Subject: need for encrypting IKE QM exchange

From: [email-masked] (Floroiu John)
Date: Tue, 3 Jun 2003 11:51:23 +0200

Hi,

There is a question I would like to ask regarding the need to
encrypt the IKE Quick Mode exchange. I couldn't find throughout
RFC2408 and RFC2409 a clear explanation to why SA, Nx, KE need to be
encrypted (since the messages are authenticated anyway). 

SA, Nx and KE only indicate to a potential attacker the transforms that
are being used and the SA's lifetime, which imo is harmless.

Clearly IDci, IDcr must be encrypted, and the only answer I could figure
out to the question above is that, since the protocol does not provide
support for individual payloads to be encrypted, the whole message is
encrypted instead.

Looking at JFK I noticed however that "sa" and "sa'" are also
transported (within message 3 and 4) in encryted form.

The ultimate question is whether, assuming another protocol than IKE is
used to negotiate SAs, SA, Nx and KE could be transported in plain text.
Of course it is "better" to have them encrypted, but I cannot understand
why would it be "worse" to have them in clear.

Any comments would be gratly appreciated.

John.

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 03 Jun 2003 16:18:59 -0400

> are being used and the SA's lifetime, which imo is harmless.

others may disagree.  

also, selector values are exchanged, which may indicate port number /
protocol of the protected traffic, leaking information about the
traffic being carried.

					- Bill

---

From: [email-masked] (Floroiu John)
Date: Wed, 4 Jun 2003 10:48:29 +0200

> > are being used and the SA's lifetime, which imo is harmless.

Thanks for the answer. I had this feeling indeed, but I wasn't sure
about the reasons ;-) I actually overlooked the selectors, which provide
indeed information about the traffic being exchanged through a security
gateway.

Regarding the other parameters, maybe the lifetime is the most
sensitive. KE is essentially a public parameter, SPIs are seen
afterwards in clear. As for the transforms, they are not many of them
(so that one may try them in turn) and their strength, I believe, comes
from the algorithm itself rather than from hiding its identity.

John.