IETF Logo Mail Archive

Re: [IPsec] AD review of draft-ietf-ipsecme-ikev2-multiple-ke-06

Roman Danyliw <rdd@cert.org> Mon, 10 October 2022 20:27 UTC

Return-Path: <rdd@cert.org>
X-Original-To: ipsec@ietfa.amsl.com
Delivered-To: ipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9022C15271B for <ipsec@ietfa.amsl.com>; Mon, 10 Oct 2022 13:27:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.105
X-Spam-Level:
X-Spam-Status: No, score=-2.105 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kr18_t__19t0 for <ipsec@ietfa.amsl.com>; Mon, 10 Oct 2022 13:27:20 -0700 (PDT)
Received: from USG02-BN3-obe.outbound.protection.office365.us (mail-bn3usg02on0128.outbound.protection.office365.us [23.103.208.128]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 78BCAC1526E9 for <ipsec@ietf.org>; Mon, 10 Oct 2022 13:27:19 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector5401; d=microsoft.com; cv=none; b=t6ueNyCI2BwxrXn/Ucbbcxnpej49ufJ12/2JrqNruVff3r5/3FcIt+DQTwMOUb9nfWBYgLk+jpET/NFkTBGiZBkWx+W0iHeJo6rFLYKImzg4O3SrM+7UfE9uccrl73XHqyyV0mH27kiJuQTv2ThTbrH71K9S72PClhiysvTBBbA5quKW2lHx3QW0p/rcbf/I3Eza237hLTsFI7vjXbvAkI+9j5Az4O6lhkAfT5SCFpTisygpKSNPvlBS6Y9j/6lYSjAzZtrP/MdmfY6U+AgsfdOIsLDSS0nBug0Zpz57esAHumlMQMZuzpuv7+LBwVbI3NBhUbm2jyY/ynxsOasb/g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector5401; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=FH/LOodM1cGJOBsuqa2Jy2KAb89Mf32lRSUOAfXbj/c=; b=pKGz530qK85QSEtOgoJkp4Puiqhe4DDOrikbXqEhJPpVgHhyW1DO/nVI7QeRgtaMKGS/LGytQ686tpYp2HRVYcJAJY9YsjIJUvPk6w+JLmKkg3duXO/OQmkkwKUEUINkZjnaLFmQd75GLogmj8x7OE6B27AprqtgjrL7S4hiVQCoK1cWOee+DbN45JcNNtFRmMCdav2vGfgT3UqGYL4UZAyUif+jvEKCr0cMbPG0NME0Vuevcyp+FDA9dERxI57DCs5nfq3+pk+AFJVHSzRWWFT2gQPlUxX3cckEQeKqSknEtI90l+t/NzUXe2xV2LLs1nfchl6HKjIiq21cRVZOAA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cert.org; dmarc=pass action=none header.from=cert.org; dkim=pass header.d=cert.org; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FH/LOodM1cGJOBsuqa2Jy2KAb89Mf32lRSUOAfXbj/c=; b=O66hyaaIV6ObxXYdr486WJqmxdcO/9qOl7CtbeFRBevQRZaXOJLQ7cdy/eN9n1bbpGbfTnVgP1USnaARI4SE4JXnwwy/n6/g4RoB6g3yYlHw8gnKne8U6jLWZsDjge6qrekKh11IjQsB/OFLQb0mM3MsTnwptbqMvjY2Wzs6DXI=
Received: from BN2P110MB1107.NAMP110.PROD.OUTLOOK.COM (2001:489a:200:168::11) by BN2P110MB1073.NAMP110.PROD.OUTLOOK.COM (2001:489a:200:16b::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5676.19; Mon, 10 Oct 2022 20:27:16 +0000
Received: from BN2P110MB1107.NAMP110.PROD.OUTLOOK.COM ([fe80::dbc:d573:57cb:e0e1]) by BN2P110MB1107.NAMP110.PROD.OUTLOOK.COM ([fe80::dbc:d573:57cb:e0e1%6]) with mapi id 15.20.5676.040; Mon, 10 Oct 2022 20:27:16 +0000
From: Roman Danyliw <rdd@cert.org>
To: CJ Tjhai <cjt@post-quantum.com>
CC: Valery Smyslov <svan@elvis.ru>, "ipsec@ietf.org" <ipsec@ietf.org>
Thread-Topic: [IPsec] AD review of draft-ietf-ipsecme-ikev2-multiple-ke-06
Thread-Index: AdjVFve8l6i95Y8RTMyDGHjJmSSKlwDP4BIAASQCDkA=
Date: Mon, 10 Oct 2022 20:27:16 +0000
Message-ID: <BN2P110MB110794ABA44832BD530B05D7DC209@BN2P110MB1107.NAMP110.PROD.OUTLOOK.COM>
References: <BN2P110MB1107D456BF345148FADD88CFDC569@BN2P110MB1107.NAMP110.PROD.OUTLOOK.COM> <CANs=h-WWnrdv5+ewjKVnBdoC4X4eTosM5uZ1BDfED1EJ=V9UFw@mail.gmail.com>
In-Reply-To: <CANs=h-WWnrdv5+ewjKVnBdoC4X4eTosM5uZ1BDfED1EJ=V9UFw@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cert.org;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: BN2P110MB1107:EE_|BN2P110MB1073:EE_
x-ms-office365-filtering-correlation-id: 9b9712fb-0012-4f8f-ef97-08daaafdd2e4
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: +JDwaUfc2onZrL44PMpX0re46BzW2DTFiDCpfqbmNbwP1ZJo/FEVlZuISD0fqX7Ov5mOUKUIMRv9AKtwcItu8ZA0lCUjR6PQdlCw6RI6WPEn2sjCsvhiLroHMchrSiqQ9GlgIny/RRvuq6oRXnPJ7Btlu//fPivzekTfTrGh35wQDcyxa37YTUTAvRw0ixD2vL9AveLL3LkaFfO64ArIUfcSuPXkxwRah26KlojbYe9sRiVe4gVnveaxdT1PRpsocaSPA8nx5zHHm6gWAfvZOToOYk4EiKv7DDHfirIQlOE5CtLPthChNw2C21Z2PM+Efv9uOB8T563gArRH+DFK3shkByNBpBQDhCyyAqgHOFnxqh8/w2NqD9gph4//yLdafIfzDF1JCAgbMTu8wKvQhbfSODXibasNN2uowuiAz92RuZamMnljTX1MjqyG2k71aFCCxK2vtByfG0sQO4IDPPgeaMuXy1vWWiB26VgMQF4BrlqQoQL7Zy6/kvTLavptzolDpU1/R6CsNDyoxvdJqwO4vesdKxzbsaFg7kL5p5ySTWED9qQjfy0uAsJq5RjeenxktfORh7XOztjkM+hTXb0DzKbKPihat9S33683W9hWUDzNbQXAqSw8JOEskZk8qzcGHdmhnOvsCbJxMOuhjLtlRJOe6/YdeJfBMfOzq1Cq5tHRIoGZsoBNiAKWs257vjcXAQKjg8hIdFxhCvMHrA==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BN2P110MB1107.NAMP110.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230022)(366004)(451199015)(8936002)(166002)(2906002)(6916009)(52536014)(86362001)(33656002)(54906003)(966005)(64756008)(8676002)(66946007)(5660300002)(4326008)(66446008)(66476007)(66556008)(38100700002)(83380400001)(122000001)(76116006)(55016003)(9686003)(26005)(7696005)(6506007)(498600001)(71200400001)(186003)(38070700005)(53546011)(82960400001); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: bqgc5ToSMQSolDa0MzuxbbJh9bruMg+wPmuJxa0wl1WeeiokAM08lITmM3C/o1oya93ccbhsO1mu1qeM8nJmXAnu1ElLgkMP16cpPlnwgG60YXxCaDrVDcQWXF5kYuFKRu8OFlaVQXl4X7CBnDPrt5V8xAbvC/vfJXikUycwzHKMnUHFR4FuyP5cJun+GYCBDaVX7DDhP8qltyqvjVDDq5NPv9hdBzq9TCr3NOC0QaYHB1zLDAEcJcBrZw8p32SviqZr2tp8rDIRjvgSwZBcc3tDCt0slzFg4zcNUQp78X7wX7zxa1urjLUfYrrsnkHoJA2I9e5MXAov3hGxZjH0gXvbuVuH32gN2Qzm0++2hkBfcKeUIGwYcLtFMata9yaXQTeQBonUrrwU995TMl4fM5weGSZyfOfKXhAmNY0jATM=
Content-Type: multipart/alternative; boundary="_000_BN2P110MB110794ABA44832BD530B05D7DC209BN2P110MB1107NAMP_"
MIME-Version: 1.0
X-OriginatorOrg: cert.org
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN2P110MB1107.NAMP110.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 9b9712fb-0012-4f8f-ef97-08daaafdd2e4
X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Oct 2022 20:27:16.7700 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 95a9dce2-04f2-4043-995d-1ec3861911c6
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN2P110MB1073
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipsec/UYQpjziXwN3foA0TeTVsIcTVM0A>
Subject: Re: [IPsec] AD review of draft-ietf-ipsecme-ikev2-multiple-ke-06
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipsec/>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Oct 2022 20:27:25 -0000

Hi!

From: CJ Tjhai <cjt@post-quantum.com>
Sent: Tuesday, October 4, 2022 9:05 PM
To: Roman Danyliw <rdd@cert.org>
Cc: Valery Smyslov <svan@elvis.ru>; ipsec@ietf.org
Subject: Re: [IPsec] AD review of draft-ietf-ipsecme-ikev2-multiple-ke-06

Hi Roman,

Many thanks for the review, really appreciate it. We will update our draft and submit a revision soon.

Please see our response inline below.

Best wishes,
CJ and Valery


On Fri, 30 Sept 2022 at 23:20, Roman Danyliw <rdd@cert.org<mailto:rdd@cert.org>> wrote:
Hi!

I performed an AD review of draft-ietf-ipsecme-ikev2-multiple-ke-06.  Thanks for the work on this document.

Per the shepherd write-up:

** Question 4

Several implementors have been integral in developing this document, thus
implementors have indicated interest in implementing this. There is already
at least two interoperable implementations of this specification.

Could these implementations be explicitly named?

Just an extra to Andreas' response, the interop tests have been presented in IETF meetings and the latest one was in 2021. The slides can be found here: https://datatracker.ietf.org/meeting/111/materials/slides-111-ipsecme-hybrid-ikev2-interoperability-testing-00


** Question 5

No. The document has already been reviewed by security area people, and
the cryptographic algorithms are not part of this document, but are documented
separately. In addition reviews from cryptographers have already been received
to the basic protocol.

With no disrespect intended to the expertise of the authors, what is the process used by the WG to review the robustness of the cryptographic mechanisms?  Was there an independent assessment beyond those on the author team?  Did the Crypto Panel have an independent look?

In terms of independent assessment, there is a paper on the formal proof analysis of the extension introduced in the draft: https://www.mnm-team.org/pub/Publikationen/gggh21b/PDF-Version/gggh21b.pdf

[Roman] Thanks for this pointer.  I’ll add that to the Shepherd Review citing it from the ACSAC 2021 proceedings (https://dl.acm.org/doi/10.1145/3485832.3485885).

Roman

v2.23.0 | Report a Bug | By Email