Subject: Re: CREATE_CHILD_SA exchange with PFS

From: [email-masked]
Date: Sat, 1 Feb 2003 18:09:44 -0500

burkhard <[email-masked]> wrote on 01/26/2003 02:26:26 PM:
> Hallo all,
>
> I have the following question about <draft-ietf-ipsec-ikev2-04.txt>.
>
> Am I allowed to use after the Initial phase 1 Exchange the
CREATE_CHILD_SA
> exchange with PFS or is the CREATE_CHILD_SA exchange with PFS only
intended
> to be for rekeying at a later stage?
>
> My understanding by reading the draft is that CREATE_CHILD_SA exchange
with
> PFS is not allowed to be piggybacked on the phase 1 exchange, therefore
if I
> whish to use PFS I need to do a CREATE_CHILD_SA exchange. This will
result
> in 4 Initial phase 1 Exchange transmissions and 2 for the CREATE_CHILD_SA
> creation with PFS.
>
> Does it make sense to use a CREATE_CHILD_SA exchange with PFS straight
after
> the Initial phase 1 Exchange?
>
> Burkhard

The current spec does not allow a second D-H exchange for the child SA set
up in the initial IKE exchange. This was to simplify the specification and
because I believe there is never any security advantage in doing so. The
purpose of subsequent D-H exchanges is to assure that even someone who has
broken into the endpoints and copied all keying material cannot in a
passive attack decrypt the data encrypted under keys derived using the
second D-H exchange. But this advantage only applies if a nontrivial
period of time elapses between the two exchanges (because protection
is only gained if the break in occurs between the two exchanges).

      --Charlie