IETF Logo Mail Archive

Re: [secdir] secdir review of draft-kuegler-ipsecme-pace-ikev2

Nico Williams <nico@cryptonector.com> Thu, 14 April 2011 21:13 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: secdir@ietfc.amsl.com
Delivered-To: secdir@ietfc.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfc.amsl.com (Postfix) with ESMTP id ED06DE0823 for <secdir@ietfc.amsl.com>; Thu, 14 Apr 2011 14:13:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.883
X-Spam-Level:
X-Spam-Status: No, score=-1.883 tagged_above=-999 required=5 tests=[AWL=0.094, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([208.66.40.236]) by localhost (ietfc.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u-hNkdchcC34 for <secdir@ietfc.amsl.com>; Thu, 14 Apr 2011 14:13:08 -0700 (PDT)
Received: from homiemail-a71.g.dreamhost.com (caiajhbdccac.dreamhost.com [208.97.132.202]) by ietfc.amsl.com (Postfix) with ESMTP id 4C548E07E6 for <secdir@ietf.org>; Thu, 14 Apr 2011 14:13:08 -0700 (PDT)
Received: from homiemail-a71.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a71.g.dreamhost.com (Postfix) with ESMTP id BBAB9428076 for <secdir@ietf.org>; Thu, 14 Apr 2011 14:13:07 -0700 (PDT)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=cryptonector.com; h=mime-version :in-reply-to:references:date:message-id:subject:from:to:cc: content-type; q=dns; s=cryptonector.com; b=K9VBBWwxpzB1Iux8Ez556 cXbZXdqUTBL2qAvONXhcwa7wVPJdxvRK0irO2tfCzUaumWD/mpzzV6q44IoN1peH irLXIBbD7jVgt4IMZBNjl4SedI7PbaIhx72xKWQvVwy/+Oh5WLT0RKKdViTqGtBt Nnm4gV6HDsg/0Cdm+/KoaQ=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h= mime-version:in-reply-to:references:date:message-id:subject:from :to:cc:content-type; s=cryptonector.com; bh=FQ3DN1wcWnSJLbLVLNJs PeKyLTE=; b=tXhDjEkdGyB0FzORokPGyoYpt9X1SQ5agKReiAmw5QWPAoyt5E5O VffDeitkVDaUDIKfhqc49bVcMqavnLbR056t+skexDicmVbKqbREtASq/ALmcvhX HxDw1INYJL7rlKVstxJp3m2+gUCPFKt4q97xC9GTzYXISnPJ2n/zS7c=
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by homiemail-a71.g.dreamhost.com (Postfix) with ESMTPSA id 8706142806E for <secdir@ietf.org>; Thu, 14 Apr 2011 14:13:07 -0700 (PDT)
Received: by vxg33 with SMTP id 33so2063914vxg.31 for <secdir@ietf.org>; Thu, 14 Apr 2011 14:13:06 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.52.98.225 with SMTP id el1mr1779811vdb.174.1302815586831; Thu, 14 Apr 2011 14:13:06 -0700 (PDT)
Received: by 10.52.163.228 with HTTP; Thu, 14 Apr 2011 14:13:06 -0700 (PDT)
In-Reply-To: <BANLkTinm1fbtaxtTBRP-eDQpcm3QUqXUgA@mail.gmail.com>
References: <AC6674AB7BC78549BB231821ABF7A9AEB530189991@EMBX01-WF.jnpr.net> <4DA69C8A.7000305@gmail.com> <BANLkTi=3WCvUgtLdNknDog--UniYM1G9Bg@mail.gmail.com> <4DA72605.10506@gmail.com> <BANLkTikXF=S3NugNBErZZGLngyCECh=jTw@mail.gmail.com> <ced915e87f60e86c5db6f21f7e94d1a3.squirrel@www.trepanning.net> <BANLkTimqGh84igi5iVJop6O2reG8WF8s-Q@mail.gmail.com> <9c05d036d0e99a053cf977d3f2c441db.squirrel@www.trepanning.net> <BANLkTikF_eG3-CfoJi+6fthvt0gg6D=kwQ@mail.gmail.com> <4DA73C26.5070407@gmail.com> <BANLkTin7tZwKX5zK6Qq2HOtWH17k0omtMA@mail.gmail.com> <4DA74F2A.2060504@gmail.com> <ldvk4ewd0ac.fsf@cathode-dark-space.mit.edu> <BANLkTinm1fbtaxtTBRP-eDQpcm3QUqXUgA@mail.gmail.com>
Date: Thu, 14 Apr 2011 16:13:06 -0500
Message-ID: <BANLkTi=i7DOuu-Vq1MzG_4EBUk58tBNRUw@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: Tom Yu <tlyu@mit.edu>
Content-Type: text/plain; charset="UTF-8"
Cc: "draft-kuegler-ipsecme-pace-ikev2@tools.ietf.org" <draft-kuegler-ipsecme-pace-ikev2@tools.ietf.org>, "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] secdir review of draft-kuegler-ipsecme-pace-ikev2
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Apr 2011 21:13:09 -0000

So, I'm embarrassed.  Please ignore all my earlier comments on this.

Having read the paper, and the sections I'd missed in the I-D, I
believe this document is fine.  There's no need for salting nor
iteration counts in a ZKPP like this (though an augmented version
would require salting, and preferably also iteration counts, so as to
slow down dictionary attacks on verifiers should the verifiers be
lost).

Nico
--

v2.23.0 | Report a Bug | By Email