Subject: [IPsec] Last Call: <draft-ietf-ipsecme-qr-ikev2-09.txt> (Postquantum Preshared Keys for IKEv2) to Proposed Standard

From: The IESG <[email-masked]>
Date: Wed, 11 Dec 2019 06:44:49 -0800

The IESG has received a request from the IP Security Maintenance and
Extensions WG (ipsecme) to consider the following document: - 'Postquantum
Preshared Keys for IKEv2'
  <draft-ietf-ipsecme-qr-ikev2-09.txt> as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
[email-masked] mailing lists by 2019-12-25. Exceptionally, comments may
be sent to [email-masked] instead. In either case, please retain the beginning
of the Subject line to allow automated sorting.

Abstract

   The possibility of Quantum Computers poses a serious challenge to
   cryptographic algorithms deployed widely today.  IKEv2 is one example
   of a cryptosystem that could be broken; someone storing VPN
   communications today could decrypt them at a later time when a
   Quantum Computer is available.  It is anticipated that IKEv2 will be
   extended to support quantum-secure key exchange algorithms; however
   that is not likely to happen in the near term.  To address this
   problem before then, this document describes an extension of IKEv2 to
   allow it to be resistant to a Quantum Computer, by using preshared
   keys.

The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-ipsecme-qr-ikev2/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-ipsecme-qr-ikev2/ballot/

No IPR declarations have been submitted directly on this I-D.

---

From: "Paul Hoffman" <[email-masked]>
Date: Wed, 11 Dec 2019 07:54:59 -0800

I'm glad to see this document finally make it towards standardization. 
Just a minor editorial note: capitalizing "Quantum Computers" is 
incorrect and should be fixed before it goes to the RFC Editor.

--Paul Hoffman

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 11 Dec 2019 16:23:22 +0000

We are seeing a flurry of these kind of “post quantum protection” things.  This is premature. The co-chair of the CFRG, Kenny Paterson, said so awhile back.

At best, this should be EXPERIMENTAL.

I would like to see an IESG policy that makes all drafts on this topic be EXPERIMENTAL.

---

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Wed, 11 Dec 2019 16:35:59 +0000

Did Kenny make this statement in the context of postquantum cryptography (that is, public key algorithms that are believed to be secure even if the adversary has a quantum computer)?

That would certainly be a reasonable statement (as most postquantum algorithms are fairly new, and are still being cryptographically vetted).

On the other hand, this specific draft doesn't involve any postquantum algorithms; it relies only on currently accepted algorithms, and so Kenny's caution would not apply.

> -----Original Message-----
> From: Salz, Rich <[email-masked]>
> Sent: Wednesday, December 11, 2019 11:23 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]
> Subject: Re: Last Call: <draft-ietf-ipsecme-qr-ikev2-09.txt> (Postquantum
> Preshared Keys for IKEv2) to Proposed Standard
> 
> We are seeing a flurry of these kind of “post quantum protection” things.
> This is premature. The co-chair of the CFRG, Kenny Paterson, said so awhile
> back.
>

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 11 Dec 2019 16:40:36 +0000

Slides: https://datatracker.ietf.org/meeting/99/materials/slides-99-saag-post-quantum-cryptography

Video: https://www.youtube.com/watch?v=abmd1n5WUvc&t=1451s 

On 12/11/19, 11:36 AM, "Scott Fluhrer (sfluhrer)" <[email-masked]> wrote:

---

From: "David McGrew (mcgrew)" <[email-masked]>
Date: Wed, 11 Dec 2019 17:59:51 +0000

Hi Rich,

I strongly disagree with your statement that “this is premature”, and the slides that you cite do not support that claim.  I totally agree with the points in Kenny’s slides, especially as they pertain to QKD and SDO-shopping, but they say nothing about improvements to security protocols that use quantum-resistant *symmetric* cryptography.  The Postquantum Preshared Keys for IKEv2 specification is a sound and mature specification that uses existing crypto algorithms with parameters that are widely believed to be post quantum secure. 

David

> On Dec 11, 2019, at 11:40 AM, Salz, Rich <[email-masked]> wrote:
>

---

From: "Paul Hoffman" <[email-masked]>
Date: Wed, 11 Dec 2019 10:03:47 -0800

> We are seeing a flurry of these kind of “post quantum protection” 

This is the only one I have seen that is a method, not a new key 
exchange algorithm. It is understandable that you could have missed this 
from the title which misstates the topic. A much better title would be 
"Mixing Preshared Keys in IKEv2 for Postquantum Resistance".

> This is premature.

Disagree. The method described in the document has been well-discussed 
in the IPsecME for years, getting good cryptographic review.

> The co-chair of the CFRG, Kenny Paterson, said so awhile back.

I don't think that's what he said in the slides you posted, but I've 
Cc'd him so he can reply. The slides are about picking new post-quantum 
algorithms; what is described in the draft is a method for mixing in 
preshared secrets with current algorithms.

--Paul Hoffman

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 11 Dec 2019 18:21:26 +0000

> A much better title would be 
  
That's better.

I misunderstood the document as both you and David Mcgrew kindly explained.  I withdraw my concerns and hope the title is changed.

---

From: Valery Smyslov <[email-masked]>
Date: Wed, 11 Dec 2019 21:25:01 +0300

Hi Rich,

I think that Kenny's slides only support the idea, that the draft should be Standards Track.
In particular, the slide "The Coming Crypt-Apocalypse?" has a bullet:

	* And traffic captured now could be broken later, so it’s a problem *today* if you
	have data that needs to be kept secure for decades.

That's the problem the draft solves.

Regards,
Valery.

>     Did Kenny make this statement in the context of postquantum
> cryptography (that is, public key algorithms that are believed to be secure
> even if the adversary has a quantum computer)?
> 
>     That would certainly be a reasonable statement (as most postquantum
> algorithms are fairly new, and are still being cryptographically vetted).
> 
>     On the other hand, this specific draft doesn't involve any postquantum
> algorithms; it relies only on currently accepted algorithms, and so Kenny's
> caution would not apply.
>

---

From: Yoav Nir <[email-masked]>
Date: Wed, 11 Dec 2019 21:11:35 +0200

Hi, Paul

> On 11 Dec 2019, at 20:03, Paul Hoffman <[email-masked]> wrote:
> 
> This is the only one I have seen that is a method, not a new key exchange algorithm. It is understandable that you could have missed this from the title which misstates the topic. A much better title would be "Mixing Preshared Keys in IKEv2 for Postquantum Resistance".

Should we consider this a last call comment?

Yoav

---

From: "Paul Hoffman" <[email-masked]>
Date: Wed, 11 Dec 2019 14:04:24 -0800

On 11 Dec 2019, at 11:11, Yoav Nir wrote:

>> exchange algorithm. It is understandable that you could have missed 
>> this from the title which misstates the topic. A much better title 
>> would be "Mixing Preshared Keys in IKEv2 for Postquantum Resistance".
>

Yes, please do.

--Paul Hoffman

---

From: Paul Wouters <[email-masked]>
Date: Fri, 13 Dec 2019 15:28:20 -0500 (EST)

> I misunderstood the document as both you and David Mcgrew kindly explained.  I withdraw my concerns and hope the title is changed.

I am fine with the title change (and publication). We have long ago
implemented this and performed a number of interop tests.

Paul