Re: [Secdispatch] Controller-IKE

[Eric Rescorla <[e-mail]>]

David,

At the mic today, you said that C-IKE was 2N complexity rather than N^2
complexity in terms of messages. Here's what confuses me.

Just for simplicity, imagine that we do this in two phases: everyone
registers their key with the controller and then the controller
disseminates them. At this point, the controller has N keys and it needs to
send them to N endpoints. If you are able to broadcast to all the nodes at
once, then the controller will send N keys, so the total overhead is 2N (N
uploads + N downloads). However, if the controller has point to point
links, then the controller has to send ~N^2 keys (N-1 keys down N links).
So those might be bundled into a single message, but you still have to send
N^2 keys. Or am I missing something?

-Ekr






On Mon, Jul 22, 2019 at 10:27 AM Eric Rescorla <[e-mail]> wrote:

> Thanks for clarifying. With that said, it's possible to do better than
> this if you use a conventional AKE and time out associations somewhat
> aggressively.
>
> -Ekr
>
>
>
>
> On Mon, Jul 22, 2019 at 10:09 AM David Carrel (carrel) <[e-mail]>
> wrote:
>
>>
>>
>>
>>
>> * The PFS story here seems pretty bad: I'm assuming that people
>> aren't going to change their DH keys very often (as it's extremely
>> expensive for everyone else).
>>
>> True, the DH load can be expensive, but no more so than an equivalent
>> mesh of traditional IKE.  We would not need to re-key any less often.  I
>> believe this makes the PFS story equivalent.
>>
>> This doesn't seem correct to me. Consider the case where you do pairwise
>> IKE and then delete the SA and the DH ephemerals. At this point, compromise
>> doesn't leak the traffic keys at all. By contrast, in Controller-IKE
>> because I need to store my DH share indefinitely in case a new peer comes
>> online, then that represents a long-term source of compromise.
>>
>>
>>
>> OK, I think this is where you misunderstood something or we didn’t
>> explain well enough.  There are no long-term DH keys in Controller-IKE.
>> All are ephemeral.  It is true that due to synchronization, you will likely
>> keep them a little longer, but never more than 2 key lifetimes.  If you
>> re-key every 2 hours, then the worst case is that your DH values are kept
>> for 4 hours.
>>
>>
>>
>> Dave
>>
>>
>>
>