Re: [secdir] secdir review of draft-kuegler-ipsecme-pace-ikev2

[Nico Williams <[e-mail]>]

On Thu, Apr 14, 2011 at 12:21 PM, Dan Harkins <[e-mail]> wrote:
> On Thu, April 14, 2011 9:57 am, Nico Williams wrote:
>> This betrays a fundamental misunderstanding of SCRAM and channel binding.
>>
>> SCRAM with channel binding to a secure channel is as secure as PACE,
>> and arguably more so.
>
>  PACE does not require a secure channel to be passed through. In fact,
> the way it's used there is no security (yet), it's just an unauthenticated
> Diffie-Hellman that "protects" the channel that PACE is done through.
> PACE performs authentication of the IKE SA by doing a ZKPP and adding the
> authenticated and shared secret result of the ZKPP into the result of the
> unauthenticated Diffie-Hellman (plus assorted cruft).

In RFC5056 terms, your "unauthenticated Diffie-Hellman" exchange is a "channel".

There seems to be a terminology disconnect.  As a result of this
disconnect you and others are discarding the work of others (e.g.,
SCRAM in this case) without understanding it in the first place.

I can't force you to read RFC5056 and become familiar with the notion
of channel binding.  But I do wish you'd give it a go.

Nico
--