Subject: Re: [Ipsec] IKEv1 Security Considerations

From: "Dan Harkins" <[email-masked]>
Date: Sat, 13 May 2006 00:22:50 -0700 (PDT)

Hi Tero,

  I can't really say I'm too happy with the term "consumed entropy"
either but there is a reason you want to rekey the IKE SA after a
certain number of Quick Mode rekeys.

  You're right that the value of breaking the Diffie-Hellman secret
increases when more keys are derived from it. It also increases when the
information being protected by those keys is high. Regardless though,
you want to rekey the IKE SA after a certain number of Quick Mode
rekeys. Can you articulate a reason why that does not use the words
"consumed" and "entropy"?

  Dan.

> Russ Housley writes:
>> RFC 2409 says:
>>
>>     Repeated re-keying using Quick Mode can consume the entropy of the
>>     Diffie-Hellman shared secret. Implementors should take note of this
>>     fact and set a limit on Quick Mode Exchanges between
>> exponentiations.
>>     This memo does not prescribe such a limit.
>>
>> What limit do implementors impose?
>
> Usually none.
>
> There are quite a many people who do not really agree on that text. I
> do not think entropy really get consumed, but of course the value of
> breaking that one Diffie-Hellman increases when more and more keying
> material is derived from it.
>
> In most implementations IKE SAs do have lifetime that is around few
> hours (from 4-8 hours or so), and using gigabit link with 3DES means
> you need to rekey avery few minutes, which would mean that you would
> be doing around 50 quick mode exchanges before the IKE SA expires.
> The 50 unknown keying materials generated from the same Diffie-Hellman
> secret, should yet give any way to crack that Diffie-Hellman itself.
> --
> [email-masked]
>
> _______________________________________________
> Ipsec mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ipsec
>

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec