IPsec +- Perfect Forward Secrecy

[Eric Rescorla]

John Denker <jsd at av8n.com> writes:
> Eric Rescorla wrote:
>
>> Uh, you've just described the ephemeral DH mode that IPsec
>> always uses and SSL provides.
>
> I'm mystified by the word "always" there, and/or perhaps by
> the definition of Perfect Forward Secrecy.  Here's the dilemma:
>
> On the one hand, it would seem to the extent that you use
> ephemeral DH exponents, the very ephemerality should do most
> (all?) of what PFS is supposed to do.  If not, why not?
>
> And yes, IPsec always has ephemeral DH exponents lying around.
>
> On the other hand, there are IPsec modes that are deemed to
> not provide PFS.  See e.g. section 5.5 of
>    http://www.faqs.org/rfcs/rfc2409.html

Sorry, when I said IPsec I mean IKE. I keep trying to forget
about the manual keying modes. AFAICT IKE always uses the
DH exchange as part of establishment.

-Ekr

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com