IETF Logo Mail Archive

Re: [IPsec] replacing PSKs: CFRG and PAKE

Paul Wouters <paul@nohats.ca> Mon, 10 December 2018 23:45 UTC

Return-Path: <paul@nohats.ca>
X-Original-To: ipsec@ietfa.amsl.com
Delivered-To: ipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E506A129BBF for <ipsec@ietfa.amsl.com>; Mon, 10 Dec 2018 15:45:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Efcm774v0prh for <ipsec@ietfa.amsl.com>; Mon, 10 Dec 2018 15:45:00 -0800 (PST)
Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10FCB129A87 for <ipsec@ietf.org>; Mon, 10 Dec 2018 15:45:00 -0800 (PST)
Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 43DKS82vJBzG6y; Tue, 11 Dec 2018 00:44:56 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1544485496; bh=fwScq+i/U+DfP4GjHBA9VmftEQ1hZ2KZyu7oMIFYdFo=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=KmWbWehDLmVNUvryUXfw11evNVAhGy96FRN+JUphWSpQ7FXreudnX+WktJ8bZNNQD GD1Tf+zQZS3tv7g03FsBkmaIsMrFzKIAmTbsTMfruf+XVKi3p50yKQH42c0rPqrKt9 VU79zmUa8EciNdBRwJNIFmC3ebJ2AqGQvWLhm/+k=
X-Virus-Scanned: amavisd-new at mx.nohats.ca
Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id V5YRmdyU6tjV; Tue, 11 Dec 2018 00:44:54 +0100 (CET)
Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Tue, 11 Dec 2018 00:44:54 +0100 (CET)
Received: by bofh.nohats.ca (Postfix, from userid 1000) id B8881125611; Mon, 10 Dec 2018 18:44:53 -0500 (EST)
DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca B8881125611
Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id ACD1B418A294; Mon, 10 Dec 2018 18:44:53 -0500 (EST)
Date: Mon, 10 Dec 2018 18:44:53 -0500
From: Paul Wouters <paul@nohats.ca>
To: Michael Richardson <mcr+ietf@sandelman.ca>
cc: Valery Smyslov <smyslov.ietf@gmail.com>, ipsec@ietf.org
In-Reply-To: <29587.1544482818@localhost>
Message-ID: <alpine.LRH.2.21.1812101842270.29141@bofh.nohats.ca>
References: <25207.1544136532@localhost> <026601d49061$8809ad30$981d0790$@gmail.com> <29587.1544482818@localhost>
User-Agent: Alpine 2.21 (LRH 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"; format="flowed"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipsec/iFZiu64UJRHkWDJL4XQ5gHKiVp4>
Subject: Re: [IPsec] replacing PSKs: CFRG and PAKE
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipsec/>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Dec 2018 23:45:02 -0000

On Mon, 10 Dec 2018, Michael Richardson wrote:

>> Why do you think balanced PAKE is more appropriate for us than augmented?
>
> Because I share Paul's view that the PSKs we care about are generally
> identical in both directions

I agree here.

> , and this use is primarily about site-to-site
> inter-company VPNs.   This is note for road-warrier accesss.

But not here. weak group PSK's for roadwarriors is a thing :(

> I would prefer that the PAKE method was not wrapped in EAP.

Indeed. As I explained at the last IETF's presentation, it CANNOT use EAP
because then site-to-site admins cannot use it to connect two different
enterprises because none wants to reconfigure their equipment to trust
the other party's authentication infrastructure.

EAP is not suitable to interconnect different enterprises.

Paul

v2.37.1 | Report a Bug | By Email | System Status