Subject: [IPsec] Issue #57: Clarify D-H transform

From: Yaron Sheffer <[email-masked]>
Date: Sun, 3 May 2009 22:48:56 +0300

Yaron: 

3.3.2: there is no explanation here or elsewhere that the D-H transform for
ESP and AH is used for PFS.

Paul (off list):

Not done. I don't think it belongs in 3.3.2, and I also don't agree that the
transform is "the D-H transform for ESP and AH is used for PFS"; that's an
oversimplification.

Yaron: I will settle for 1.3.1, and/or 1.3.3.

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 4 May 2009 14:53:42 +0300

> Yaron: I will settle for 1.3.1, and/or 1.3.3.

It is not clear for me what kind of text you want to add to there. Can
you propose some text so it would be easier to understand what the
issue here is?
-- 
[email-masked]

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 4 May 2009 16:08:45 +0300

Hi Tero,

Sec. 3.3.2 mentions that you negotiate a D-H group for ESP/AH, even though
you only need encryption and integrity transforms for these protocols. I
find it confusing, certainly for newcomers. For clarity, I suggest to add
after the table in Sec. 3.3.3, this text:

Although ESP and AH do not directly include a Diffie Hellman exchange, a D-H
group MAY be negotiated for the Child SA. This allows the peers to employ
D-H in the CREATE_CHILD_SA exchange, providing Perfect Forward Secrecy for
the generated Child SA keys.

Thanks,
	Yaron

> -----Original Message-----
> From: Tero Kivinen [mailto:[email-masked]]
> Sent: Monday, May 04, 2009 14:54
> To: Yaron Sheffer
> Cc: IPsecme WG
> Subject: [IPsec] Issue #57: Clarify D-H transform
> 
> Yaron Sheffer writes:
> > Yaron:
> >
> Scanned by Check Point Total Security Gateway.

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 5 May 2009 14:02:56 +0300

> the generated Child SA keys.

Ok, I see no problem adding that text, and I think it really belongs
to the 3.3.2 as you originally requested, not in 1.3.1/1.3.3.

The section 1.3 section already describes about KE payloads and PFS:

1.3.  The CREATE_CHILD_SA Exchange
....
   The CREATE_CHILD_SA request MAY optionally contain a KE payload for
   an additional Diffie-Hellman exchange to enable stronger guarantees
   of forward secrecy for the Child SA.  The keying material for the
   Child SA is a function of SK_d established during the establishment
   of the IKE SA, the nonces exchanged during the CREATE_CHILD_SA
   exchange, and the Diffie-Hellman value (if KE payloads are included
   in the CREATE_CHILD_SA exchange).
-- 
[email-masked]