Re: [IPsec] Proposed method to achieve quantum resistant IKEv2

[Cen Jung Tjhai <[e-mail]>]

Hi Scott,

>> The other question about your proposed mechanism is how does it work; you just outline
>> a way to exchange ‘quantum resistant’ blobs, and don’t say how those blobs actually work.
>> I’m not talking about the cryptography, I’m talking about the authentication.  For an
>> authentication mechanism to work (for Alice to authenticate to Bob), we must have:
>> - Alice can generate the Blob
>> - Eve cannot generate the Blob
>> - Bob can verify that the Blob was generated properly
>> Saying “postquantum” doesn’t change the underlying problem.  You don’t specify how this
>> works (e.g. what Alice and Bob knows), and why the current authentication mechanisms
>> already in IKE aren’t sufficient

I wonder if there is a confusion there. The text basically proposed a method to do fragmentation of payloads carrying post-quantum public data in IKE_SA_INIT exchange and deal with backward compatibility.

In terms of authentication, those post-quantum blob fragments will need to be signed as per RFC7296. We don’t claim that the authentication is post-quantum. However, we do recognise that future mechanism can be introduced to make the authentication post-quantum, as you point out using post-quantum certificate for example.

Or have I misunderstood you?

Best regards,
CJ