Subject: Re: [IPsec] RFC7296 (IKEv2) IKE SA creation question

From: Ivo Sedlacek <[email-masked]>
Date: Thu, 23 Aug 2018 05:31:55 +0000

Hello,

RFC7296 states:
----------------
>>The first two exchanges of messages
   establishing an IKE SA are called the IKE_SA_INIT exchange and the
   IKE_AUTH exchange<<; subsequent IKE exchanges are called either
   CREATE_CHILD_SA exchanges or INFORMATIONAL exchanges.
----------------
and
----------------
   If the failure is related to creating the IKE SA (for example, an
   AUTHENTICATION_FAILED Notify error message is returned), >>the IKE SA
   is not created<<.
----------------
and
----------------
   In >>an IKE_AUTH exchange<<, or in the INFORMATIONAL exchange immediately
   following it (in case an error happened when processing a response to
   IKE_AUTH), the UNSUPPORTED_CRITICAL_PAYLOAD, INVALID_SYNTAX, and
   AUTHENTICATION_FAILED notifications are the only ones to cause the
   IKE SA to be deleted or >>not created<<, without a Delete payload.
----------------

I interpret the above to mean that IKE SA is created only after completion of IKE_AUTH exchange.

Kind regards

Ivo Sedlacek

From: Liu, Jennifer (Nokia - US/Plano) <[email-masked]>
Sent: Wednesday, August 22, 2018 1:10 PM
To: [email-masked]
Cc: Paul Hoffman <[email-masked]>; [email-masked]; Ivo Sedlacek <[email-masked]>
Subject: RFC7296 (IKEv2) IKE SA creation question

Hi, All,

3GPP CT1 workgroup is currently working on developing 5G related standards and we have some questions related to RFC7296 regarding IKE SA creation time. Paul suggested me to post the questions to IPsecME mailing list.  Your feedback/clarification would be very much appreciated.

According RFC7296, after IKE_SA_INIT exchange, session key is established after Diffie-Hellman exchange, which means all subsequent messages are protected. This seems to mean that IKE SA is already created after IKE_SA_INIT, then first child SA is established after IKE_AUTH exchange.  Is this understanding correct? i.e. Is IKE SA created after IKE_SA_INIT exchange or after IKE_AUTH exchange?

-------<snip>------------------------
The first pair of messages (IKE_SA_INIT) negotiate
cryptographic algorithms, exchange nonces, and do a Diffie-Hellman
exchange [DH].

The second pair of messages (IKE_AUTH) authenticate the previous
messages, exchange identities and certificates, and establish the
first Child SA.

Regards,
Jennifer

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 23 Aug 2018 15:18:17 +0300

> RFC7296 states:

Your understanding is correct. IKE SA is created only after
successfull IKE_AUTH exchange. 

> 3GPP CT1 workgroup is currently working on developing 5G related standards and
> we have some questions related to RFC7296 regarding IKE SA creation time. Paul
> suggested me to post the questions to IPsecME mailing list.  Your feedback/
> clarification would be very much appreciated.
> 
> According RFC7296, after IKE_SA_INIT exchange, session key is established
> after Diffie-Hellman exchange, which means all subsequent messages are
> protected.

Session keys are established and messages are protected, but the whole
SA is not yet authenticated. I.e., even if we know that the messages
are encrypted and MACed, we do not know if they are coming from the
node we think they are coming from. 

> This seems to mean that IKE SA is already created after IKE_SA_INIT,
> then first child SA is established after IKE_AUTH exchange. Is this
> understanding correct? i.e. Is IKE SA created after IKE_SA_INIT
> exchange or after IKE_AUTH exchange?

IKE_AUTH as the name says, authenticates the peers. I.e., only after
that we actually know who is on the other end of the IKE SA, and we
know that there cannot be man-in-the-middle attacker there. IKE_AUTH
is required part for making IKE SA, and in addition to that it can
also optionally create first Child SA. Note, that the first Child SA
creation can fail, but still the IKE SA will be created, and also
using Childless Inititiation of IKEv2 (RFC6023) the Child SA creation
is not even tried, but IKE_AUTH is still needed to create the IKE SA. 

-- 
[email-masked]