Re: [IPsec] IKEv2 Diffie-Hellman Elliptic curve mess (RFC4753, RFC5114, RFC4869, and draft-solinas-rfc4753bis-01)

[Tero Kivinen <[e-mail]>]

Dan Harkins writes:
>   My understanding of Tero's mail is that the code was originally written
> in 2001. It was modified sometime in 2007 to add "y". Then in July 2009
> it was changed to not add "y". So I think there is a problem for a product
> shipped from sometime in 2007 to July 2009 when it interoperates with
> product from outside that window, either before or after.

Yes. 

> And that problem will not go away by defining new numbers.

It does, as if none of the new versions include support for those
groups at all using those numbers (as they are obsoleted), then those
old unpatched versions are getting policy mismatch instead of MAC
failures, and they can fix their policy to use MODP groups.

>   We are going to have unconditional interoperability for new
> implementations whether we define new numbers or just clean up the
> existing specification.

No, as every time one of those new implementations talks to old
implementation following RFC4753 without errata, there will be MAC
failure which is hard to diagnostic.

If new version does not ever include old ECP group numbers in their SA
proposals, there is no way new versions and old versions could even
try to negotiate ECP groups, thus they would fall back to modp groups,
or at least get people to ask correct question, i.e. why the new
version removed ECP groups 19, 20, 21, 25, 26 and then vendor would
answer: "because they are obsoleted and replaced with groups n ..
n+m". 

>   I think most everyone agrees that elliptic curve groups aren't really
> used today so the problem can be resolved by fixing the documents. Yes,
> the errata introduces interoperability implications, so let's be happy
> that those implications are likely to be minor (and possibly non-existent).

EC groups are not used, but the implementations are already out there,
and some day someone might actually enable them in their policy, and
if we do not allocate new numbers we are going to get those problems
in the future. Those products using QuickSec OEM toolkit 4.4 - 5.0 are
not going to disappear, and those products will nicely interoperate
with each other.

We can provide them fix to the old products, but that does not mean
our customers will actually put that to their products, and some of
those products (ADLS boxes etc), might be something they will not
provide updates at all. 
-- 
[e-mail]