Subject: [Ipsec] IKEv1 Security Considerations

From: Tero Kivinen <[email-masked]>
Date: Tue, 4 Apr 2006 15:22:05 +0300

Russ Housley writes:
> RFC 2409 says:
> 
>     Repeated re-keying using Quick Mode can consume the entropy of the
>     Diffie-Hellman shared secret. Implementors should take note of this
>     fact and set a limit on Quick Mode Exchanges between exponentiations.
>     This memo does not prescribe such a limit.
> 
> What limit do implementors impose?

Usually none.

There are quite a many people who do not really agree on that text. I
do not think entropy really get consumed, but of course the value of
breaking that one Diffie-Hellman increases when more and more keying
material is derived from it.

In most implementations IKE SAs do have lifetime that is around few
hours (from 4-8 hours or so), and using gigabit link with 3DES means
you need to rekey avery few minutes, which would mean that you would
be doing around 50 quick mode exchanges before the IKE SA expires.
The 50 unknown keying materials generated from the same Diffie-Hellman
secret, should yet give any way to crack that Diffie-Hellman itself. 
-- 
[email-masked]

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Russ Housley <[email-masked]>
Date: Tue, 04 Apr 2006 11:35:15 -0400

I agree with your words, but it is probably not worth the effort to 
update this paragraph.

Russ

---

From: Derrell Piper <[email-masked]>
Date: Wed, 5 Apr 2006 14:58:52 -0700

I can't imagine it could be.  I mean, it's completely dependent on  
the size of your pipe.  What would be the right answer for a 1.5Mb  
branch office isn't right for a gigabit ISP.  Practically speaking,  
expiring your IKE SAs every 4-8 hours is a reasonable built-in  
default, which is what most vendors are doing and nearly every  
implementation also lets you configure that limit anyway.  So I don't  
see that there's a problem we need to solve by amending the RFC even  
if we could agree on what that number should be...  :-)

Derrell