Network Working Group                                         Y. Sheffer
Internet-Draft                                               Check Point
Intended status: Standards Track                           H. Tschofenig
Expires: May 21, 2009                             Nokia Siemens Networks
                                                              L. Dondeti
                                                            V. Narayanan
                                                          QUALCOMM, Inc.
                                                       November 17, 2008


                        IKEv2 Session Resumption
               draft-ietf-ipsecme-ikev2-resumption-00.txt

Status of this Memo

   By submitting this Internet-Draft, each author represents that any
   applicable patent or other IPR claims of which he or she is aware
   have been or will be disclosed, and any of which he or she becomes
   aware will be disclosed, in accordance with Section 6 of BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on May 21, 2009.

Abstract

   The Internet Key Exchange version 2 (IKEv2) protocol has a certain
   computational and communication overhead with respect to the number
   of round-trips required and the cryptographic operations involved.
   In remote access situations, the Extensible Authentication Protocol
   (EAP) is used for authentication, which adds several more round trips
   and consequently latency.

   To re-establish security associations (SA) upon a failure recovery



Sheffer, et al.           Expires May 21, 2009                  [Page 1]


Internet-Draft          IKEv2 Session Resumption           November 2008


   condition is time consuming, especially when an IPsec peer, such as a
   VPN gateway, needs to re-establish a large number of SAs with various
   end points.  A high number of concurrent sessions might cause
   additional problems for an IPsec peer during SA re-establishment.

   In order to avoid the need to re-run the key exchange protocol from
   scratch it would be useful to provide an efficient way to resume an
   IKE/IPsec session.  This document proposes an extension to IKEv2 that
   allows a client to re-establish an IKE SA with a gateway in a highly
   efficient manner, utilizing a previously established IKE SA.

   A client can reconnect to a gateway from which it was disconnected.
   The proposed approach uses a IKEv2 state (or a reference into a state
   store). to store state information that is later made available to
   the IKEv2 responder for re-authentication.  Restoring state
   information by utilizing a ticket is one possible way.  This document
   does not specify the format of the ticket but recommendations are
   provided.

































Sheffer, et al.           Expires May 21, 2009                  [Page 2]


Internet-Draft          IKEv2 Session Resumption           November 2008


Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
   2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  4
   3.  Usage Scenario . . . . . . . . . . . . . . . . . . . . . . . .  5
   4.  Protocol Details . . . . . . . . . . . . . . . . . . . . . . .  7
     4.1.  Requesting a Ticket  . . . . . . . . . . . . . . . . . . .  7
     4.2.  Presenting a Ticket  . . . . . . . . . . . . . . . . . . .  8
       4.2.1.  Protection of the IKE_SESSION_RESUME Exchange  . . . .  9
       4.2.2.  Presenting a Ticket: The DoS Case  . . . . . . . . . . 10
       4.2.3.  Requesting a ticket during resumption  . . . . . . . . 10
     4.3.  IKE Notifications  . . . . . . . . . . . . . . . . . . . . 11
     4.4.  TICKET_OPAQUE Notify Payload . . . . . . . . . . . . . . . 11
     4.5.  Processing Guidelines for IKE SA Establishment . . . . . . 11
   5.  Ticket Recommendations . . . . . . . . . . . . . . . . . . . . 12
     5.1.  Ticket Content . . . . . . . . . . . . . . . . . . . . . . 12
     5.2.  Ticket Identity and Lifecycle  . . . . . . . . . . . . . . 13
   6.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 13
   7.  Security Considerations  . . . . . . . . . . . . . . . . . . . 13
     7.1.  Stolen Tickets . . . . . . . . . . . . . . . . . . . . . . 13
     7.2.  Forged Tickets . . . . . . . . . . . . . . . . . . . . . . 14
     7.3.  Denial of Service Attacks  . . . . . . . . . . . . . . . . 14
     7.4.  Ticket Protection Key Management . . . . . . . . . . . . . 14
     7.5.  Ticket Lifetime  . . . . . . . . . . . . . . . . . . . . . 14
     7.6.  Ticket Format  . . . . . . . . . . . . . . . . . . . . . . 15
     7.7.  Identity Privacy, Anonymity, and Unlinkability . . . . . . 15
     7.8.  Replay Protection in the IKE_SESSION_RESUME Exchange . . . 15
   8.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 16
   9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 16
     9.1.  Normative References . . . . . . . . . . . . . . . . . . . 16
     9.2.  Informative References . . . . . . . . . . . . . . . . . . 16
   Appendix A.  Ticket Format . . . . . . . . . . . . . . . . . . . . 17
   Appendix B.  Change Log  . . . . . . . . . . . . . . . . . . . . . 18
     B.1.  -00  . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
     B.2.  -01  . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
     B.3.  -00  . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
     B.4.  -04  . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
     B.5.  -03  . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
     B.6.  -02  . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
     B.7.  -01  . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
     B.8.  -00  . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 19
   Intellectual Property and Copyright Statements . . . . . . . . . . 21








Sheffer, et al.           Expires May 21, 2009                  [Page 3]


Internet-Draft          IKEv2 Session Resumption           November 2008


1.  Introduction

   The Internet Key Exchange version 2 (IKEv2) protocol has a certain
   computational and communication overhead with respect to the number
   of round-trips required and the cryptographic operations involved.
   In particular the Extensible Authentication Protocol (EAP) is used
   for authentication in remote access cases, which increases latency.

   To re-establish security associations (SA) upon a failure recovery
   condition is time-consuming, especially when an IPsec peer, such as a
   VPN gateway, needs to re-establish a large number of SAs with various
   end points.  A high number of concurrent sessions might cause
   additional problems for an IPsec responder.

   In many failure cases it would be useful to provide an efficient way
   to resume an interrupted IKE/IPsec session.  This document proposes
   an extension to IKEv2 that allows a client to re-establish an IKE SA
   with a gateway in a highly efficient manner, utilizing a previously
   established IKE SA.

   A client can reconnect to a gateway from which it was disconnected.
   One way to ensure that the IKEv2 responder is able to recreate the
   state information is by maintaining IKEv2 state (or a reference into
   a state store) in a "ticket", an opaque data structure.  This ticket
   is created by the server and forwarded to the client.  The IKEv2
   protocol is extended to allow a client to request and present a
   ticket.

   This approach is similar to the one taken by TLS session resumption
   [RFC4507] with the required adaptations for IKEv2, e.g., to
   accommodate the two-phase protocol structure.  We have borrowed
   heavily from that specification.

   The proposed solution should additionally meet the following goals:

   o  Using only symmetric cryptography to minimize CPU consumption.
   o  Allowing a gateway to push state to clients.
   o  Providing cryptographic agility.
   o  Having no negative impact on IKEv2 security features.

   The following are non-goals of this solution:
   o  Providing load balancing among gateways.
   o  Specifying how a client detects the need for a failover.


2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",



Sheffer, et al.           Expires May 21, 2009                  [Page 4]


Internet-Draft          IKEv2 Session Resumption           November 2008


   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC2119].

   This document uses terminology defined in [RFC4301], [RFC4306], and
   [RFC4555].  In addition, this document uses the following terms:

   Ticket:  An IKEv2 ticket is a data structure that contains all the
      necessary information that allows an IKEv2 responder to re-
      establish an IKEv2 security association.


   In this document we use the term ticket and thereby refer to an
   opaque data structure that may either contain IKEv2 state as
   described above or a reference pointing to such state.


3.  Usage Scenario

   This specification envisions two usage scenarios for efficient IKEv2
   and IPsec SA session re-establishment.

   The first is similar to the use case specified in Section 1.1.3 of
   the IKEv2 specification [RFC4306], where the IPsec tunnel mode is
   used to establish a secure channel between a remote access client and
   a gateway; the traffic flow may be between the client and entities
   beyond the gateway.

   The second use case focuses on the usage of transport (or tunnel)
   mode to secure the communicate between two end points (e.g., two
   servers).  The two endpoints have a client-server relationship with
   respect to a protocol that runs using the protections afforded by the
   IPsec SA.



















Sheffer, et al.           Expires May 21, 2009                  [Page 5]


Internet-Draft          IKEv2 Session Resumption           November 2008


    (a)

    +-+-+-+-+-+                          +-+-+-+-+-+
    !         !      IKEv2/IKEv2-EAP     !         !     Protected
    ! Remote  !<------------------------>!         !     Subnet
    ! Access  !                          ! Access  !<--- and/or
    ! Client  !<------------------------>! Gateway !     Internet
    !         !      IPsec tunnel        !         !
    +-+-+-+-+-+                          +-+-+-+-+-+


    (b)

    +-+-+-+-+-+                          +-+-+-+-+-+
    !         !    IKE_SESSION_RESUME    !         !
    ! Remote  !<------------------------>!         !
    ! Access  !                          ! Access  !
    ! Client  !<------------------------>! Gateway !
    !         !      IPsec tunnel        !         !
    +-+-+-+-+-+                          +-+-+-+-+-+



         Figure 1: Resuming a Session with a Remote Access Gateway

   In this scenario, an end-host (an entity with a host implementation
   of IPsec [RFC4301] ) establishes a tunnel mode IPsec SA with a
   gateway in a remote network using IKEv2.  The end-host in this
   scenario is sometimes referred to as a remote access client.  At a
   later stage when a client needs to re-establish the IKEv2 session it
   may choose to establish IPsec SAs using a full IKEv2 exchange or the
   IKE_SESSION_RESUME exchange (shown in Figure 1).

   In this scenario, the client needs to get an IP address from the
   remote network so that traffic can be encapsulated by the remote
   access gateway before reaching the client.  In the initial exchange,
   the gateway may acquire IP addresses from the address pool of a local
   DHCP server.  The session resumption exchange may need to support the
   assignment of a new IP address.

   The protocol defined in this document supports the re-allocation of
   an IP address to the client, if this capability is provided by the
   network.  This capability is implicit in the use of the IKE
   configuration mechanism, which allows the client to present its
   existing IP address and receive the same address back, if allowed by
   the gateway.





Sheffer, et al.           Expires May 21, 2009                  [Page 6]


Internet-Draft          IKEv2 Session Resumption           November 2008


4.  Protocol Details

   This section provides protocol details and contains the normative
   parts.  This document defines two protocol exchanges, namely
   requesting a ticket, see Section 4.1, and presenting a ticket, see
   Section 4.2.

4.1.  Requesting a Ticket

   A client MAY request a ticket in the following exchanges:

   o  In an IKE_AUTH exchange, as shown in the example message exchange
      in Figure 2 below.
   o  In a CREATE_CHILD_SA exchange, when an IKE SA is rekeyed.
   o  In an Informational exchange, if the gateway previously replied
      with an N(TICKET_ACK) instead of providing a ticket.
   o  In an Informational exchange, when the ticket lifetime is about to
      expire.
   o  In an IKE_SESSION_RESUME exchange, see Section 4.2.3.

   Normally, a client requests a ticket in the third message of an IKEv2
   exchange (the first of IKE_AUTH).  Figure 2 shows the message
   exchange for this typical case.



     Initiator                Responder
     -----------              -----------
    HDR, SAi1, KEi, Ni  -->

                        <--    HDR, SAr1, KEr, Nr, [CERTREQ]

    HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,]
    AUTH, SAi2, TSi, TSr, N(TICKET_REQUEST)}     -->

        Figure 2: Example Message Exchange for Requesting a Ticket

   The notification payloads are described in Section 4.3.  The above is
   an example, and IKEv2 allows a number of variants on these messages.
   A complete description of IKEv2 can be found in [RFC4718].

   When an IKEv2 responder receives a request for a ticket using the
   N(TICKET_REQUEST) payload it MUST perform one of the following
   operations if it supports the extension defined in this document:
   o  it creates a ticket and returns it with the N(TICKET_OPAQUE)
      payload in a subsequent message towards the IKEv2 initiator.  This
      is shown in Figure 3.




Sheffer, et al.           Expires May 21, 2009                  [Page 7]


Internet-Draft          IKEv2 Session Resumption           November 2008


   o  it returns an N(TICKET_NACK) payload, if it refuses to grant a
      ticket for some reason.
   o  it returns an N(TICKET_ACK), if it cannot grant a ticket
      immediately, e.g., due to packet size limitations.  In this case
      the client MAY request a ticket later using an Informational
      exchange, at any time during the lifetime of the IKE SA.

   Provided the IKEv2 exchange was successful, the IKEv2 initiator can
   accept the requested ticket.  The ticket may be used later with an
   IKEv2 responder that supports this extension.  Figure 3 shows how the
   initiator receives the ticket.



     Initiator                Responder
     -----------              -----------
            <--    HDR, SK {IDr, [CERT,] AUTH, SAr2, TSi,
                        TSr, N(TICKET_OPAQUE) [,N(TICKET_GATEWAY_LIST)]}


                       Figure 3: Receiving a Ticket

4.2.  Presenting a Ticket

   A client MAY initiate a regular (non-ticket-based) IKEv2 exchange
   even if it is in possession of a valid ticket.  A client MUST NOT
   present a ticket when it knows that the ticket's lifetime has
   expired.

   It is up to the client's local policy to decide when the
   communication with the IKEv2 responder is seen as interrupted and a
   new exchange needs to be initiated and the session resumption
   procedure to be initiated.

   Tickets are intended for one-time use: a client MUST NOT reuse a
   ticket, either with the same or with a different gateway.  A gateway
   SHOULD reject a reused ticket.

   This document specifies a new IKEv2 exchange type called
   IKE_SESSION_RESUME whose value is TBA by IANA.  This exchange is
   somewhat similar to the IKE_AUTH exchange, and results in the
   creation of a Child SA.  The client SHOULD NOT use this exchange type
   unless it knows that the gateway supports it.



    Initiator                Responder
    -----------              -----------



Sheffer, et al.           Expires May 21, 2009                  [Page 8]


Internet-Draft          IKEv2 Session Resumption           November 2008


    HDR, Ni, N(TICKET_OPAQUE), [N+,]
         SK {IDi, [IDr,] SAi2, TSi, TSr [, CP(CFG_REQUEST)]} -->

   The exchange type in HDR is set to 'IKE_SESSION_RESUME'.

   See Section 4.2.1 for details on computing the protected (SK)
   payload.

   When the IKEv2 responder receives a ticket using the N(TICKET_OPAQUE)
   payload it MUST perform one of the following steps if it supports the
   extension defined in this document:
   o  If it is willing to accept the ticket, it responds as shown in
      Figure 4.
   o  It responds with an unprotected N(TICKET_NACK) notification, if it
      rejects the ticket for any reason.  In that case, the initiator
      should re-initiate a regular IKE exchange.  One such case is when
      the responder receives a ticket for an IKE SA that has previously
      been terminated on the responder itself, which may indicate
      inconsistent state between the IKEv2 initiator and the responder.
      However, a responder is not required to maintain the state for
      terminated sessions.
   o  When the responder receives a ticket for an IKE SA that is still
      active and if the responder accepts it, then the old SAs SHOULD be
      silently deleted without sending a DELETE informational exchange.



    Initiator                Responder
    -----------              -----------
                    <--  HDR, SK {IDr, Nr, SAr2, [TSi, TSr],
                         [CP(CFG_REPLY)]}

               Figure 4: IKEv2 Responder accepts the ticket

   Again, the exchange type in HDR is set to 'IKE_SESSION_RESUME'.

   The SK payload is protected using the cryptographic parameters
   derived from the ticket, see Section 4.2.1 below.

   At this point a new IKE SA is created by both parties, see
   Section 4.5.  This is followed by normal derivation of a child SA,
   per Section 2.17 of [RFC4306].

4.2.1.  Protection of the IKE_SESSION_RESUME Exchange

   The two messages of this exchange are protected by a "subset" IKE SA.
   The key material is derived from the ticket, as follows:




Sheffer, et al.           Expires May 21, 2009                  [Page 9]


Internet-Draft          IKEv2 Session Resumption           November 2008


        {SK_d2 | SK_ai | SK_ar | SK_ei | SK_er} = prf+(SK_d_old, Ni)

   where SK_d_old is the SK_d value of the original IKE SA, as retrieved
   from the ticket.  Ni guarantees freshness of the key material.  SK_d2
   is used later to derive the new IKE SA, see Section 4.5.

   See [RFC4306] for the notation. "prf" is determined from the SA value
   in the ticket.

4.2.2.  Presenting a Ticket: The DoS Case

   When receiving the first message of the IKE_SESSION_RESUME exchange,
   the gateway may decide that it is under a denial-of-service attack.
   In such a case, the gateway SHOULD defer the establishment of session
   state until it has verified the identity of the client.  We use a
   variation of the IKEv2 Cookie mechanism, whereby the cookie is
   protected.

   In the two messages that follow, the gateway responds that it is
   unwilling to resume the session until the client is verified, and the
   client resubmits its first message, this time with the cookie:



  Initiator                Responder
  -----------              -----------
                  <-- HDR, SK{N(COOKIE)}

 HDR, Ni, N(TICKET_OPAQUE), [N+,]
      SK {N(COOKIE), IDi, [IDr,] SAi2, TSi, TSr [, CP(CFG_REQUEST)]} -->

   Assuming the cookie is correct, the gateway now replies normally.

   This now becomes a 4-message exchange.  The entire exchange is
   protected as defined in Section 4.2.1.

   See Section 2.6 and Section 3.10.1 of [RFC4306] for more guidance
   regarding the usage and syntax of the cookie.  Note that the cookie
   is completely independent of the IKEv2 ticket.

4.2.3.  Requesting a ticket during resumption

   When resuming a session, a client will typically request a new ticket
   immediately, so it is able to resume the session again in the case of
   a second failure.  Therefore, the N(TICKET_REQUEST) and
   N(TICKET_OPAQUE) notifications may be piggybacked as protected
   payloads to the IKE_SESSION_RESUME exchange.




Sheffer, et al.           Expires May 21, 2009                 [Page 10]


Internet-Draft          IKEv2 Session Resumption           November 2008


   The returned ticket (if any) will correspond to the IKE SA created
   per the rules described in Section 4.5.

4.3.  IKE Notifications

   This document defines a number of notifications.  The notification
   numbers are TBA by IANA.

             +-------------------+--------+-----------------+
             | Notification Name | Number | Data            |
             +-------------------+--------+-----------------+
             | TICKET_OPAQUE     | TBA1   | See Section 4.4 |
             | TICKET_REQUEST    | TBA2   | None            |
             | TICKET_ACK        | TBA3   | None            |
             | TICKET_NACK       | TBA4   | None            |
             +-------------------+--------+-----------------+

4.4.  TICKET_OPAQUE Notify Payload

   The data for the TICKET_OPAQUE Notify payload consists of the Notify
   message header, a lifetime field and the ticket itself.  The four
   octet lifetime field contains the number of seconds until the ticket
   expires (encoded as an unsigned integer).


        0                     1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       ! Next Payload  !C!  Reserved   !      Payload Length           !
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       ! Protocol ID   ! SPI Size = 0  !    Notify Message Type        !
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       !                       Lifetime                                !
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       !                                                               !
       ~                        Ticket                                 ~
       !                                                               !
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


                  Figure 5: TICKET_OPAQUE Notify Payload

4.5.  Processing Guidelines for IKE SA Establishment

   When a ticket is presented, the gateway parses the ticket to retrieve
   the state of the old IKE SA, and the client retrieves this state from
   its local store.  Both peers now create state for the new IKE SA as
   follows:



Sheffer, et al.           Expires May 21, 2009                 [Page 11]


Internet-Draft          IKEv2 Session Resumption           November 2008


   o  The SA value (transforms etc.) is taken directly from the ticket.
   o  The sequence numbers are reset to 0.
   o  The IDi value is obtained from the ticket.
   o  The IDr value is obtained from the new exchange.  The gateway MAY
      make policy decisions based on the IDr value encoded in the
      ticket.
   o  The SPI values are created anew, similarly to a regular IKE
      exchange.  SPI values from the ticket SHOULD NOT be reused.  This
      restriction is to avoid problems caused by collisions with other
      SPI values used already by the initiator/responder.  The SPI value
      should only be reused if collision avoidance can be ensured
      through other means.

   The cryptographic material is refreshed based on the ticket and the
   nonce values, Ni, and Nr, from the current exchange.  A new SKEYSEED
   value is derived as follows:


        SKEYSEED = prf(SK_d2, Ni | Nr)

   where SK_d2 was computed earlier (Section 4.2.1).

   The keys are derived as follows, unchanged from IKEv2:


       {SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr} =
                                   prf+(SKEYSEED, Ni | Nr | SPIi | SPIr)

   where SPIi, SPIr are the SPI values created in the new IKE exchange.

   See [RFC4306] for the notation. "prf" is determined from the SA value
   in the ticket.


5.  Ticket Recommendations

5.1.  Ticket Content

   As noted above, the ticket represents a partial IKEv2 state, either
   by reference or by value.  When passing the state by value, the
   ticket MUST contain an integrity-protected reference to partial IKEv2
   state, containing the state items described further in this section.
   We note that such a ticket is analogous to the concept of 'stub', as
   defined in [I-D.xu-ike-sa-sync], or the concept of a Session ID from
   TLS.

   When the state is passed by value, the ticket MUST encode at least
   the following state from an IKE SA.  These values MUST be encrypted



Sheffer, et al.           Expires May 21, 2009                 [Page 12]


Internet-Draft          IKEv2 Session Resumption           November 2008


   and authenticated.

   o  IDi, IDr.
   o  SPIi, SPIr.
   o  SAr (the accepted proposal).
   o  SK_d.

   In addition, the ticket MUST encode a protected ticket expiration
   value.

   The ticket MUST include a key identity field, so that encryption and
   authentication can be changed, and when necessary, algorithms can be
   replaced.

5.2.  Ticket Identity and Lifecycle

   Each ticket is associated with a single IKE SA.  In particular, when
   an IKE SA is deleted, the client MUST delete its stored ticket.  A
   ticket is therefore associated with the tuple (IDi, IDr).

   The lifetime of the ticket carried in the N(TICKET_OPAQUE)
   notification SHOULD be the minimum of the IKE SA lifetime (per the
   gateway's local policy) and its re-authentication time, according to
   [RFC4478].  Even if neither of these are enforced by the gateway, a
   finite lifetime MUST be specified for the ticket.


6.  IANA Considerations

   This document requires a number of IKEv2 notification status types in
   Section 4.3, to be registered by IANA.  The corresponding registry
   was established by IANA.

   The document defines a new IKEv2 exchange in Section 4.2.  The
   corresponding registry was established by IANA.


7.  Security Considerations

   This section addresses security issues related to the usage of a
   ticket.  The text below assumes that the IKE state is contained
   explicitly in the ticket ("passed by value").  In most cases, there
   are similar risks when the state is passed by reference.

7.1.  Stolen Tickets

   An eavesdropper or man-in-the-middle may try to obtain a ticket and
   use it to establish a session with the IKEv2 responder.  This can



Sheffer, et al.           Expires May 21, 2009                 [Page 13]


Internet-Draft          IKEv2 Session Resumption           November 2008


   happen in different ways: by eavesdropping on the initial
   communication and copying the ticket when it is granted and before it
   is used, or by listening in on a client's use of the ticket to resume
   a session.  However, since the ticket's contents is encrypted and the
   attacker does not know the corresponding secret key, a stolen ticket
   cannot be used by an attacker to succesfully resume a session.  An
   IKEv2 responder MUST use strong encryption and integrity protection
   of the ticket to prevent an attacker from obtaining the ticket's
   contents, e.g., by using a brute force attack.

7.2.  Forged Tickets

   A malicious user could forge or alter a ticket in order to resume a
   session, to extend its lifetime, to impersonate as another user, or
   to gain additional privileges.  This attack is not possible if the
   ticket is protected using a strong integrity protection algorithm.

7.3.  Denial of Service Attacks

   An adversary could generate and send a large number of tickets to a
   gateway for verification.  To minimize the possibility of such denial
   of service, ticket verification should be lightweight (e.g., using
   efficient symmetric key cryptographic algorithms).

7.4.  Ticket Protection Key Management

   A full description of the management of the keys used to protect the
   ticket is beyond the scope of this document.  A list of RECOMMENDED
   practices is given below.
   o  The keys should be generated securely following the randomness
      recommendations in [RFC4086].
   o  The keys and cryptographic protection algorithms should be at
      least 128 bits in strength.
   o  The keys should not be used for any other purpose than generating
      and verifying tickets.
   o  The keys should be changed regularly.
   o  The keys should be changed if the ticket format or cryptographic
      protection algorithms change.

7.5.  Ticket Lifetime

   An IKEv2 responder controls the lifetime of a ticket, based on the
   operational and security requirements of the environment in which it
   is deployed.  The responder provides information about the ticket
   lifetime to the IKEv2 initiator, allowing it to manage its tickets.






Sheffer, et al.           Expires May 21, 2009                 [Page 14]


Internet-Draft          IKEv2 Session Resumption           November 2008


7.6.  Ticket Format

   Great care must be taken when defining a ticket format such that the
   requirements outlined in Section 5.1 are met.  In particular, if
   confidential information, such as a secret key, is transferred to the
   client, it MUST be done using secure communication to prevent
   attackers from obtaining or modifying the key.  Also, the ticket MUST
   have its integrity and confidentiality protected with strong
   cryptographic techniques to prevent a breach in the security of the
   system.

7.7.  Identity Privacy, Anonymity, and Unlinkability

   Since opaque state information is passed around between the IKEv2
   initiator and the IKEv2 responder it is important that leakage of
   information, such as the identities of an IKEv2 initiator and a
   responder, MUST be avoided (e.g., with the help of encryption.  Thus,
   it prevents the disclosure of potentially sensitive information.

   When an IKEv2 initiator presents a ticket as part of the
   IKE_SESSION_RESUME exchange, confidentiality is not provided for the
   exchange.  There is thereby the possibility for an on-path adversary
   to observe multiple exchange handshakes where the same state
   information is used and therefore to conclude that they belong to the
   same communication end points.

   This document therefore envisions that the ticket is presented to the
   IKEv2 responder only once; multiple usage of the ticket is not
   provided.

7.8.  Replay Protection in the IKE_SESSION_RESUME Exchange

   A major design goal of this protocol extension has been the two-
   message exchange for session resumption.  There is a tradeoff between
   this abbreviated exchange and replay protection.  It is RECOMMENDED
   that an IKEv2 responder should cache tickets, and reject replayed
   ones.  However, some gateways may not do that in order to reduce
   state size.  An adversary may attempt to replay a ticket.  To
   mitigate these risks a client may be required by the gateway to show
   that it knows the ticket's secret, before any state is committed on
   the gateway side.  Note that this is a stronger guarantee than the
   regular IKE cookie mechanism, which only shows IP return routability
   of the client.  This is enabled by including the cookie in the
   protected portion of the message.

   For performance reasons, the cookie mechanism is optional, and
   invoked by the gateway only when it suspects that it is the subject
   of a denial-of-service attack.



Sheffer, et al.           Expires May 21, 2009                 [Page 15]


Internet-Draft          IKEv2 Session Resumption           November 2008


   In any case, a ticket replayed by an adversary only causes partial
   IKE state to be created on the gateway.  The IKE exchange cannot be
   completed and an IKE SA cannot be created unless the client knows the
   ticket's secret values.


8.  Acknowledgements

   We would like to thank Paul Hoffman, Pasi Eronen, Florian Tegeler,
   Stephen Kent, Sean Shen, Xiaoming Fu, Stjepan Gros, Dan Harkins, Russ
   Housely, Yoav Nir and Tero Kivinen for their comments.  We would to
   particularly thank Florian Tegeler and Stjepan Gros for their help
   with their implementation efforts and Florian Tegeler for his formal
   verification using the CASPER tool set.

   We would furthermore like to thank the authors of
   [I-D.xu-ike-sa-sync] (Yan Xu, Peny Yang, Yuanchen Ma, Hui Deng and Ke
   Xu) for their input on the stub concept.


9.  References

9.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC4306]  Kaufman, C., "Internet Key Exchange (IKEv2) Protocol",
              RFC 4306, December 2005.

9.2.  Informative References

   [I-D.rescorla-stateless-tokens]
              Rescorla, E., "How to Implement Secure (Mostly) Stateless
              Tokens", draft-rescorla-stateless-tokens-01 (work in
              progress), March 2007.

   [I-D.xu-ike-sa-sync]
              Xu, Y., Yang, P., Ma, Y., Deng, H., and H. Deng, "IKEv2 SA
              Synchronization for session resumption",
              draft-xu-ike-sa-sync-01 (work in progress), October 2008.

   [RFC4086]  Eastlake, D., Schiller, J., and S. Crocker, "Randomness
              Requirements for Security", BCP 106, RFC 4086, June 2005.

   [RFC4301]  Kent, S. and K. Seo, "Security Architecture for the
              Internet Protocol", RFC 4301, December 2005.




Sheffer, et al.           Expires May 21, 2009                 [Page 16]


Internet-Draft          IKEv2 Session Resumption           November 2008


   [RFC4478]  Nir, Y., "Repeated Authentication in Internet Key Exchange
              (IKEv2) Protocol", RFC 4478, April 2006.

   [RFC4507]  Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig,
              "Transport Layer Security (TLS) Session Resumption without
              Server-Side State", RFC 4507, May 2006.

   [RFC4555]  Eronen, P., "IKEv2 Mobility and Multihoming Protocol
              (MOBIKE)", RFC 4555, June 2006.

   [RFC4718]  Eronen, P. and P. Hoffman, "IKEv2 Clarifications and
              Implementation Guidelines", RFC 4718, October 2006.


Appendix A.  Ticket Format

   This document does not specify a mandatory-to-implement or a
   mandatory-to-use ticket format.  The following format is RECOMMENDED.


  struct {
      [authenticated] struct {
          octet format_version;    // 1 for this version of the protocol
          octet reserved[3];       // sent as 0, ignored by receiver.
          octet key_id[8];         // arbitrary byte string
          opaque IV[0..255];       // actual length (possibly 0) depends
                                   // on the encryption algorithm

          [encrypted] struct {
              opaque IDi, IDr;     // the full payloads
              octet SPIi[8], SPIr[8];
              opaque SA;           // the full SAr payload
              octet SK_d[0..255];  // actual length depends on SA value
              int32 expiration;    // an absolute time value, seconds
                                   // since Jan. 1, 1970
          } ikev2_state;
      } protected_part;
      opaque MAC[0..255];          // the length (possibly 0) depends
                                   // on the integrity algorithm
  } ticket;

   Note that the key defined by "key_id" determines the encryption and
   authentication algorithms used for this ticket.  Those algorithms are
   unrelated to the transforms defined by the SA payload.

   The reader is referred to a recent draft
   [I-D.rescorla-stateless-tokens] that recommends a similar (but not
   identical) ticket format, and discusses related security



Sheffer, et al.           Expires May 21, 2009                 [Page 17]


Internet-Draft          IKEv2 Session Resumption           November 2008


   considerations in depth.

   For implementations that prefer to pass a reference to IKE state in
   the ticket, rather than the state itself, we RECOMMEND the following
   format:



  struct {
        [authenticated] struct {
            octet format_version;  // 1 for this version of the protocol
            octet reserved[3];     // sent as 0, ignored by receiver.
            octet key_id[8];       // arbitrary byte string

            struct {
                opaque state_ref;  // reference to IKE state
                int32 expiration;  // an absolute time value, seconds
                                   // since Jan. 1, 1970
            } ikev2_state_ref;
        } protected_part;
        opaque MAC[0..255];        // the length depends
                                   // on the integrity algorithm
  } ticket;


Appendix B.  Change Log

B.1.  -00

   Resubmitted document as a WG item.

B.2.  -01

   Added reference to [I-D.xu-ike-sa-sync]

   Included recommended ticket format into the appendix

   Various editorial improvements within the document

B.3.  -00

   Issued a -00 version for the IPSECME working group.  Reflected
   discussions at IETF#72 regarding the strict focus on session
   resumption.  Consequently, text about failover was removed.







Sheffer, et al.           Expires May 21, 2009                 [Page 18]


Internet-Draft          IKEv2 Session Resumption           November 2008


B.4.  -04

   Editorial fixes; references cleaned up; updated author's contact
   address

B.5.  -03

   Removed counter mechanism.  Added an optional anti-DoS mechanism,
   based on IKEv2 cookies (removed previous discussion of cookies).
   Clarified that gateways may support reallocation of same IP address,
   if provided by network.  Proposed a solution outline to the problem
   of key exchange for the keys that protect tickets.  Added fields to
   the ticket to enable interoperability.  Removed incorrect MOBIKE
   notification.

B.6.  -02

   Clarifications on generation of SPI values, on the ticket's lifetime
   and on the integrity protection of the anti-replay counter.
   Eliminated redundant SPIs from the notification payloads.

B.7.  -01

   Editorial review.  Removed 24-hour limitation on ticket lifetime,
   lifetime is up to local policy.

B.8.  -00

   Initial version.  This draft is a selective merge of
   draft-sheffer-ike-session-resumption-00 and
   draft-dondeti-ipsec-failover-sol-00.


Authors' Addresses

   Yaron Sheffer
   Check Point Software Technologies Ltd.
   5 Hasolelim St.
   Tel Aviv  67897
   Israel

   Email: yaronf@checkpoint.com









Sheffer, et al.           Expires May 21, 2009                 [Page 19]


Internet-Draft          IKEv2 Session Resumption           November 2008


   Hannes Tschofenig
   Nokia Siemens Networks
   Linnoitustie 6
   Espoo  02600
   Finland

   Phone: +358 (50) 4871445
   Email: Hannes.Tschofenig@gmx.net
   URI:   http://www.tschofenig.priv.at


   Lakshminath Dondeti
   QUALCOMM, Inc.
   5775 Morehouse Dr
   San Diego, CA
   USA

   Phone: +1 858-845-1267
   Email: ldondeti@qualcomm.com


   Vidya Narayanan
   QUALCOMM, Inc.
   5775 Morehouse Dr
   San Diego, CA
   USA

   Phone: +1 858-845-2483
   Email: vidyan@qualcomm.com






















Sheffer, et al.           Expires May 21, 2009                 [Page 20]


Internet-Draft          IKEv2 Session Resumption           November 2008


Full Copyright Statement

   Copyright (C) The IETF Trust (2008).

   This document is subject to the rights, licenses and restrictions
   contained in BCP 78, and except as set forth therein, the authors
   retain all their rights.

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
   THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.


Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   ietf-ipr@ietf.org.











Sheffer, et al.           Expires May 21, 2009                 [Page 21]