Subject: [IPsec] draft-tjhai-ipsecme-hybrid-qske-ikev2-02: PFS for CHild SAs?

From: "Bruckert, Leonie" <[email-masked]>
Date: Wed, 15 Aug 2018 09:05:40 +0000

I'd like to put the topic PFS up for discussion, since section 3.5 Child SAs contains some (to cite Scott) weasel words.

Obviously, in order to  achieve PFS in the sense of PQ security, we need to perform at least one PQ key exchange for Child SAs. At this point of the protocol, the peers already know if both of them support PQ algorithms, so backwards compatibility should not be an issue. Furthermore, as the CREATE_CHILD_SA exchange is already encrypted and IKE fragmentation could be used, you could simply include further (PQ) KE payloads in the message.
I don't think that it is necessary to negotiate the PQ key exchange algorithms again. This would introduce more complexity. Instead you could restrict the PQ algorithms to the ones already negotiated in the IKE_AUX exchange.

Any thoughts?

Leonie

---

From: Paul Wouters <[email-masked]>
Date: Sun, 19 Aug 2018 15:15:51 -0400 (EDT)

On Wed, 15 Aug 2018, Bruckert, Leonie wrote:

> Obviously, in order to  achieve PFS in the sense of PQ security, we need to perform at least one PQ key exchange for Child SAs. At this point
> of the protocol, the peers already know if both of them support PQ algorithms, so backwards compatibility should not be an issue.
> Furthermore, as the CREATE_CHILD_SA exchange is already encrypted and IKE fragmentation could be used, you could simply include further (PQ)
> KE payloads in the message.  
> 
> I don’t think that it is necessary to negotiate the PQ key exchange algorithms again. This would introduce more complexity. Instead you could
> restrict the PQ algorithms to the ones already negotiated in the IKE_AUX exchange.

That makes sense to me.

Paul