Subject: CREATE_CHILD_SA exchange with PFS

From: 96985283 <[email-masked]>
Date: Mon, 03 Feb 2003 19:29:52 +0000

Charlie thanks for your explanations.

I tried to summaries you mail:

>The current spec does not allow a second D-H exchange for the child SA set
>up in the initial IKE exchange.

The first initial IKE exchange (4 messages) and the CREATE_CHILD_SA with PFS 
(2 new messages) is not allowed to come direct after the first initial IKE 
exchange. Therefore I need to piggyback the child SA on the first initial IKE 
and use the following KEYMAT = prf+(SK_d, Ni | Nr). The first initial IKE 
exchange is always 4 messages long.

KEYMAT = prf+(SK_d, g^ir (ph2) | Ni | Nr ) is only used for CREATE_CHILD_SA 
establishment with PFS at later stage in the IKE exchange and never direct 
after the first initial IKE exchange (4 messages).

>This was to simplify the specification and
>because I believe there is never any security advantage in doing so. The
>purpose of subsequent D-H exchanges is to assure that even someone who has
>broken into the endpoints and copied all keying material cannot in a
>passive attack decrypt the data encrypted under keys derived using the
>second D-H exchange. But this advantage only applies if a nontrivial
>period of time elapses between the two exchanges (because protection
>Is only gained if the break in occurs between the two exchanges).

CREATE_CHILD_SA IKE with PFS direct after the initial IKE does not add more 
protection to the IKE exchange at all.

Thanks for the help,

Burkhard