Re: [IPsec] Comments to the g-ikev2

[Tero Kivinen <[e-mail]>]

Valery Smyslov writes:
> After some thinking and recollecting I realized, that things are not that
> simple.
> It's true that SK_w is derived in QC-resistant way, but it is only used
> for providing confidentiality of the wrapped keys. Note, that their
> authenticity and integrity is provided only on G-IKEv2 message level, 
> so it is SK_a[i/r] that are responsible for these properties, and 
> these keys are not QC-resistant. So, a QC-equipped attacker
> cannot learn the keys, but can substitute them if they are
> transferred in GSA_AUTH. 

True, but note, that this requires active attack with real time attack
against the IKEv2 Diffie-Hellman.

The main reason for PPK is to provide protection against the store and
attack later cases, i.e., where attackers store all traffic now, and
then later break the Diffie-Hellman and then can see the traffic keys
and then will be able to decrypt the traffic protected by those keys.

I.e. PPK is not properly trying to protect against the cases where
there is real time quantum computers, for that we most likely need to
have quantum safe key exchange, and authentication algorithms too,
i.e., multiple-ke and ikev2 intermediate...

I think we can simply document this to the security considerations
section saying that if that kind of protection against real time
attacks is needed then quantum safe key exchange is needed, and most
likely also quantum safe authentication algorithms...
-- 
[e-mail]