IPsecME Session - IETF 126 in Vienna

Chairs: Tero Kivinen, Yoav Nir
Responsible AD: Deb Cooley

Agenda

Presentations

Use of SHA-3 in IKEv2 and IPsec

Ben Salter

https://datatracker.ietf.org/doc/draft-ietf-ipsecme-sha3/

Customization strings discussion:
Sophie: Expect future XOF to have more domain separators because
cryptographers love them.
Valery: Support discussion on the list. For cryptographers, strings
are good.
Jonathan: KMAK spec tells you how to do a wrapper for customization
strings.

Discussions and improvements on RFC 9370 ADDKE algorithm selection

Lun Li

https://datatracker.ietf.org/doc/draft-li-ipsecme-extensions-for-robust-negotiation/

Valery: Opposed to the change, makes the negotiaton
non-deterministic. Some of the examples are broken.
Scott: Agrees with Valery.
Paul: The examples are not correct and cannot happen with a properly
implemented client.

Tero: Maintain the draft as draft, even if it will not be published,
it is a useful resource to collect issues and solutions.

FrodoKEM in IKEv2

Wang Guiling

https://datatracker.ietf.org/doc/draft-ietf-ipsecme-hybrid-kem-ikev2-frodo/

Scott: FrodoKEM is an ISO document behind a paywall, that is an RFC
blocker.
Deb: Working with paywalls is tricky.
Christian: There are ways to use paywalled standards, so technically
not a blocker. Still not easy.
Valery: There is a draft in CFRG that basically defines FrodoKEM.
Scott: Not usable before it becomes an RFC.
John: Against using paywalled.

Multi-Authentication in IKEv2 with PQ security

Wang Guiling

https://datatracker.ietf.org/doc/draft-wang-ipsecme-multi-auth-ikev2-pq/

Scott: This does not say how to actually negotiate the algorithms.
Valery: How do the initiator would try to negotiate?
Sophie: How do you avoid downgrade attacks?

PQ/T Hybrid PKI Authentication in IKEv2

Jun Hu Wang Guiling

https://datatracker.ietf.org/doc/draft-hu-ipsecme-pqt-hybrid-auth/

Tirumal: Composite draft mandates that a single composite key is
generated, but you're allowing to use two dfferent CAs.

PQ/T Hybrid PKI Authentication in IKEv2

Tirumal Reddy

https://datatracker.ietf.org/doc/draft-reddy-ipsecme-pqt-hybrid-auth/

Tirumal: open to combining the two drafts, but would prefer to keep
a separate draft for the dual certificate authentication.
Scott: If the working group wants to consider both ideas, keep the
drafts separate.
Paul: wait for a few months for LAMPS.
Guilin: do composite auth first.
Deb: What are we expecting from lamps? They are not any plans to do
more there.
Alicja: let's reuse code, just use single signature & certificate.

PQ/T Hybrid Composite Key Exchange and Reliable Transport for IKEv2

Tirumal Reddy

https://datatracker.ietf.org/doc/draft-reddy-ipsecme-ikev2-hybrid-reliable/

Paul: How do you fit DH and PQC payloads in single roundtrip?
Tirumal: use TCP.
Paul: Are you saying RTT is single packet exchange or single IKE
message exchange.
Tirumal: Packet. For data centers use cases.
Anthony: Why is there no comparison with 0% packet loss?
Tirumal: There weren't real differences then.
Tero: Comparing TCP and UDP is difficult, UDP retransmission
timeouts matter a lot.

KEM-based Authentication for IKEv2 with PQ Security

Uri Blumenthal Valery Smyslov

https://datatracker.ietf.org/doc/draft-wang-ipsecme-kem-auth-ikev2/
Related paper:
https://github.com/smyslov/draft-wang-ipsecme-kem-auth-ikev2/blob/main/analysis/pqc_ikev2_auth_v28.pdf

Hannes: Is there a need for performance optimization? Based on the
presentation, McEliece seems like a bad choice compared to ML-KEM. You
need to consider other metrics than just CPU usage (RAM, code size).
Scott: ML-KEM loses much of its advantage if there are no
preconfigured ML-KEM public keys, scalability nightmare, that's why we
abandonned pre-encrypted nonces.

MLS for IPsec Group Key Exchange

Valery Smyslov and Konrad Kohbrok

https://datatracker.ietf.org/doc/draft-kohbrok-ipsecme-mls-gike/

Daniel: Usually the GCKS handles the keys in a very centralized way,
is this different in MLS?
Konrad: In MLS, GCKS does not generate the data protection keys.
Sean: Group IKEv2 is not well deployed.
John: MLS is state of the art, this would provide signficant
security improvement.
Johnathan: Very exciting.
Carlos: What would be the impact of moving to this group setting?
Can we expect improvements in PQC setting?
Valery: There will be some problems with transport for PQC.
Hannes: Deployment is not blocked by complexity but because the
use-cases are very niche. We're approaching this with the wrong angle.
Valery: Agree with the need for the real use cases.

AOB