Subject: [IPsec] About PFS for first CHILD_SA

From: "Anil Bollineni" <[email-masked]>
Date: Mon, 1 Oct 2007 16:26:11 -0700

Hi there,

I would like to know how PFS is achieved for first CHILD_SA that is
created as part of piggyback in AUTH exchange.

RFC 4306 says no KE will be exchanged and RFC 4718 says no D-H group is
exchanged for first CHILD_SA. 

Does it mean the first CHILD_SA will inherit all keys from first
SA_INIT? 

If anybody know the answer for this, can you please tell to me?

Thanks in Advance,

Anil

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: [email-masked]
Date: Mon, 1 Oct 2007 21:18:26 -0400

Anil,

> created as part of piggyback in AUTH exchange.

PFS against what?  The IKE SA and the first child SA are created at
essentially the same time.  There isn't anything previous against
which to provide forward secrecy.  

> exchanged for first CHILD_SA.

And there are no Nonces for the first CHILD_SA, either.

SA_INIT?

Not exactly.  See the first part of Section 2.17 of RFC 4306 - the
Ni and Nr inputs are from the SA_INIT, but the SK_d input comes from
the keying material generated for the IKE_SA (see Section 2.14).

So, the keys for the two SAs are separate, but they all depend on the
SKEYSEED master secret (Section 2.14).

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------