Subject: CREATE_CHILD_SA exchange with PFS

From: burkhard <[email-masked]>
Date: Sun, 26 Jan 2003 19:26:26 +0000

Hallo all,

I have the following question about <draft-ietf-ipsec-ikev2-04.txt>.

Am I allowed to use after the Initial phase 1 Exchange the CREATE_CHILD_SA
exchange with PFS or is the CREATE_CHILD_SA exchange with PFS only intended
to be for rekeying at a later stage?

My understanding by reading the draft is that CREATE_CHILD_SA exchange with
PFS is not allowed to be piggybacked on the phase 1 exchange, therefore if I
whish to use PFS I need to do a CREATE_CHILD_SA exchange. This will result
in 4 Initial phase 1 Exchange transmissions and 2 for the CREATE_CHILD_SA
creation with PFS.

Does it make sense to use a CREATE_CHILD_SA exchange with PFS straight after
the Initial phase 1 Exchange?

Burkhard

Excerpt from Draft follows:
----------------------------------------------------------------------------
-
4.16 Generating Keying Material for CHILD-SAs

   CHILD-SAs are created either by being piggybacked on the phase 1
   exchange, or in a phase 2 CREATE_CHILD_SA exchange. Keying material
   for them is generated as follows:

      KEYMAT = prf+(SK_d, Ni | Nr)

   Where Ni and Nr are the Nonces from the IKE_SA_INIT exchange if this
   request is the first CHILD-SA created or the fresh Ni and Nr from the
   CREATE_CHILD_SA exchange if this is a subsequent creation.

   For phase 2 exchanges with PFS the keying material is defined as:

IKEv2                                                      [Page 27]

INTERNET DRAFT                                              January 2003

      KEYMAT = prf+(SK_d, g^ir (ph2) | Ni | Nr )

   where g^ir (ph2) is the shared secret from the ephemeral Diffie-
   Hellman exchange of this phase 2 exchange,

   A single CHILD-SA negotiation may result in multiple security
   associations. ESP and AH SAs exist in pairs (one in each direction),
   and four SAs could be created in a single CHILD-SA negotiation if a
   combination of ESP and AH is being negotiated.  KEYMAT is generated
   as described in section 4.13.

   Keying material is taken from the expanded KEYMAT in the following
   order:

      All keys for SAs carrying data from the initiator to the responder
      are taken before SAs going in the reverse direction.

      If multiple protocols are negotiated, keying material is taken in
      the order in which the protocol headers will appear in the
      encapsulated packet.

      If a single protocol has both encryption and authentication keys,
      the encryption key is taken from the first octets of KEYMAT and
      the authentication key is taken from the next octets.

   Each cryptographic algorithm takes a fixed number of bits of keying
   material specified as part of the algorithm.

4.17 Rekeying IKE-SAs using a CREATE_CHILD_SA exchange

   The CREATE_CHILD_SA exchange can be used to re-key an existing IKE-SA
   (see section 4.8).  New Initiator and Responder SPIs are supplied in
   the SPI fields. The TS payloads are omitted when rekeying an IKE-SA.
   SKEYSEED for the new IKE-SA is computed using SK_d from the existing
   IKE-SA as follows:

       SKEYSEED = prf(SK_d (old), [g^ir (ph2)] | Ni | Nr)

   where g^ir (ph2) is the shared secret from the ephemeral Diffie-
   Hellman exchange of this phase 2 exchange and Ni and Nr are the two
   nonces stripped of any headers.

   The new IKE-SA MUST reset its message counters to 0.

   SK_d, SK_ai, SK_ar, and SK_ei, and SK_er are computed from SKEYSEED
   as specified in section 4.14.