Subject: [IPsec] Preliminary minutes from today's meeting

From: Paul Hoffman <[email-masked]>
Date: Tue, 12 Mar 2013 14:28:22 -0400

...are at http://www.ietf.org/proceedings/86/minutes/minutes-86-ipsecme

Please send changes *to the minutes* to the list. If you want to discuss something that was discussed in the minutes, please start a new mail thread. Thanks! (And thanks to Dan Harkins for turning these around quickly.)

--Paul Hoffman

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 12 Mar 2013 21:43:01 +0200

Paul Hoffman writes:
> Please send changes *to the minutes* to the list. If you want to
> discuss something that was discussed in the minutes, please start a
> new mail thread. Thanks! (And thanks to Dan Harkins for turning
> these around quickly.) 

Very good Dan... Thanks... Some comments:

----------------------------------------------------------------------
  * D-H tests for IKEv2 (Tero Kivinen)
...
    - tests are required if using ECDH or reusing public keys or
				       ^^
      using groups with a small subgroup.
----------------------------------------------------------------------

That "or" needs to be "and". I.e. test are required if using ECDH and
reusing public keys. I.e. both are required.

----------------------------------------------------------------------
    - Jabber! Yaron says "this is true already."
----------------------------------------------------------------------

I think that reply was to answer to Paul's comment that the draft
should support different types of groups we have out there.
-- 
[email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 12 Mar 2013 16:20:22 -0400

Both things are fixed and uploaded.

--Paul Hoffman

---

From: Daniel Migault <[email-masked]>
Date: Tue, 12 Mar 2013 21:21:13 +0100

Hi,

RFC XYZ is RFC5566. Thanks for the minutes.

BR,

Daniel

On Tue, Mar 12, 2013 at 8:43 PM, Tero Kivinen <[email-masked]> wrote:

> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58

---

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Tue, 12 Mar 2013 20:26:25 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Tero Kivinen
> Sent: Tuesday, March 12, 2013 3:43 PM
> To: Paul Hoffman
> Cc: IPsecme WG
> Subject: [IPsec] Preliminary minutes from today's meeting
> 
> Paul Hoffman writes:
> > ...are at
> > http://www.ietf.org/proceedings/86/minutes/minutes-86-ipsecme
> >
> > new mail thread. Thanks! (And thanks to Dan Harkins for turning these
> > around quickly.)
> 
> That "or" needs to be "and". I.e. test are required if using ECDH and reusing
> public keys. I.e. both are required.

Actually, the condition is "reusing public keys AND (ECDH OR groups with a small subgroup)"

That is,

- If you're not reusing public keys, well, the attacker can learn something about the DH private key that you used when negotiating with him, however that doesn't tell him about what you used on any other SA

- If you are reusing public keys, then he can learn a lot of information with ECDH, and some information with a MODP group with a small subgroup, by injecting an illegal value, and seeing how the other side reacts (that is, what keys he derives).

> I think that reply was to answer to Paul's comment that the draft should
> support different types of groups we have out there.
> --
> [email-masked]

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 12 Mar 2013 22:32:29 +0200

And to clarify my cryptic comment below, I meant that the draft already 
covers all DH groups currently specified for IKEv2 (i.e. those that have 
an IANA allocation plus the new Brainpool stuff). I cannot confirm - but 
maybe Scott can - that we cover any weird curve that's ever crossed 
DJB's mind.

Thanks,
	Yaron