Network Working Group                                             Y. Nir
Internet-Draft                                               Check Point
Intended status: Standards Track                             F. Detienne
Expires: January 14, 2009                                       P. Sethi
                                                           July 13, 2008

                 A Quick Crash Detection Method for IKE

Status of this Memo

   By submitting this Internet-Draft, each author represents that any
   applicable patent or other IPR claims of which he or she is aware
   have been or will be disclosed, and any of which he or she becomes
   aware will be disclosed, in accordance with Section 6 of BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at

   The list of Internet-Draft Shadow Directories can be accessed at

   This Internet-Draft will expire on January 14, 2009.


   This document describes an extension to the IKEv2 protocol that
   allows for faster crash recovery using a saved token.

   When an IPsec tunnel between two IKEv2 implementations is
   disconnected due to a restart of one peer, it can take as much as
   several minutes for the other peer to discover that the reboot has
   occurred, thus delaying recovery.  In this text we propose an
   extension to the protocol, that allows for recovery immediately
   following the reboot.

Nir, et al.             Expires January 14, 2009                [Page 1]

Internet-Draft            Quick Crash Detection                July 2008

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
     1.1.  Conventions Used in This Document  . . . . . . . . . . . .  3
   2.  RFC 4306 Crash Recovery  . . . . . . . . . . . . . . . . . . .  3
   3.  Protocol Outline . . . . . . . . . . . . . . . . . . . . . . .  4
   4.  Stateless Variant Outline  . . . . . . . . . . . . . . . . . .  5
     4.1.  Introducing CHECK_SPI  . . . . . . . . . . . . . . . . . .  5
     4.2.  Stateless Recovery . . . . . . . . . . . . . . . . . . . .  6
     4.3.  Wait before rekey  . . . . . . . . . . . . . . . . . . . .  6
     4.4.  Throttling and Dampening . . . . . . . . . . . . . . . . .  7
       4.4.1.  Invalid SPI throttling . . . . . . . . . . . . . . . .  8
       4.4.2.  Dampening  . . . . . . . . . . . . . . . . . . . . . .  8
       4.4.3.  User controls  . . . . . . . . . . . . . . . . . . . .  9
   5.  Formats and Exchanges  . . . . . . . . . . . . . . . . . . . .  9
     5.1.  Notification Format  . . . . . . . . . . . . . . . . . . .  9
     5.2.  check_fmt  . . . . . . . . . . . . . . . . . . . . . . . .  9
     5.3.  Stateless IKE Recovery VendorID  . . . . . . . . . . . . . 10
     5.4.  Authentication Exchange  . . . . . . . . . . . . . . . . . 10
     5.5.  Informational Exchange . . . . . . . . . . . . . . . . . . 12
   6.  Token Generation and Verification  . . . . . . . . . . . . . . 12
     6.1.  A Stateless Method of Token Generation . . . . . . . . . . 13
     6.2.  Token Lifetime . . . . . . . . . . . . . . . . . . . . . . 13
   7.  Backup Gateways  . . . . . . . . . . . . . . . . . . . . . . . 13
   8.  Alternative Solutions  . . . . . . . . . . . . . . . . . . . . 13
     8.1.  Initiating a new IKE SA  . . . . . . . . . . . . . . . . . 14
     8.2.  Birth Certificates . . . . . . . . . . . . . . . . . . . . 14
   9.  Interaction with IFARE . . . . . . . . . . . . . . . . . . . . 14
   10. Operational Considerations . . . . . . . . . . . . . . . . . . 15
     10.1. Who should implement this specification  . . . . . . . . . 15
     10.2. Response to unknown child SPI  . . . . . . . . . . . . . . 16
     10.3. Stateless IKE Recovery cookie  . . . . . . . . . . . . . . 17
   11. Security Considerations  . . . . . . . . . . . . . . . . . . . 17
     11.1. Security Considerations for the Stateful Method  . . . . . 18
     11.2. Security Considerations for the Stateless Method . . . . . 18
   12. IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 19
   13. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 19
   14. Change Log . . . . . . . . . . . . . . . . . . . . . . . . . . 19
     14.1. Changes from draft-nir-ike-qcd-00  . . . . . . . . . . . . 19
     14.2. Changes from draft-nir-qcr-00  . . . . . . . . . . . . . . 19
   15. References . . . . . . . . . . . . . . . . . . . . . . . . . . 19
     15.1. Normative References . . . . . . . . . . . . . . . . . . . 19
     15.2. Informative References . . . . . . . . . . . . . . . . . . 20
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 20
   Intellectual Property and Copyright Statements . . . . . . . . . . 22

Nir, et al.             Expires January 14, 2009                [Page 2]

Internet-Draft            Quick Crash Detection                July 2008

1.  Introduction

   IKEv2, as described in [RFC4306] has a method for recovering from a
   reboot of one peer.  As long as traffic flows in both directions, the
   rebooted peer should re-establish the tunnels immediately.  However,
   in many cases the rebooted peer is a VPN gateway that protects only
   servers, or else the non-rebooted peer has a dynamic IP address.  In
   such cases, the rebooted peer will not be able to re-establish the
   tunnels.  Section 2 describes how recovery works under RFC 4306, and
   explains why it takes several minutes.

   The method proposed here, is to send a token in the IKE_AUTH exchange
   that establishes the tunnel.  That token can be stored on the peer as
   part of the IKE SA.  After a reboot, the rebooted implementation can
   re-generate the token, and send it to the non-rebooted peer so as to
   delete the IKE SA.  Deleting the IKE SA results is a quick re-
   establishment of the IPsec tunnels.  This is described in Section 3.

   Finally, Section 4 describes a variant that does not require storing
   state on the non-rebooted peer, but does require an extra round-trip.

1.1.  Conventions Used in This Document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   document are to be interpreted as described in [RFC2119].

   The term "token" refers to an octet string that an implementation can
   generate using only the IKE SPIs as input.  A conforming
   implementation MUST be able to generate the same token from the same
   input even after rebooting.

   The term "token maker" refers to an implementation that generates a
   token and sends it to the peer in the IKE_AUTH exchange.

   The term "token taker" refers to an implementation that stores such a
   token or a digest thereof, after receiving it in an IKE_AUTH

2.  RFC 4306 Crash Recovery

   When one peer reboots, the other peer does not get any notification,
   so IPsec traffic can still flow.  The rebooted peer will not be able
   to decrypt it, however, and the only remedy is to send an unprotected
   INVALID_SPI notification as described in section 3.10.1 of [RFC4306].
   That section also describes the processing of such a notification:
   "If this Informational Message is sent outside the context of an

Nir, et al.             Expires January 14, 2009                [Page 3]

Internet-Draft            Quick Crash Detection                July 2008

   IKE_SA, it should be used by the recipient only as a "hint" that
   something might be wrong (because it could easily be forged)."

   Since the INVALID_SPI can only be used as a hint, the non-rebooted
   peer has to determine whether the IPsec SA, and indeed the parent IKE
   SA are still valid.  The method of doing this is described in section
   2.4 of [RFC4306].  This method, called "liveness check" involves
   sending a protected empty INFORMATIONAL message, and awaiting a
   response.  This procedure is sometimes referred to as "Dead Peer
   Detection" or DPD.

   Section 2.4 does not mandate how many times the liveness check
   message should be retransmitted, or for how long, but does recommend
   the following: "It is suggested that messages be retransmitted at
   least a dozen times over a period of at least several minutes before
   giving up on an SA".  Clearly, implementations differ, but all will
   take a significant amount of time.

3.  Protocol Outline

   Supporting implementations will send a notification, called a "QCD
   token", as described in Section 5.1 in the last packets of the
   IKE_AUTH exchange.  These are the final request and final response
   that contain the AUTH payloads.  The generation of these tokens is a
   local matter for implementations, but considerations are described in
   Section 6.  Implementations that send such a token will be called
   "token makers".

   A supporting implementation receiving such a token SHOULD store it as
   part of the IKE SA.  Implementations that support this part of the
   protocol will be called "token takers".  Section 10.1 has
   considerations for which implementations need to be token takers, and
   which should be token makers.  Implementation that are not token
   takers will silently ignore QCD tokens.

   When a token maker receives a protected IKE request message with
   unknown IKE SPIs, it MUST generate a new token that is identical to
   the previous token, and send it to the requesting peer in an
   unprotected IKE message as described in Section 5.5.

   When a token taker receives the QCD token in an unprotected
   notification, it MUST verify that the TOKEN_SECRET_DATA matches the
   token stored in the matching the IKE SA.  If the verification fails,
   or if the IKE SPIs in the message do not match any existing IKE SA,
   it SHOULD log the event.  If it succeeds, it MUST delete the IKE SA
   associated with the IKE_SPI fields, and all dependant child SAs.
   This event MAY also be logged.  The token taker MUST accept such

Nir, et al.             Expires January 14, 2009                [Page 4]

Internet-Draft            Quick Crash Detection                July 2008

   tokens from any address, so as to allow different kinds of high-
   availability configuration of the token maker.

   A supporting token taker MAY immediately create new SAs using an
   Initial exchange, or it may wait for subsequent traffic to trigger
   the creation of new SAs.

   There is ongoing work on IKEv2 Session Resumption [resumption].  See
   Section 9 for a short discussion about this protocol's interaction
   with session resumption.

4.  Stateless Variant Outline

   Sometimes, a QCD token is not available to the non-rebooted
   implementation.  This can happen for several reasons:
   o  Perhaps the rebooted peer has not implemented the "token maker"
      part of the protocol.
   o  Perhaps the non-rebooted peer is resource-constrained, and cannot
      spare the memory needed to save the token, so it did not implement
      the "token taker" part of the protocol.

   In such cases, we also define a stateless variant of the protocol,
   that does not require any state on the non-rebooted peer, but does
   require an extra round-trip.

   A supporting implementation will advertise this capability with a
   special VID payload as defined in Section 5.3.  When such an
   implementation reboots and sends an INVALID_SPI or INVALID_IKE_SPI
   notification to the non-rebooted peer, which has no QCD token, the
   non-rebooted peer uses a CHECK_SPI notification (see Section 4.1) to
   poll its peer about whether or not the SPI is actually invalid.

4.1.  Introducing CHECK_SPI

   In order to achieve stateless IKE recovery, this memo introduces a
   new notify type called CHECK_SPI.  The CHECK_SPI payload carries an
   SPI (IKE_SA or Child SA) and one of three sub-types (QUERY, ACK,
   NACK).  The semantic of the CHECK_SPI subtypes is the following:
   o  QUERY: a peer queries the remote peer SA DB for the presence of
      the SA whose value is in the payload.
   o  ACK: a peer confirms it has the SA specified in the payload.
   o  NACK: a peer confirms it does not have the SA specified in the

   The payload format of the CHECK_SPI notify is covered in Section 5.2.

Nir, et al.             Expires January 14, 2009                [Page 5]

Internet-Draft            Quick Crash Detection                July 2008

4.2.  Stateless Recovery

   After receiving the INVALID_SPI or INVALID_IKE_SPI notifications, the
   non-rebooted peer (called Peer Y in the figure) will send an
   unprotected IKE message as follows.  Note that Peer Y MUST NOT send
   this unless Peer X has advertised this capability in the IKE_AUTH

      Peer X                                                  Peer Y

                HDR(A,B) INVALID_IKE_SPI(A,B)

                HDR(A,B) CHECK_SPI(QUERY,(A,B)), N(Cookie)

                HDR(A,B) CHECK_SPI(ACK|NACK,(A,B)), N(Cookie)

   In this figure, A & B represent the IKE SPIs, and the Cookie is a
   stateless cookie with similar considerations as the stateless cookie
   described in section 2.6 of RFC 4306.  The cookie SHOULD depend on
   the IKE SPIs and a saved secret.

   A similar exchange happens when the peer sends an INVALID_SPI

      Peer X                                                  Peer Y

                HDR(0,0) INVALID_SPI(a)

                HDR(A,B) CHECK_SPI(QUERY,(A,B)), N(Cookie)

                HDR(A,B) CHECK_SPI(ACK|NACK,(A,B)), N(Cookie)

   The difference here is that Peer Y had to locate the IKE SPIs
   associated with the SPI mentioned in the INVALID_SPI notification.

4.3.  Wait before rekey

   There exists a particular attack where a man-in-the-middle can snoop
   and inject traffic but can not block or drop packets.  This attack
   can spoof INVALID_SPI (allegedly from X), forcing a CHECK_SPI(QUERY)
   from Y. The attacker would spoof back CHECK_SPI(NACK) to force an
   undue rekey.  Since the attacker can not block packets, the

Nir, et al.             Expires January 14, 2009                [Page 6]

Internet-Draft            Quick Crash Detection                July 2008

   INVALID_SPI will also reach Alice, who will reply with

   Y receives CHECK_SPI(NACK) first and MAY wait for a few msec before
   creating a new SA.  Y will eventually receive BOTH a CHECK_SPI(ACK)
   and a CHECK_SPI(NACK), Which is dubious.  The SIR process should then
   stop and log an error, saving the SA.

   The process is illustrated below:

         X                 Attacker                Y
                               Inv SPI


                               ------------------> Should rekey
                                                   but wait a few msec

            -------------------------------------> Hint of attack
                                                   => no rekey

   Ideally, the round-trip-time should be measured during the IKE
   exchange and Y wait for a full RTT before initiating a rekey.

   Given that IKE itself is subject to DH computation by a man-in-the-
   middle, also considering that SA's are dampened after creation (see
   Section 4.4.2), the staging complexity and limited interest of this
   attack makes it rather impractical.  An implementation MAY decided to
   implement this final safety wait but this is strictly optional.

4.4.  Throttling and Dampening

   An important aspect of the security in stateless IKE recovery has to
   do with limiting the CPU utilization.  In order to thwart flood types
   denial of service attacks, strict rate limiting and throttling
   mechanisms have to be enforced.

   All the notifications that are exchanged during IKE recovery SHOULD
   be rate limited.  This paragraph provides information on the way rate
   limiting should take place.

Nir, et al.             Expires January 14, 2009                [Page 7]

Internet-Draft            Quick Crash Detection                July 2008

4.4.1.  Invalid SPI throttling

   The sending of all Invalid SPI notifies MUST be rate limited one way
   or an other.  The rate limiting SHOULD be performed on a per peer
   basis but dynamic state creation SHOULD be avoided as much as
   possible.  A recommended tradeoff is to limit the number of flows
   that can undergo recovery at one point in time and avoid sending
   Invalid SPI notifies for flows that are potentially already under

   Invalid SPI rate limiting protects against natural dangling SA
   occurences.  I.e. normal traffic conditions may cause unrecognized
   SPI's to be received and this message is the most important to
   protect.  Indeed, it is not realistic to send one notification per
   bad ESP packet received.  On high speed links, this could mean
   thousands of IKE notifies sent for the same offending SPI.

   The receiving of unauthenticated Invalid SPI notifies MUST as well be
   rate limited.  Again, the rate limiting SHOULD be performed on a per
   peer basis without dynamic state creation.  In normal circumstances,
   the peer receiving Invalid SPI notifies has an SA with the peer
   sendig those notifies and already maintains peer-related data
   structures that can help in maintaining adequate counters.

   Authenticated Invalid SPI notifies can be accepted without

4.4.2.  Dampening

   After one of the following conditions:
   o  the natural creation or rekey of one or more SA's
   o  the recovery of one or more SA's
   o  the failure in recovering an SA owned by the local security
   o  the logging of an error or warning message involving an SA owned
      by the local security gateway

   The peer with which SA's were created, attempted or against which a
   log was emitted SHOULD be dampened, which means that all the
   unauthenticated Invalid SPI and Check SPI messages emitted by that
   peer MUST be ignored for a chosen duration.

   This protection prevents a man-in-the-middle from forcing the fast
   recreation of SA's and potentially depleting the entropy of systems
   under attack.  It also deals efficently with race conditions that may
   occur after a rekey.

Nir, et al.             Expires January 14, 2009                [Page 8]

Internet-Draft            Quick Crash Detection                July 2008

4.4.3.  User controls

   Because throttling at large is related to speed, the network
   implementation around the security gateways has a major influence on
   the pertinence of the paremeters controlling rate limiting.  It is
   difficult to provide good absolute values for the rate limiters,
   considering that these are implementation dependent.

   As such, for the sake of fitness in practical deployments, a system
   implementing this memo MUST provide administrative controls over the
   rate limiter parameters.

5.  Formats and Exchanges

5.1.  Notification Format

   The notification payload called "QCD token" is formatted as follows:

                            1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       ! Next Payload  !C!  RESERVED   !         Payload Length        !
       !  Protocol ID  !   SPI Size    ! QCD Token Notify Message Type !
       !                                                               !
       ~                       TOKEN_SECRET_DATA                       ~
       !                                                               !

   o  Protocol ID (1 octet) MUST contain 1, as this message is related
      to an IKE SA.
   o  SPI Size (1 octet) MUST be zero, in conformance with [RFC4306].
   o  QCD Token Notify Message Type (2 octets) - MUST be xxxxx, the
      value assigned for QCD token notifications.  TBA by IANA.
   o  TOKEN_SECRET_DATA (16-256 octets) contains a generated token as
      described in Section 6.

5.2.  check_fmt

   The notification payload called "CHECK_SPI" is formatted as follows:

Nir, et al.             Expires January 14, 2009                [Page 9]

Internet-Draft            Quick Crash Detection                July 2008

                            1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       ! Next Payload  !C!  RESERVED   !         Payload Length        !
       !  Protocol ID  !   SPI Size    ! CHECK_SPI Notify Message Type !
       ! Operation     !

   o  Protocol ID (1 octet) MUST contain 1, as this message is related
      to an IKE SA.
   o  SPI Size (1 octet) MUST be zero, in conformance with [RFC4306].
   o  CHECK_SPI Notify Message Type (2 octets) - MUST be xxxxx, the
      value assigned for CHECK_SPI notifications.  TBA by IANA.
   o  Operation (1 Octet) - This field determines the operation being
      performed (Query, Reply_ACK, Reply_NACK)

   The list of operations and their corresponding value:
   o  Query: 0
   o  Reply_ACK: 1
   o  NACK: 2

5.3.  Stateless IKE Recovery VendorID

   The stateless IKE recovery VendorID or SIR_VID is as follows:

   "SIR STATELESS" hex: 53 49 52 20 53 54 41 54 45 4c 45 53 53

   This VendorID payload MUST be sent in the first IKE_AUTH message of
   any implementation that supports the stateless variant of this

5.4.  Authentication Exchange

   For clarity, only the EAP version of an AUTH exchange will be
   presented here.  The non-EAP version is very similar.  The figure
   below is based on appendix A.3 of [RFC4718].

Nir, et al.             Expires January 14, 2009               [Page 10]

Internet-Draft            Quick Crash Detection                July 2008

    first request       --> IDi,
                            [[N(HTTP_CERT_LOOKUP_SUPPORTED)], CERTREQ+],
                            SA, TSi, TSr,

    first response      <-- IDr, [CERT+], AUTH,

                      / --> EAP
    repeat 1..N times |
                      \ <-- EAP

    last request        --> AUTH

    last response       <-- AUTH,
                            SA, TSi, TSr,

   Note that the QCD_TOKEN notification is marked as optional because it
   is not required by this specification that every implementation be
   both token maker and token taker.  If only one peer sends the QCD
   token, then a reboot of the other peer will not be recoverable by
   this method.  This may be acceptable if traffic typically originates
   from the other peer.

   In any case, the lack of a QCD_TOKEN notification MUST NOT be taken
   as an indication that the peer does not support this standard.
   Conversely, if a peer does not understand this notification, it will
   simply ignore it.  Therefore a peer MAY send this notification
   freely, even if it does not know whether the other side supports it.

Nir, et al.             Expires January 14, 2009               [Page 11]

Internet-Draft            Quick Crash Detection                July 2008

5.5.  Informational Exchange

   This QCD_TOKEN notification is unprotected, and is sent as a response
   to a protected IKE request, which uses an IKE SA that is unknown.

            request             --> N(INVALID_IKE_SPI), N(QCD_TOKEN)+

            response            <--

   If child SPIs are persistently mapped to IKE SPIs as described in
   Section 10.2, we may get the following exchange in response to an ESP
   or AH packet.

            request             --> N(INVALID_SPI), N(QCD_TOKEN)+

            response            <--

   The QCD_TOKEN and INVALID_IKE_SPI notifications are sent together to
   support both implementations that conform to this specification and
   implementations that don't.  Similar to the description in section
   2.21 of [RFC4306], The IKE SPI and message ID fields in the packet
   headers are taken from the protected IKE request.

   To support a periodic rollover of token generation constants, the
   token taker MUST support at least four QCD_TOKEN notifications in a
   single packet.  The token is considered verified if any of the
   QCD_TOKEN notifications matches.  The token maker MAY generate up to
   four QCD_TOKEN notifications, based on several generations of keys.

   If the QCD_TOKEN verifies OK, an empty response MUST be sent.  If the
   QCD_TOKEN cannot be validated, a response SHOULD NOT be sent.
   Section 6 defines token verification.

6.  Token Generation and Verification

   No token generation method is mandated by this document.  A method is
   documented in Section 6.1, but only serves as an example.

   The following lists the requirements from a token generation
   o  Tokens MUST be at least 16 octets log, and no more than 128 octets
      long, to facilitate storage and transmission.  Tokens SHOULD be
      indistinguishable from random data.
   o  It should not be possible for an external attacker to guess the
      QCD token generated by an implementation.  Cryptographic
      mechanisms such as PRNG and hash functions are RECOMMENDED.

Nir, et al.             Expires January 14, 2009               [Page 12]

Internet-Draft            Quick Crash Detection                July 2008

   o  The token maker, MUST be able to re-generate or retrieve the token
      based on the IKE SPIs even after it reboots.

6.1.  A Stateless Method of Token Generation

   This describes a stateless method of generating a token:
   o  At installation or immediately after the first boot of the IKE
      implementation, 32 random octets are generated using a secure
      random number generator or a PRNG.
   o  Those 32 bytes, called the "QCD_SECRET", are stored in non-
      volatile storage on the machine, and kept indefinitely.
   o  The TOKEN_SECRET_DATA is calculated as follows:


   o  If key rollover is required by policy, the implementation MAY
      periodically generate a new QCD_SECRET and keep up to 3 previous
      generations.  When sending an unprotected QCD_TOKEN, as many as 4
      notification payloads may be sent, each from a different

6.2.  Token Lifetime

   The token is associated with a single IKE SA, and SHOULD be deleted
   by the token taker when the SA is deleted or expires.  More formally,
   the token is associated with the pair (SPI-I, SPI-R).

7.  Backup Gateways

   Making crash recovery quick is important, but since rebooting a
   gateway takes a non-zero amount of time, many implementations choose
   to have a stand-by gateway ready to take over as soon as the primary
   gateway fails for any reason.

   If such a configuration is available, it is RECOMMENDED that the
   stand-by gateway be able to generate the same token as the active
   gateway. if the method described in Section 6.1 is used, this means
   that the QCD_SECRET field is identical in both gateways.  This has
   the effect of having the crash recovery available immediately.

8.  Alternative Solutions

Nir, et al.             Expires January 14, 2009               [Page 13]

Internet-Draft            Quick Crash Detection                July 2008

8.1.  Initiating a new IKE SA

   Instead of sending a QCD token, we could have the rebooted
   implementation start an Initial exchange with the peer, including the
   INITIAL_CONTACT notification.  This would have the same effect,
   instructing the peer to erase the old IKE SA, as well as establishing
   a new IKE SA with fewer rounds.

   The disadvantage here, is that in IKEv2 an authentication exchange
   MUST have a piggy-backed Child SA set up.  Since our use case is such
   that the rebooted implementation does not have traffic flowing to the
   peer, there are no good selectors for such a Child SA.

   Additionally, when authentication is asymmetric, such as when EAP is
   used, it is not possible for the rebooted implementation to initiate

8.2.  Birth Certificates

   Here we should explain why not Birth Certificates.

9.  Interaction with IFARE

   IFARE, specified in [resumption] proposes to make setting up a new
   IKE SA consume less computing resources.  This is particularly useful
   in the case of a remote access gateway that has many tunnels.  A
   failure of such a gateway would require all these many remote access
   clients to establish an IKE SA either with the rebooted gateway or
   with a backup gateway.  This tunnel re-establishment should occur
   within a short period of time, creating a burden on the remote access
   gateway.  IFARE addresses this problem by having the clients store an
   encrypted derivative of the IKE SA for quick re-establishment.

   What IFARE does not help, is the problem of detecting that the peer
   gateway has failed.  A failed gateway may go undetected for as long
   as the lifetime of a child SA, because IPsec does not have packet
   acknowledgement.  Before establishing a new IKE SA using IFARE, a
   client MUST ascertain that the gateway has indeed failed.  This could
   be done using either a liveness check (as in RFC 4306) or using the
   QCD tokens described in this document.

   A remote access client conforming to both specifications will store
   QCD tokens, as well as the IFARE state, if provided by the gateway.
   A remote access gateway conforming to both specifications will
   generate a QCD token for the client.  When the gateway reboots, the
   client will discover this in either of two ways:

Nir, et al.             Expires January 14, 2009               [Page 14]

Internet-Draft            Quick Crash Detection                July 2008

   1.  The client does regular liveness checks, or else the time for
       some other IKE exchange has come.  Since the gateway is still
       down, the IKE times out after several minutes.  In this case QCD
       does not help.
   2.  Either the primary gateway or a backup gateway (see Section 7) is
       ready and sends a QCD token to the client.  In that case the
       client will quickly re-establish the IPsec tunnel, either with
       the rebooted primary gateway, the backup gateway as described in
       this document or another gateway as described in [resumption]

   The full combined protocol looks like this:

        Initiator                Responder
        -----------              -----------
       HDR, SAi1, KEi, Ni  -->

                           <--    HDR, SAr1, KEr, Nr, [CERTREQ]

       HDR, SK {IDi, [CERT,]
       [CERTREQ,] [IDr,]
       SAi2, TSi, TSr,
       N(TICKET_REQUEST)}  -->
                           <--    HDR, SK {IDr, [CERT,] AUTH, SAr2, TSi,
                                  TSr, N(TICKET_OPAQUE)

                ---- Reboot -----

       HDR, {}             -->
                           <--  HDR, N(QCD_Token)

       [N+,], SK {IDi, [IDr,]
       SAi2, TSi, TSr,
       [CP(CFG_REQUEST)]}  -->
                           <--  HDR, SK {IDr, Nr, SAr2, [TSi, TSr],

10.  Operational Considerations

10.1.  Who should implement this specification

   Throughout this document, we have referred to reboot time
   alternatingly as the time that the implementation crashes and the

Nir, et al.             Expires January 14, 2009               [Page 15]

Internet-Draft            Quick Crash Detection                July 2008

   time when it is ready to process IPsec packets and IKE exchanges.
   Depending on the hardware and software platforms and the cause of the
   reboot, rebooting may take anywhere from a few seconds to several
   minutes.  If the implementation is down for a long time, the benefit
   of this protocol extension are reduced.  For this reason critical
   systems should implement backup gateways as described in Section 7.
   Note that the lower-case "should" in the previous sentence is
   intentional, as we do not specify this in the sense of RFC 2119.

   Implementing the "token maker" side of QCD makes sense for IKE
   implementation where protected connections originate from the peer,
   such as inter-domain VPNs and remote access gateways.  Implementing
   the "token taker" side of QCD makes sense for IKE implementations
   where protected connections originate, such as inter-domain VPNs and
   remote access clients.

   To clarify the requirements:
   o  A remote-access client MUST be a token taker and MAY be a token
   o  A remote-access gateway MAY be a token taker and MUST be a token
   o  An inter-domain VPN gateway MUST be both token maker and token

   In order to limit the effects of DoS attacks, a token taker SHOULD
   limit the rate of QCD_TOKENs verified from a particular source.

   If excessive amounts of IKE requests protected with unknown IKE SPIs
   arrive at a token maker, the IKE module SHOULD revert to the behavior
   described in section 2.21 of [RFC4306] and either send an
   INVALID_IKE_SPI notification, or ignore it entirely.

10.2.  Response to unknown child SPI

   After a reboot, it is more likely that an implementation receives
   IPsec packets than IKE packets.  In that case, the rebooted
   implementation will send an INVALID_SPI notification, triggering a
   liveness check.  The token will only be sent in a response to the
   liveness check, thus requiring an extra round-trip.

   To avoid this, an implementation that has access to non-volatile
   storage MAY store a mapping of child SPIs to owning IKE SPIs.  If
   such a mapping is available and persistent across reboots, the
   rebooted implementation MAY respond to the IPsec packet with an
   INVALID_SPI notification, along with the appropriate QCD_Token
   notifications.  A token taker SHOULD verify the QCD token that
   arrives with an INVALID_SPI notification the same as if it arrived
   with the IKE SPIs of the parent IKE SA.

Nir, et al.             Expires January 14, 2009               [Page 16]

Internet-Draft            Quick Crash Detection                July 2008

   However, a persistent storage module might not be updated in a timely
   manner, and could be populated with IKE SPIs that have already been
   rekeyed.  A token taker MUST NOT take an invalid QCD Token sent along
   with an INVALID_SPI notification as evidence that the peer is either
   malfunctioning or attacking, but it SHOULD limit the rate at which
   such notifications are processed.

10.3.  Stateless IKE Recovery cookie

   The cookie information is chosen by the peer that emits it.  As such,
   the cookie has strictly no meaning for the remote peer and can thus
   be chosen as seen fit.  This section provides recommendations on how
   to generate and validate those cookies.

   When an IKE endpoint X sends an unauthenticated CHECK_SPI, the cookie
   payload following the notify is computed as follow:

                  Cookie = VersionIDofSecret
                           | H( SECRET | CHECK_SPI(..., Query)
                           | ip.src | ip.dst
                           | udp.src | udp.dst)

   o  SECRET is a randomly generated secret known only to the
      implementation and periodically changed.
   o  VersionIDofSecret should be changed whenever SECRET is
   o  CHECK_SPI(..., Query) is the content of the CHECK_SPI notify
      payload where the operation subtype has been set to Query (cf.
      Section 4.1)
   o  ip.src is the source ip address of the IKE packet.
   o  ip.dst is the destination ip address of the IKE packet.
   o  udp.src is the source udp post of the IKE packet.
   o  udp.dst is the destination udp port of the IKE packet.

   Upon reception of a CHECK_SPI notify (ACK or NACK) followed by a
   N(Cookie), a peer can verify whether this is the reply to a Query it
   placed by recomputing the cookie and comparing it to the COOKIE in
   the IKE message.

   In order to minimize the range of cryptographic attacks on SECRET,
   its value SHOULD have a limited life time.

11.  Security Considerations

Nir, et al.             Expires January 14, 2009               [Page 17]

Internet-Draft            Quick Crash Detection                July 2008

11.1.  Security Considerations for the Stateful Method

   Tokens MUST be hard to guess.  This is critical, because if an
   attacker can guess the token associated with the IKE SA, she can tear
   down the IKE SA and associated tunnels at will.  When the token is
   delivered in the IKE_AUTH exchange, it is encrypted.  When it is sent
   again in an unprotected notification, it is not, but that is the last
   time this token is ever used.

   An aggregation of some tokens generated by one peer together with the
   related IKE SPIs MUST NOT give an attacker the ability to guess other
   tokens.  Specifically, if one peer does not properly secure the QCD
   tokens and an attacker gains access to them, this attacker MUST NOT
   be able to guess other tokens generated by the same peer.  This is
   the reason that the QCD_SECRET in Section 6.1 needs to be
   sufficiently long.

   The QCD_SECRET MUST be protected from access by other parties.
   Anyone gaining access to this value will be able to delete all the
   IKE SAs for this token maker.

   The QCD token is sent by the rebooted peer in an unprotected message.
   A message like that is subject to modification, deletion and replay
   by an attacker.  However, these attacks will not compromise the
   security of either side.  Modification is meaningless because a
   modified token is simply an invalid token.  Deletion will only cause
   the protocol not to work, resulting in a delay in tunnel re-
   establishment as described in Section 2.  Replay is also meaningless,
   because the IKE SA has been deleted after the first transmission.

11.2.  Security Considerations for the Stateless Method

   IKE recovery self-protection is discussed all along the document and
   contains many mechanism to thwart denial of service attacks.

   IKE recovery is subject to a man-in-the-middle attack that can let
   the attacker trigger a renegotiation.  It has to be noticed that an
   attacker able to block ESP and/or IKE packets can cause IKE itself to
   also tear down and trigger a rekey of IKE SA's.  With throttling and
   dampening enabled, IKE recovery is able to reduce the amount of
   rekeys/negotiations to as low a rate as IKEv2.

   Overall, IKE Recovery is not more vulnerable than IKEv2 and even
   improves on the security of IKEv2 by resynchronizing SA's more
   rapidly which is important with dynamic polices.

Nir, et al.             Expires January 14, 2009               [Page 18]

Internet-Draft            Quick Crash Detection                July 2008

12.  IANA Considerations

   IANA is requested to assign a notify message type from the error
   types range (43-8191) of the "IKEv2 Notify Message Types" registry

   IANA is requested to assign a notify message type from the status
   types range (16406-40959) of the "IKEv2 Notify Message Types"
   registry with name "CHECK_SPI".

13.  Acknowledgements

   We would like to thank Hannes Tschofenig and Yaron Sheffer for their
   comments about IFARE.

14.  Change Log

   This section lists all changes in this document

   NOTE TO RFC EDITOR : Please remove this section in the final RFC

14.1.  Changes from draft-nir-ike-qcd-00

   o  Merged proposal with draft-detienne-ikev2-recovery [recovery]
   o  Changed the protocol so that the rebooted peer generates the
      token.  This has the effect, that the need for persistent storage
      is eliminated.
   o  Added discussion of birth certificates.

14.2.  Changes from draft-nir-qcr-00

   o  Changed name to reflect that this relates to IKE.  Also changed
      from quick crash recovery to quick crash detection to avoid
      confusion with IFARE.
   o  Added more operational considerations.
   o  Added interaction with IFARE.
   o  Added discussion of backup gateways.

15.  References

15.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

Nir, et al.             Expires January 14, 2009               [Page 19]

Internet-Draft            Quick Crash Detection                July 2008

   [RFC4306]  Kaufman, C., "Internet Key Exchange (IKEv2) Protocol",
              RFC 4306, December 2005.

   [RFC4718]  Eronen, P. and P. Hoffman, "IKEv2 Clarifications and
              Implementation Guidelines", RFC 4718, October 2006.

15.2.  Informative References

              Detienne, F. and P. Sethi, "Safe IKE Recovery",
              draft-detienne-ikev2-recovery-00 (work in progress),
              June 2008.

              Sheffer, Y., Tschofenig, H., Dondeti, L., and V.
              Narayanan, "IPsec Gateway Failover Protocol",
              draft-sheffer-ipsec-failover-03 (work in progress),
              March 2008.

Authors' Addresses

   Yoav Nir
   Check Point Software Technologies Ltd.
   5 Hasolelim st.
   Tel Aviv  67897


   Frederic Detienne
   Cisco Systems, Inc.
   De Kleetlaan, 7
   Diegem  B-1831

   Phone: +32 2 704 5681

Nir, et al.             Expires January 14, 2009               [Page 20]

Internet-Draft            Quick Crash Detection                July 2008

   Pratima Sethi
   Cisco Systems, Inc.
   O'Shaugnessy Road, 11
   Bangalore, Karnataka  560027

   Phone: +91 80 4154 1654

Nir, et al.             Expires January 14, 2009               [Page 21]

Internet-Draft            Quick Crash Detection                July 2008

Full Copyright Statement

   Copyright (C) The IETF Trust (2008).

   This document is subject to the rights, licenses and restrictions
   contained in BCP 78, and except as set forth therein, the authors
   retain all their rights.

   This document and the information contained herein are provided on an

Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at

Nir, et al.             Expires January 14, 2009               [Page 22]