[IPsec] DH Tests draft - failure behavior

[Yaron Sheffer <[e-mail]>]

Following up on the discussion we just had:

Paul raised the question whether we should respond with an error message 
in case any of the tests fail. We know from many examples that errors 
can reveal secret information.

However in this particular case:

- All IKEv2 DH groups are public information.
- All of the proposed tests only depend on public information, plus the 
information received from the sender in the clear. In other words, the 
test could just as well be performed by an eavesdropper.

The only thing that such an error message does reveal is that the 
receiver implements the test, but this is something that an attacker can 
find out anyway.

Which is why I think we should treat such failures as a normal syntax 
error, and respond with an error message, as a courtesy to the sender.

We should make these considerations explicit in the draft, specifically 
that the groups are well known.

Thanks,
     Yaron