Subject: [MSEC] Re: Position statement on IKE development

From: "Steven M. Bellovin" <[email-masked]>
Date: Sat, 04 Aug 2001 09:12:51 -0400

In message <[email-masked]>, Henry Spe
ncer writes:
>
>On Thu, 2 Aug 2001, Alex Alten wrote:
>> ...Their suggestion to use a process like NIST's for selecting
>> the AES standard is an excellent one. It's a pity they did not suggest
>> it a decade ago. However it should be considered seriously not only
>> for the replacement of IKE, but possibly also for the modification or
>> simplification of the entire IPsec protocol suite...
>
>I think this is throwing the baby out with the bathwater.
>
>While the packet-level parts (ESP etc.) do have some flaws, most of those
>can be fixed simply by taking a big black pen and crossing out superfluous
>parts of the existing specs (e.g., all of RFC 2402).  While there is room
>for some debate about exactly which parts should be crossed out (e.g.,
>there are people who still think AH is useful), I think there would be
>little or no support for redesigning the surviving parts.  So a design
>competition does not seem very useful in this area.  Moreover, *this* is
>the area where there is massive investment in silicon, solder traces, etc. 
>Just deleting features does not, by and large, invalidate that investment.
>
>IKE is the disaster area.  The rest of IPsec could use some judicious
>featurectomies, but is not badly broken.

Agreed.  And large parts of the Schneier/Ferguson analysis of the 
packet-level parts are just plain wrong.

		--Steve Bellovin, http://www.research.att.com/~smb

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: Alex Alten <[email-masked]>
Date: Sat, 04 Aug 2001 14:42:27 -0700

>packet-level parts are just plain wrong.

Steve, with all due respect, you, Jeff and Marcus stated the following.

"In the several years since the standardization of the IPSEC protocols
(ESP, AH, and ISAKMP/IKE), there have come to light several security
problems with the protocols, most notably the key-agreement protocol,
IKE.  Formal and semi-formal analyses by Meadows, Schneier et al, and
Simpson, have shown that the security problems in IKE stem directly
from its complexity."

If IKE is no longer considered viable because of it's complexity, then
I am concerned that the other protocols of IPsec are also at risk. This
is not my concern alone, others have expressed it to me as well.

At this point, to restore confidence in the security of the design I 
would hope that the IETF will retain the services of a quality 
cryptanalysis consulting firm and publish the results.  To do otherwise
will be to risk the discrediting of the entire IPsec standard.

Sincerely,

- Alex

--

Alex Alten

[email-masked]