Re: [Secdispatch] Controller-IKE

[Hannes Tschofenig <[e-mail]>]

Additional question: If you use DH you often want to use an ephemeral DH key with each communication partner. Is this also the case in your deployment?

From: Secdispatch <[e-mail]> On Behalf Of Eric Rescorla
Sent: Montag, 22. Juli 2019 14:13
To: David Carrel (carrel) <[e-mail]>
Cc: [e-mail]
Subject: Re: [Secdispatch] Controller-IKE

David,

At the mic today, you said that C-IKE was 2N complexity rather than N^2 complexity in terms of messages. Here's what confuses me.

Just for simplicity, imagine that we do this in two phases: everyone registers their key with the controller and then the controller disseminates them. At this point, the controller has N keys and it needs to send them to N endpoints. If you are able to broadcast to all the nodes at once, then the controller will send N keys, so the total overhead is 2N (N uploads + N downloads). However, if the controller has point to point links, then the controller has to send ~N^2 keys (N-1 keys down N links). So those might be bundled into a single message, but you still have to send N^2 keys. Or am I missing something?

-Ekr






On Mon, Jul 22, 2019 at 10:27 AM Eric Rescorla <[e-mail]<mailto:[e-mail]>> wrote:
Thanks for clarifying. With that said, it's possible to do better than this if you use a conventional AKE and time out associations somewhat aggressively.

-Ekr




On Mon, Jul 22, 2019 at 10:09 AM David Carrel (carrel) <[e-mail]<mailto:[e-mail]>> wrote:


* The PFS story here seems pretty bad: I'm assuming that people
aren't going to change their DH keys very often (as it's extremely
expensive for everyone else).
True, the DH load can be expensive, but no more so than an equivalent mesh of traditional IKE.  We would not need to re-key any less often.  I believe this makes the PFS story equivalent.
This doesn't seem correct to me. Consider the case where you do pairwise IKE and then delete the SA and the DH ephemerals. At this point, compromise doesn't leak the traffic keys at all. By contrast, in Controller-IKE because I need to store my DH share indefinitely in case a new peer comes online, then that represents a long-term source of compromise.

OK, I think this is where you misunderstood something or we didn’t explain well enough.  There are no long-term DH keys in Controller-IKE.  All are ephemeral.  It is true that due to synchronization, you will likely keep them a little longer, but never more than 2 key lifetimes.  If you re-key every 2 hours, then the worst case is that your DH values are kept for 4 hours.

Dave

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.