Subject: [Lwip] Review of draft-ietf-lwig-ikev2-minimal-00

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 13 Oct 2013 17:36:07 +0300

Hi all,

I took a look at draft-ietf-lwig-ikev2-minimal-00 since I volunteered at 
the last IETF meeting.

The specification describes a subset of IKEv2 that utilizes shared 
secrets (although the appendix also talks about raw public key usage, 
which is not mentioned in the introduction). By cutting various options 
and the support of PKI-based authentication the result is less complex 
than the original version.

The document does not talk about cryptographic algorithm choices nor 
does it talk about IPsec (which would be required for a complete 
security implementation). Is that a problem? Not necessarily. It is 
rather a matter of scope.

The document is, from a style point of view, quite different to 
draft-ietf-lwig-tls-minimal-00. It is interesting to see how different 
authors approach the same task differently.

I do not necessarily need to see a need to change the style and the 
abstract says what the document is trying to accomplish. It might 
nevertheless be helpful to note in the abstract that the document talks 
about raw public keys as well or, if you believe the main focus is on 
shared secrets, then put the shared secret authentication somewhere in 
the title.

An interesting aspect of IKEv2, which is helpful in light of the 
recently discovered issues with the pervasive surveillance, is that 
IKEv2 uses a mandatory Diffie-Hellman exchange, which provides PFS. It 
makes the protocol more heavyweight but that's good for security.

Tero obviously knows IKEv2 and so there are no issues with the content 
of the document. I know that Tero had a working implementation and that 
increases my confidence in the quality of the write-up even more.

In a nutshell, I believe it is a good document.

My suggestion is to get it to the IESG as soon as possible. No reason to 
wait.

Ciao
Hannes

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 17 Oct 2013 15:34:38 +0300

> rather a matter of scope.

I think cryptographic algorithms depend so much about the hardware and
environment that I do not think it is useful to list them here. Also
this is mostly meant in environments where devices will know
beforehand that they will talk to each other, i.e. the sensor device
will know that the server it is connecting to, implements the
algorithms it is using, so that is not problem. I.e. the server end is
quite often full IKEv2 implementation so it will support much wider
range of algorithms and the minimal implementation just might support
one algorithm.

> shared secrets, then put the shared secret authentication somewhere in 

I added changed "describes only shared secret authentication" to
"describes mostly ..." in the abstract, and added paragraph in the
introduction:

   The main body of this document describes how to use the shared
   secret authentication in the IKEv2, as it is easiest to implement.  In
   some cases that is not enough and the Appendix B.2 describes how to
   use Raw Public keys instead of shared secret authentication.

The new version should be available shortly. 
-- 
[email-masked]

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 17 Oct 2013 15:34:23 +0200

Hi Tero,

> range of algorithms and the minimal implementation just might support

It was just a point that came to my mind when I was thinking about the 
smart object security workshop where a number of people particularly 
focused on algorithms, both asymmetric as well as symmetric key algorithms.

But you are certainly right that there might be a dependency on the 
hardware and other factors that make it difficult to suggest a set of 
algorithms.

>     use Raw Public keys instead of shared secret authentication.

Thanks
> The new version should be available shortly.

Thanks. As said in my review, I consider the document ready for the IESG.

Ciao
Hannes