<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>This is the interesting bit that came out of IETF related to the quantum crypto project idea.<br><br>Sent from my iPhone</div><div><br>Begin forwarded message:<br><br></div><blockquote type="cite"><div><b>From:</b> Tero Kivinen <<a href="mailto:kivinen@iki.fi">kivinen@iki.fi</a>><br><b>Date:</b> March 29, 2017 at 18:11:25 CDT<br><b>To:</b> <a href="mailto:ipsec@ietf.org">ipsec@ietf.org</a><br><b>Subject:</b> <b>[IPsec] Quantum Resistance SK_d, SK_pi, SK_pr etc mixing</b><br><br></div></blockquote><blockquote type="cite"><div><span>So I have proposed earlier that we should mix the ppk to SK_d, SK_pi,</span><br><span>and SK_pr, i.e., something like this:</span><br><span></span><br><span> SKEYSEED = prf(Ni | Nr, g^ir)</span><br><span></span><br><span> {SK_d' | SK_ai | SK_ar | SK_ei | SK_er | SK_pi' | SK_pr'}</span><br><span> = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr)</span><br><span> </span><br><span> If no PPK available, then</span><br><span></span><br><span> SK_d = SK_d'</span><br><span> SK_pi = SK_pi'</span><br><span> SK_pr = SK_pr'</span><br><span></span><br><span> If PPK is available then</span><br><span></span><br><span> SK_d = prf(PPK, SK_d')</span><br><span> SK_pi = prf(PPK, SK_pi')</span><br><span> SK_pr = prf(PPK, SK_pr')</span><br><span></span><br><span>This has the follolowing benefits. The SK_d modification will mean</span><br><span>that IKEv2 SA will gain protection against Quantum Resistance after</span><br><span>the IKEv2 SA irs rekeyed, as rekeyed SA will be using SK_d to derive</span><br><span>new keys. SK_d also used to derive the KEYMAT, meaning the Child SA</span><br><span>will gain protection.</span><br><span></span><br><span>Modifying the SK_pi, and SK_pr will mean that if the PPK is wrong the</span><br><span>IKEv2 authentication will fail, and we will get exactly same failure</span><br><span>for wrong PPK than we do with wrong shared key or digital signature</span><br><span>failures. This means that attacker do not gain any information which</span><br><span>part of the authentication failed.</span><br><span></span><br><span>I do so that in the early cases the PPKs are going to be configured</span><br><span>manually in the system and there is quite big propability they being</span><br><span>wrong, and catching the misconfigurations with proper error code is</span><br><span>better, than just getting the random garbage on the Child SA data.</span><br><span>-- </span><br><span><a href="mailto:kivinen@iki.fi">kivinen@iki.fi</a></span><br><span></span><br><span>_______________________________________________</span><br><span>IPsec mailing list</span><br><span><a href="mailto:IPsec@ietf.org">IPsec@ietf.org</a></span><br><span><a href="https://www.ietf.org/mailman/listinfo/ipsec">https://www.ietf.org/mailman/listinfo/ipsec</a></span><br></div></blockquote></body></html>