Internet Engineering Task Force 102, 18 Jul 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: IETF102-IPSECME-20180718-1520

Description

IPSECME meeting session at IETF102
2018/07/18 1520

https://datatracker.ietf.org/meeting/102/proceedings/

A

We have bruises that are probably already forced everybody, I think or is their vegetable seeds or going around there should be one blue sheet called rod where it is okay, it's already passed in the end, so somebody good practice. We bring it out here in the front, because I think there's probably going to be people coming in not late, but actually on time.

A

Then we need to have a note-taker. We already have a Brian who are said he will take it. We take notes in the ether pad. So if actually anybody else would be willing to help Brian to take notes. Okay, I could just you know, just take it.

A

What if you are having a discussion or something like that, so there's already I prefilled it we talk or if you know things out there, so it's actually very easy to in, and you just see where cocoa optic and if you have a chopper scribe, we do have people there at least admit a code, but they like that. But we also coming up questions from this chopper. Anybody willing to do chopper, scribing.

A

Actually would be interesting to have, okay could fall. You can do it because one of the things is because if you have a very we have a remote presenters, then we actually cut them. I think they're, I, don't know what actually I can see that the if they were might need to know what the slider you are on because actually ostomy take horse up, show you actually the slides or the person who is speaking alright.

A

Okay, so then we have a choppers room and we have a meter Co and at eater, pod and I actually remember to update person on ITF numbers. So here's our agenda for now in the attenti passing the autistic stuff. Anybody had any big that needs to be changed here or update it you're. Actually we don't have too many items there or we have a some items, but actually I think we should be getting this done quite quickly. I picture submit. That must disgust me. So if there's nothing else, then we go to reach our Turing.

A

It sucks race. I was actually asked for area director. The comment on that yeah I draw.

B

Irrigator so I have a draft order from a German which had a buncha light IHC comments. You sent me a revision which they encourage most to come us, but on all of them. I'm gonna realize it attempt to hit all of them, and then it should go out for sure no review I don't see any hundreds of any problems, but so I'll actually try to go out during this meeting. Perhaps.

C

My work during.

B

A

Alright, so the next one is draft status, so we have one craft that is the EDD si that is in our shared eater. Q has been there for a long time and I. Guess it's because it's a part of very big group of documents that are going to be published. At the same time, there are now in Hadley some of those are in out 48 hours, I'm, not sure if all of them are already out 48 hours, but it's it's going to be probably taking some time to cook.

A

It I think there was about almost 10 documents in the same cluster, so it still takes some time to get all of them, true and so on. But it's already, you know, should be getting ready. Then we have the split dns document that was given to the ATS, an ad say: ok, there's some issues. We will come back to the later of those we have one that is through working group last called implicit, IV and I. Guess it. We didn't get any comments during there, but I've never already addressed analyst, but we have actually.

A

We have heavenly drafts of that already that this is like a second work: equal plus Co. If I read correctly all right, and then we have this control assistant document that they would require to be starting where control priced or I think.

D

Channeling Europe, he says IPSec EDD essays in all 48. Yes,.

A

That that document, but some of the other documents in the same cluster are still I- think RFC edit, it's and I don't think any of them goes out before everything is out. Everything is ready, so, and so the controversial stuff still needs to I think we are going to be starting group last talk very quickly after this idea for subscribe, death or maybe baby, but actually I want to actually read it before I.

A

All right so said that we have a current work. We have a sleep. These things are like what we have a currently today me just discussing, and we start with split TNS. So tell me if you can.

E

All right, hello, everyone, yeah, I'm Tommy, and so this is a document that I've co-authored with Paul. We've talked about a lot, it's the split DNS, it's pretty much done, but then ecker gave some useful comments about some concerns on the DNS SEC language and potential.

E

Misuse of this that allows a VPN server to essentially a hijack and replace your certificates with TLS a records using the split des mechanism, and so we discussed this earlier this week because we do definitely want to resolve this issue. Just like an hour ago, we've posted a update to the document to try to incorporate some of the thoughts that came up in that meeting, so we'd like to review them now and hopefully resolve things or at least decide as a working group what to do going forward.

E

So this is just literally I think copy and paste from the new text that was in that section, so just going through them one by one by clients, when they're using the DNS sekhti a new configuration type as a request, they must use a pre-configured write list of domain names that they're willing to accept these from so they have to have specific ones that they want so for in total, Apple comm.

E

For me right, you can't just put star so, as we say, dot must not be white listed, so you cannot let the VPN server just override everything, and this is specifically different from what a normal split DNS domain would be split. Dns does not without DNS egg does not have the same restrictions. This is just going to be for the DNS SEC part, so any updates half so any updates of the domain names either must be done by the user or by having explicit administrative changes not being done in bandwidth, the I connection itself.

E

So we're not going going to be dynamically just allowing your VPN server to say: hey I want to be the authority now for a Facebook, or something like that. um That is the idea, so this language should hopefully be a little bit more strict their father's. So.

D

Just cover this was to address the concern that echo raise, that a PPN server might be compromised and then send out new trust anchors. While it's assumed that your provisioning out-of-band provisioning will happen through other CAS and other security mechanisms that it would not be compromised, correct, thicker, so.

B

This looks like mostly where we discussed the Ren Arctica has, as a second see, I, think um I, don't this is done, but I thought we discussed on. You were supposed to offer this list in your initial exchange. I suppose just filtering, but I, don't think this says, but I don't if you are advisable.

E

In retrospect,.

B

E

Sorry I guess Paul you can clarify cuz. You wrote the text personally reading that when I say we have a pre-configured list of domain names, I assume that means that those are the ones I'm sending, but in clarify I didn't.

D

Actually change the tax on purpose, just in case we wanted to keep the optional if the client doesn't sent anything because it does want to reveal that and he gets a list of mine if.

B

I said a federal I think isn't advisable. um um I think the only thing I would add is I. Think some text should go in here about, like not. You know if ie Tod TLT about like not mmm basically not do eto, D and I. Think, as you said, lunch I think something has to be a little wishy-washy because it like a local but like I, mean really. We should tell people they shouldn't be doing call exactly so that that's what the one thing also.

E

That I thought when I read this, because you mentioned explicitly, must not for dot I, think potentially just right after that sentence, we could have vague language about implementations should restrict this to things that are reasonably going to be internal domains like they internally we could blacklist calm and net, and so Paolo.

D

Speaking so I was I was afraid of actually speaking of specific till these, because those things are dynamic and changes, and you know tomorrow that Oracle is important, and today it's taken over by internal.

E

Not given by exam I say that the implementation may also restrict any other top-level or common domain that but.

D

You already do.

E

That, by not having him into I post.

B

My thesis here is that, like there's a certain set of domain names which effectively are almost at the present generic right and they are generic and not local and those are basically the effect, the effect of the minimum like the cz, the TLDs rifle, and maybe each of these and like and like the like local, and you know, doc, home and crap like that, and so it seems like like explain to the user, that the impact of doing that is effectively the like whiteness.

B

The entire Internet is like something that you understand and like I'm, not saying I. Think like, and you know it's true like. Maybe you decide that someday. That turns out that, actually you did. You know that, actually you know you used dot, you know, got Apple and then suddenly Apple goes and buys it or, conversely, that you just like no, you really take a reward like serious thought should be given before you like. Take a TLD and hoisting this last.

E

Right and actually a really good example of this practically in deployments, I have seen many cases in which some configure usually not a well-set-up enterprise, but someone else is going to list out in their domains. A calm be calm right. You know, they're going to try to hack the list in some way by listening, ridiculous things. So, just saying an implementation should reasonably also not include things that are clearly just trying to grab the entire internet good.

A

Giving in a chair- but you do it all one of the things actually is that we end up in every time. If look it's very easy. Every time you go below dot, we get problems because there's lots of things like the suffix list, for example, okay, which CA is to allow- or we saw you, know, subdomains of country codes.

A

Somebody have that some of country codes have two levels or one level or so on and in actually some of the cases actually might be useful to actually be able to take dot foo if the dot foo is not signed at all and I mean.

F

If it enough yeah, because.

A

I mean it on point. For example, when truth was in China, you know there was you know some of these countries had their own. You know the trust. Of course. They were publishing, I, say oh yeah, but I. Don't progress, we'd erratic they had at their own. You know they were actually signing. The doctor is if before they root for sign and that or actually say, okay, if you want to use this, you have to do that and and okay, this probably doesn't go with I I.

A

Think the country code chart quite a bit, but something below that is actually well might happening. So he said, and then they are have acts are the other question is for them machine I know I enough. We now have a registration for this which says it's zero or more, and that's actually one of the question. Okay, with Paul was parable, polos actually saying it yeah, okay, we could actually see the empty list and just verify it. But if you'd say that, okay, you always must send the list.

A

Then the zero is not valid option to send in ever because I mean zero means. Usually that okay, yes I, would like to get those back, but you know I, don't restrict what you are code to be doing. But if you are now saying that so.

G

A

To be explicit about a list of one or more the question there is so that, if you are going to be allowing this that we were actually said that empty list we have I think we actually need to express to say it and the interest.

E

A

Okay, either is okay or not: okay, meaning okay, meaning that, yes, you can send it in place, and then you compare it against your pre-conference list that the reason you do that you don't want to tell the other end, oh sure sure beats me, but what you would allow them to hack and and and and and or you could say that you always have to say, if you always have to send them, then I we have to modify on a registered say that okay, the length of this is always something or something done, not zero.

D

So just to clarify a little bit so so we're actually talking about stealing the delegations, not so much as installing it's just anchorite, because they're already binding you to so it already means it. It's not specific to the trust anchor. It also means the redirection, so I mean we could add tax. It says you must not redirect your domain, that that's not yours and then maybe you should really not take one, that's not in use and then hope for the best.

E

Okay, yeah, okay,.

B

I'm not really looking for texture but I'm, just like I think, like I, intend, says well, I think I think that that's you know how we get to get past your concern, but I think like I'm. Trying to get out of this document like who thinks like. Okay, fine I'll have to do that dot on the dude calm like that's stupid, don't do that right! That's all I'm! Getting at and like a paragraph. That said, like the implication of doing anything which is effective. Generic is like you're like well. This needs our internet.

B

It's like that's like that's all I'm trying to get out yep.

E

Yep so I yeah I, agree. I can work on a sentence for that. Beyond that change, does anyone else have any objections to this update to the text, because then, at that point, I assume once we go through this? What state does this go back into.

H

Goes back to ad yeah.

E

Okay, great so, okay, we'll do one more rep of this send out to the list again after we word Smith things and that'll, be it and just to be clear.

H

Where we're keeping the text to allow an empty list to be included? Yes,.

E

I think we want to specify maybe I'll change the words a little bit to make sure that it's a non-empty white list of what you allow. But you do not. You were not required to send it. Don't advertise that list.

H

So no concerns with that.

A

I

J

A

Express next years,.

A

It's quicker for you.

K

Hello, my name is piss off update some words about I'd like to host a town with burn, update of oxygen exchange, authentic dropped, not about a bit, but about some issues that was identified.

K

World just remind you would like. Oaks is Brewers in London. Can you say gif? It was presented as a mean to transfer large public keys. That not only large public is that it's probably a primer primer implementation, primary purpose of this use of this exchange, but it can be as far as the purposes to so.

K

It takes place between I, say in it and between Allison you can take out and so that it is encrypted using keys that are computed in initial key exchange as it's why it can employ like fragmentation, and so we solve a lot of issues who is transferring much loads so.

K

This exchange must be finally authenticated and in the draft, the war supposed a scheme that outlined here, cells that sign octet for initiator and first ponder include I CV integrity, check words from messages of I ox, and so that you include only I CV saves space, but because I don't need to store to keep the messages until like all takes place, but latest got floor and Denis 1g youngest identified some problem. So the problem is that there are actually two problems.

K

The first problem is for me is another problem, so not not Jenny and generally speaking, not only a ID algorithm has a separate ICP where you probably it is possible to invent algorithms that will speed, authentication information across sulphate test. But currently, all the idea algorithm defined have a separate authentication texels. It serves as IC value integrity check value. So this this problem machine is a minor program, but a magic problem is a security problem. So the problem is that some I D algorithm behave.

K

Not very good in terms of second preimage resistance in case when I taken out the key. So in this case, in our case, we.

G

Assume that initial.

K

Key exchange can be broken by a checker who is equipped with quantum computers so taken all the keys, and in this case the attacker can vouch hi kokes messages. Is we use this authentication, as described in current draft, so for not not in every case, but in the used algorithm is acceptable to this attack, for example, GCM is acceptable.

K

Well, so this is description of this attack so attack in the middle. A clip is a quantum computing break initial key exchange, so she learns ske SQL and if negotiation, a media Greece was not resistant to second preimage attack sounds that attacker can forge like aux messages and change its content and Muro Muro.

K

If it works, messages contain quantum resistant, public exchange, public release for contrary system key exchange, so attacker can substitute these public release risk own and at the boot, and but use is that with some phantom safe key exchange methods not resolved, but with some Escott discard, it is symmetrically possible that attacker found those values that most peers who commit.

G

K

Share it secret and attacker will note it. So it's a question: it's not only little attack, so it is not good, so a possible solution. The simplest solution is to include the cool messages into so not yet, but it's completed words, but it opens a possibility for the you know, service attack because PS need to keep messages. It might be quite much until like all states place and a cows cannot take place at all, so it will exhaust memory. So it's not good. The.

G

K

Solution is to use, instead of whom messages use. Hashes of these messages will some hash function is ortiz cohesion at second preimage resistant. So it's all also a good solution for sourcing this attack, but the problem is that we don't have unlikely to return. 12 hash function, primitive, so it is not negotiated and it is not defined. So we need to define new registry and you negotiation mechanism, and you transform type so include its increases protocol complexity and the beta to avoid it.

K

So the third solution possible is to use pure from the zero key instead of crash function and PRF is negotiated and we have registering ahead negotiation and in so everything is fine well, but this no problem is again that not every PRF is resistant to second pretty much attack in case when I take another key, but good news that well, which make this pair of are resistant. But some people have at least two pairs that are registered as a different file. P2 is X, CBC and Alex.

K

C mark are not resistant, but this pair of are not suitable for use with quantum exchange at all, because they internally use one key and so they're.

G

Not secure enough.

K

So question actually.

A

I have a comment in one of the things: I was together, because what we are usually doing with imitators and updates is that we are PRF in it. We are condemned PR effort out of it, and then we are, you know if it says you know preset T we are using the priesthood keys, a pre appear office.

A

If it's going to be, you know the authentication, it's okay, then we are signature that we ex are doing something else, but I mean we are already filling them with them into the PRF relief if those algorithms are not suitable. For you know, for that kind of operation,.

K

A

Going to be a probably answering to me already, there.

K

Is minor, Indians minor everywhere, like two pair F, is used in suggestions as attacker doesn't know the key, but in this case it is a little bit in a different situation and Scott escaped Agra facade a shoot, as a sample of you have at least two of them badly. Oh, it's made behave, behave good ki, make pair of that is based on kachuck. It's also became good, so most part became good, but there are very few of them that are not very good in this situation.

I

Question I think.

H

You dropped out of the queue.

D

So, actually, at this point in time we have negotiated, or at least exchanged payloads for hash algorithm. For that it's the signature, one no.

K

It is not initiated, it's just announced; no, it is, it is no. Every PA announced the set of hash algorithms that can be used for signatures, but after that each peer selects one hash algorithm among the set that it's been announced and use it in echoes, but.

G

K

Need to know, we need to negotiate it first. We need to negotiate it before. I calls, there's no negotiation mechanism and no among the list of hash function that are currently defined for useful signature. There is at least one identity function that is not collision resistant at all, so it is not. It is not an option. I was thinking about it a bit so currently the search solution using peripheral looks like best possible, but compromise. If you have any other batch IDs, please you're.

K

Welcome, so I would update the draft shortly after ITF with the solution, but if you have some as IDs you're welcome. Thank you.

A

All right so no comments about that. Actually one of the things we actually skipped your previous presentation, because you need to comment anything. We don't.

K

Need an update presentation because there are just two statement.

A

Give you this one: this was a teacher part of the craft update.

K

This presentation well I, don't know what even presented isn't it. So the draft just has two changes from conversation: all changes, auditory sense to Tommy and cool, and it's just qualification it they didn't change becomes aware. So we still have four in implementation such that were tested for interoperability, and we believe that the draft is ready for a school. It is quite stable for the last half a year.

L

Hi from CeCe, please forgive this late comment from a newcomer, but when I was reviewing, the draft I was looking at the there's, notify use PPK, that's in sent in the I guess a in it. I was wondering what why that is actually necessary when you send a notify with the key ID in me, Ike auth, particularly by sending that you're, enabling someone to an attacker to profile which connections might actually be quite and resistant or not to enable them to to store those ones versus ones. That might be quantum resistant. Well,.

K

This indication is needed for support of legacy implementation as that don't support the PK, so you can't just start using it without knowing, since appear also is able to use.

L

It, but can you just handle that in the same way as if the responder doesn't know what the key idea is so.

K

The problem is that the job has several versions in the very first versions. The PKK ID was sent in a case a need just in the very first message, but because it has a much more disadvantages and advantages first became de. It was if, if I remember correctly, it was a hash of okay. So you it was bad from agility point of view because the cache function wasn't initiated. So he first need to negotiate some terrific primitive before you can use.

G

K

Same thing in a ksanych send an epic ad is not a good idea, wasn't a good idea, so we decided to first negotiate using P key and then some people caddy in a cow's message when all Kappa perfect evaluated- and you have all done attribute negotiated.

L

Sorry so I'm not suggesting moving the negotiation of the key ID to the Annette I. Just think that the state machine can actually handle it. If you just remove the use, PPK notify from from the SI in it, but I am missing.

K

Say if initiated doesn't know whether responder supports with bikini or not each sound in Ike else in the sentence? Education, information in articles below the dis computing using typically so, while.

G

Preparing these.

K

Authentication information be sure to meet already to know whether.

L

K

Understand it or not,.

L

E

K

E

Right that was the point I think I was going to make as well. So with the current structure. If you do support the PPK, then you actually are replacing the Eickhoff payload with the pbkdf2 key. So in order to, if you wanted to not negotiate upfront, let's say I'm talking to a legacy. Client I, don't negotiate it I. Don't have any confirmation that the responder sports BBK they will not recognize the PPK, the no PPK off payload. They will look at the off payload expect it to be the normal.

G

E

And they will not match, and especially if I do have, an implementation that doesn't want to support no PPK off in the case in which I can use PPK, because I don't want to support fallback for a case in which I can potentially have a quantum resistant connection, then there is no other off payload, even for them to have, and so I don't want to necessarily switch the definitions of those okay, I.

L

Said I see, thank you. Thank you pulling.

M

As much laughs, thank you so much for continuing efforts. This document I think that it's a really good condition and thank you for comments about the PRF sand properties which can be or it cannot be applicable for the properties you require. You know if there is some excellent up to time version of security assessment of.

M

Mechanisms because I think they're quite reasonably quite secure, but just in case do you have any assessments publicly available now or just maybe in my list I've taken about quantum system, trust.

K

Well, I think that, generally speaking, I don't know I'm not aware of any formal security analysis. But since that Scott make some cryptographic evolution of.

G

The scheme at, and it is widely known, ideas.

K

That using symmetric cipher is proven to be acceptable only to lower our algorithm in quantum computer world. So if we use symmetric, cipher symmetrical symmetric cryptography by stealing in typically in key seat calculation, we seem to be secure.

M

Against quantum computing, yes, but I am just talking about the issues that are more or less about as a command. You did just five minutes ago that not all perils can see.

K

Floating as it dropped its bottom as it that so.

M

Are we talking about the chart? Okay, okay,.

K

I, don't I'm not a club affair. I can rely on Scott. It's good that assert that some PRF are not pretty much second preimage secure in situation when attacker knows the key and he said that each mark and key mark, although each map based a surah qamar', is secure also, but exhibition and smoke are not secure. Well, I can is comment about it because I'm not a photographer. It's.

M

True and I think that if some additional security assessment we need it, I think it is, can be pushed forward to safer G and critical panel I think it's a good way to go, though I think it will be very easy review, but if you need okay, thank you. Thank.

K

A

H

Just wanted to before we switch talk about timeframe on the draft, and so you would like to review it. Yeah.

A

Answer yeah we could, we got a I, can read of course review it towards the last call. So I did working group last column, so we can actually I think yeah I think we are ready for starting working group last call that so we could probably push temple so just push the pause button on.

A

But actually we can start working from plastico before that, yes, so I think we're actually going to be starting work, intro class code for this quantum registers. You know draft as in few minutes or something like that, all right. So what's next in our charts and I need to check it because our last time I missed it. So we have, we have post quantum key exchange for I can Scott this already there so and switch this floor. Is this one.

H

Scott we're not getting any audio.

N

Sorry I forgot to throw my mic. Okay, we are. This is the most recent draft of our proposal to actually to try to extend IP to to include post quantum key exchanges I'm afraid that to do a technical glitch are the most draft. Most recent Grafton going got updated a few days ago and I don't know if you've got a chance to review it. Yet let's go on to slide three, because, where we're going a bit short in time, fight three please or do I.

N

Have this plea: yeah, okay, uh just a quick summary to my people. What the problem was is is we're trying to add key post-punk exchanges to Ike, as opposed to the previous draft, was just trying to add an a post quantum, a pre-shared keys. We also want to do multi exchanges, so you can do both diffie-hellman del the curve plus new fangled post quantum, so that, basically we don't make things worse and also because of most post quantum algorithms are tend to be chatty.

N

uh We have to deal with fragmentation because we don't necessarily need to be able to rely on TCP fragmentation next.

N

Quick overview, we've completely revised our ideas from the previous ones, because we were there actually rather complex. We were basically going to use the the I Cox exchange is proposed by Valerie and basically the idea is that we put the additional key exchanges within those I and so that and and so that the final key is we actually used is actually the only secure of any of the previous key exchanges were actually secure.

N

Oh say it so that if even if I get the initial diffie-hellman was broken, but the next key exchange which say round two is secure, then the final iqs be secure, and so the IPSec keys will be secure and.

N

All Qixing is our first, our encrypted it confers are encrypted so that, as Valerie mentioned earlier, standard like fragmentation works and therefore that solves the fragmentation problem. If, if the key things you really want needs to be is big, then just do a just to do a say, a group nineteen transfer to be Helmand, XJ exchange that front and then use your the one. You really want. I next slide this proposal. The protocol is actually quite simple.

N

Basically, we do the standard I can knit I say unit exchange with just some some post policy attached and there's a title on this slide. This ke hybrid unresponded. That should really be ke response to response one.

N

Basically, the the initiator just lists does: does it's a normal essay policy in the essay 1 and also lists what sort of additional key things it would would like and responder list which responds with which I wanted it accepted next slide, then, basically, assuming that there was and that they they both agreed on at least one additional key exchanged and then didn't they. They perform each key exchange within a separate I message, with each exchange with the keys, which have already been agreed.

N

I've been agreed to with the previous key exchanges and each kids to exchange updates the keys for the next exchange. Look at the bottom, when we've done through all the I Cox messages with my billing one, then we do and I thought exchange to actually do authentication to to make sure that the Prius transcripts were not man-in-the-middle, attacked and and beyond that.

N

After that, we go and- and everything is nice next slide format a policy we put together, I put a very simple one, basically just list I supposed trying to get fancy with an or, as we just list what's our combinations you would would like, and this is an addition to the key exchange performed in I. Can it so that, if your policy is, you want to do ECD, h, plus one just say route around to back, then all you need to do is list round two and you're in your policy. Its next.

N

This is a work in progress. We deliberately tried to keep things simple because.

N

Well, they make suggestions and and capabilities. It was felt to be a lot easier to add to bullies in later, rather than taking these fake ability as complexity and taking them out and.

N

My open questions is a do. You agree with this general approach, this particular approach a tries to treat classical and post-punk exchanges. Equivalently. Do you agree with that?

N

One of the things we they debated was doing a lot for try to allow multiple key exchanges per exchange just to make things more efficient. How do we include policy? We picked a rather simple, dumb method, something more involved appropriate and also it was actually brought up in the previous ITTF. That key exchange key share is greater than 64. K is a bit problematic. We don't see that as problem. We just want to make sure that we all agree.

N

Thank you. Now we do any questions.

K

Whether it's been slow for this bus first, thank you for a new draft I think it gets improved and actually I like it. There are probably a few things that I don't fully agree with. First I have a question just out of curiosity.

K

You outlines that each new key exchange method is its own months, so you think is it necessary for security, I.

N

Do not believe so the reason we did that is. We really reusing an existing update, that's already with an IP 2, and so since that requires adapter exchange recorded nonce. We put it in there. Okay.

K

Well, what about your questions so I think that the general approach is good, so I think that second bullet is perfect, that we treat click on quantum equally and I. Think that we should not allow multiple kicks chair. Multiple key exchanges, box exchange well, I, think is that only see negotiation well, I'm, not I'm, not convinced that it's currently the best way I still prefer to use in I guess a payload for negotiating premiership, but probably I can live with it. Well, one question: is it inverted to send multiple modified a lot? It's turned of.

G

K

Consistent age containing those exchange message, that must be that suggested to be right secretly, instead of making use of it. So it's just a question of simplicity and complexity. Yeah.

N

One of the things that we want, we were felt was important was to make sure we didn't break compatibility with old, existing.

N

Implementations and we played games with what the what's in the actual DSA payload, they may get confused if we go beyond. What's in the ruling things notifies, they can just basically be counted on to ignore those notifies and everything works. Everything works backwards, leav Adamle well,.

K

I think we need each of the discussed about the last one, with no native support for keys.

N

Course is, of course, the format of the I keep a love payload that there's only existed for a bit k, 16-bit linked field. So of course there were fields right on top, so if they were really wide to, they could actually 60 Meg endorsed as possible. So.

K

N

If you have a huge key share, payload basically slap that on a server somewhere and make your key share. A URL and a hash.

K

Okay, thank you.

D

Channeling den Harkins, he says part of my ignorance, but our oldie NIST qrc submissions request response protocols. That is to message one from each than done. Yeah.

N

Pretty much be honest: I've actually only heard of one serious proposal, which was not a submission which required a three pass protocol and we're ignoring it.

A

Okay, I think that was or call I didn't see anybody in deloin anymore. So I guess we have getting answers to some of their questions here and, let's see okay. So, let's move to next forward, then this is drafted is ongoing, so we are going to be. You know working on this for some time anyway. So, but if you of course would be a good thing to if people actually read it at some point, meaning me to stun it already here. Let's.

A

Keep him now and let's go to the controller Ike, because he I know Daniel is in the whole net making presentation there and he was supposed to be all done in the first 20 minutes. But guess they are relieved like.

C

Why mess with perfection all right, so I started a few years back at a company doing SDRAM stuff, which is what got me involved in all this stuff, we're building things a little differently, so we're building very large full mesh networks. We do 10,000 nodes and in our networks everything is controller based. So we push everything down. We want the end nodes as light as possible, and this is where we came up with this. So a lot of work was done.

C

Looking at how do we get the scalability going I know some discussions been done on the list, so I actually kind of try to address scalability a bit. We're really not focused on how many different ins we can do in a second there's a lot more to our scalability that we're looking at how much memory are we taking up even things like the latency of bringing up a an IKE session is important to us and so for us having sessions ready to go after the controller.

C

Sends you, your information in a full mash was important, and so that's, where we've come out of other things, we're looking at st wins. Getting more and more popular different groups are looking at them and I'm, seeing folks talking about doing key exchanges in a controller environment where they are sending keys through the controller, and that was something we really wanted to avoid. We don't want that man in the middle.

C

We don't want controllers to ever know what keys were actually using to encrypt data and and even in that we've come up with, though there'll be some stuff on. You know future stuff to think about where you could even have end notes, encrypting to even prevent a man-in-the-middle from spoofing other things, odd-shaped networks we have networks that are sometimes links are one directional. It is very hard to do Ike in one direction only, and so with a controller model.

C

We can actually set up a link where two nodes can communicate, though it's only one direction, and that does actually happen.

C

So what is controller Ike? The concept is really simple. You start off. You've got a controller, it's controlling all your IPSec nodes, every node generates a diffie-hellman pair. They send their public is up to the controller. The controller is going to send all the public keys for everybody out to everybody else. It lets everyone know and then voila we've got the ability to do diffie-hellman, shared secrets with every other node in the network.

C

What else here I mentioned? You could sign a message if you cared to in this we've got no peer-to-peer messaging going on, so every everything is strictly to the controller and you're ready to go as it says, it sounds really easy. You could almost think you're done at that point, but it's harder what happens so? What happens when a peer decides to rekey? And this is where it starts to get fun.

C

So if one peer decides, it's time to, you know expire his key out, and this happens every ever how many hours it's configured he's going to send a new diffie-hellman, pier and diffie-hellman public key up to the controller. The controller will distribute that out to all the other peers, but it never happens at the same time. Obviously, and so now, you need a way to make sure that you can do a clean rollover with every other peer you're talking to and not lose data.

C

We don't want any point in that session where traffic drops or you know, traffic can't be sent, it gets even more fun. Then what happens when all 10,000 nodes in your network are all rekeying and this often happens. You've got multiples at the same time,.

D

Go ahead, sorry, fellas, so question so on one hand, you're saying you don't have enough memory to do multiple difficulties at once, because you don't have two memory for it. But on the other hand, you're saying you have two memory to store: 10,000, diffie-hellman public key pairs from all your notes. So.

C

I didn't say we don't at the memory to do 10,000 diffie-hellman. We manage our memory very carefully, so managing 10,000 Ike sessions is more memory than just 10,000 if he humans there's a lot of state going on in that you know these. These are things we've looked at I.

C

There's some other issues: we've had what happens when you have a network with more than one algorithm. Typically in an ST, LAN environment, you've got one configuration for all your notes, everybody's going to do AES GCM. You just tell them to do that, but you have situations they'll be migrations that will be situation three of older hardware. That has supports older algorithms. You want newer Hardware using newer algorithms, so some amount of a negotiation, ish negotiation ish needs to be supported.

C

You have a question. uh Yes,.

O

Queen dang I think something I don't know stand here, so you have the controller who controls all the communication. So why do you need if you're, hammering four, because the controller can generate a shared key for two endpoints and that would be it and they can? They can communicate right.

C

And that's kind of the whole point of this protocol is we don't want the controller generating no.

O

But the controller hold different share from both parties, so the controller can know all the sickness sharing between any any pair. Okay.

C

No, so diffie-hellman doesn't work that way. The the controller has on a.

O

Home in public.

C

Values, it does not know that if your.

O

Controller is emitter on the controller, can replace all the share and and can be an Amana me doing and know everything. That's how it works. That's how you need authentication for the fisherman in order to to be sure that you communicate it to one to the right person, but you have a controller who control all the shares that can replace or a share by its own and then again they can get the he can get all the share secret in his hand. So.

C

As mentioned, you could have nodes individually signing their keys before they send them up. So, if nota a wants to send up no today's new public key, it can sign that when node B gets it, you can verify that this was a key generated by node, a not by the controller. So.

O

So the to knows in a pair already have the communication where they can vet a sign and verify signatures. So I don't know what else do we need if I do have that connection already connection.

C

To the controller, not necessarily peer-to-peer in both directions, so.

O

You mean in this a controller just passing no passing along the the if you haven't share with, if silly sail on it to one party to another, possibly.

D

Yes, absolutely okay,.

O

So so, at least in most opportunity or somewhere in here to to guaranteed that has been done. Otherwise, the controller you know has is this as everything in his head: okay,.

B

Hi Cori director. What makes this Ike what.

C

Makes this Ike? Yes,.

B

And what weighs decided to.

C

Say key exchange and it's on the internet.

C

B

T also being skillful is working group right, so yeah right all right. Sorry, let me vote point more sharply. This is out of scope in this working group.

A

Distilled unit, first of all, as a chair, we take it here because there had been discussed on an ie to NSF about this. You know things that are doing similar kind of thing. This was doing better thing than what they are doing there you state what they are having their east. They have this thing that the controller they'll have two options. One option is to distribute on a day.

A

You know the configuration, which is fine, that the Pierce product like in a in the other box, or they have a toad again when we say that okay, we have all the keys generated by the controller and it pushes them, which means that the controller has all the keys, which would be really really nice for some governments and TAS, but not really nice for anybody else in here. It would actually be yes.

A

The co dragon still do the same thing unless you out have a into and out indication which might bring this case more, probably wouldn't, but the difference there is that now the controller has to manage the active management, many the middle kind of thing, because he has to change the public key said: that's one of the things he might actually get caught, and he probably don't want to do that. Everybody.

A

You know just you know so so it's it's it's some kind of things that this this is parity and if you are not, this is not going to be in our charter. Know that Sasquatch is now, but it's got to be something that might be interesting in people and that's why they took it here. It's.

C

Certainly, it's very applicable to IPSec it's being used. You know, controller based protocols are being used for IPSec, which is why we decided to present it here sure um you know I've presented key exchanges in this forum before so thought. I'd. Do it again sure.

B

Sure um I'm running here on, but it's not IPSec maintenance. Therefore, if you were there for, if you wished, if you wish to actually advance this you'll have to let the screw out the retarder or, yes, this form a new working group and not take a position on the quarry. The work I'm just saying as a process matter, it's out of scope for this working group or go to I to NFS.

K

Come on back to the job already dropped, it's interesting, I won't talk about. It is applicable function, just one question, so in your job, each year has only joined a private key, and so it uses it as its key for communication with every peer in the network. Sure so and Pierce policy says that the key must be changed periodically, of course, so a key must be must take place, but usually how often do you need to change? The key depends on, for example, how much data you encrypt with this key.

K

So in the in situation when you use the single key, but your connections with different peers have different boundaries and different load most the most busy connection will limit support. The key must be changed so that it is suboptimal. We've.

C

Had we've had this discussion.

K

Just raise okay, actually, okay,.

C

Yes, you are limited by your busiest connection.

K

C

Standard key lifetimes in terms of data usage nowadays are large enough that we feel our time based our time based lifetimes.

K

Are going to Pastis, it.

C

Has to be considered, you have a bandwidth lifetime I, never keep okay, we're gonna hit our time based buns. First thank.

K

P

Linda Dunbar, actually I, do have a question for the IPSec and week working group on this, because I do see your environment because you now deploy and then we have similar issue and we have sd1. We have large number of CPS and we don't want to CP to do like a peer authentication for area of the remote nodes and the. To be honest, the controller is under much much more secure environment than those CPL CP can be a pop-up box in like a shopping mall.

P

It's like kerry, not that important data from the network perspective, but the CPE does have established secure channel to the controller. So when CP talk to other CPE, instead of them doing peer-to-peer authentication like PA authentication, they can go to controller through this existing control channel to the other peer. So if it is not IPSec and maybe create a different name and IPSec simplified extra fees- and so it really is- is the environment. When you think about IPSec was created between two nodes: they don't have secure communication. There's a man-in-the-middle attack.

P

Okay, so we had this IP and all those things developed. But in today many of those deployment like today in iTunes I, said they talked about this device. Maybe is the resource constraint with device? Maybe he's a container in the cloud and for this particular note they don't want this know to actually carry the peer-to-peer syndication, so they want a controller to be able to control it. It's true you're, saying, hey controller has everything, but the truth is this particular particular device out in the field.

P

Maybe it's one hundreds of the entire thing, the controller carry much much more information or sensitive information. This particular remote node, it's almost I was telling terrorists almost like your whole body is out of there. You have that little finger, you put so much effort protecting that little finger there. So.

C

Right, you know obviously, we'll have nodes and data centers that are highly protected, but our controllers are the most protective devices on that network and there are a lot of devices stuck in remote offices. Don't need sitting in shopping malls in you know, in a pop-up store, yeah.

P

So so that's that's what I'm saying maybe not calling it IPSec, because when you say IPSec they need those kind of fool protection. Ok,.

O

Kundun again so in that scenario you choose describe and in his application the noes have to do signatures. So that means in a constrained environment. You do signatures fine, then you do it for him in just fine.

C

In our environment, we don't sign ok,.

O

So so so again, so if, if you don't sign your diffie-hellman shares, that means that that means you don't have to do. You don't need to do different human because the controller can generate you know pairwise keys to distribute to different pairs and they can go from there.

C

You know, law enforcement can come subpoena the records of that controller. They want to know that you know there is no to Asians.

G

Like those key.

C

I'm sorry stand your back a bit. um No, it's important. We want. Okay, we want.

O

C

That the keys are only on those end notes. Okay,.

O

If you, if you don't, want anybody to get the keys, then you don't keep the keys. The controller, don't keep the keys either. Don't keep the different human shares from the parties or you don't keep the secret scenes that you generate either one you don't keep them.

P

When I talk to you, I go through Heath, but.

P

A

Actually I think I will cut this disgusting because I don't think it as as eager a quarter said. This is not really a it's, not a part of our Charter, which means that we are presenting it here. Giving a presentation here, because first, you know would be interesting, perhaps especially with the discussing going with a2 and FS, and that people would hear, but we probably be more happy if a to n FS Google Code, this kind of thing are not having the controller having all the keys, yeah understood.

O

I just want to have because people might do a lot of work for wrong reason.

C

Starting about what happens, we've got 10,000 notes everyone's rekeying, the work we did. We put this debt. We put this together and started working on the state machine required to keep everything in synchronous, everything, synchronized, and so it's been broken down. If you read the draft things come down before me, like all right, keep standing back things break down into four rules. We've got four rules that define all of the state and it's actually quite simple. What we've ended up with is a way of synchronizing very loosely we've got.

C

You can have nodes, send their public keys up to the controller controller, we'll send them out. They will arrive at different nodes at different times. Different nodes can decide to act on them at different times it. It all works out more details, read the draft.

C

What else? So, just a quick introduction. You we'd like to take it further. I, don't know what the right working group is or the right politics for that. But we'll be doing this I know I to NSF is doing this and there have been requests. Sure.

B

Oh well I'm happy to talk to you offline, but I. Think, roughly speaking, this will say the second isn't enough piece of new work that I'd be pretty I pretty like I breathe like unenthusiastic. I ain't done anything working group. If you want to talk about, if you want to have like a mailing list and start you know it's our discussions in having a boss, we can show how the discussion, okay,.

C

B

Just like I like to think I like to see things, know narrowly scoped impossible, fair.

C

Enough just wanted to you know a few things to finish on what we've described here is a method, not a protocol. We did not embed this in our own protocol. It's suitable to go into the I to NSF work. It is suitable and other protocols, but it is really just a method at this point.

C

What else you know future considerations, but that's for once we have a place to talk about this mark and that's it.

A

All right thanks, let me go back next to split skipped version, which was Paul people don't comment that they're going to be a skip. Don't you don't.

G

A

Don't care about? You know your presentations, because when I skip you, you don't even comment on them.

F

I made a slide for you. Thank you. Thank you. So.

D

We talked about labeled, IPSec, I brought it in because the reason we wanted support by q2 is that it currently is supported, Ike v1 and we want to be able to kill like v1, and so this is one of the items that some people are using. It's not super common, but we have customers that are using it, and so we want a way of doing is not v2. So there was some discussion whether it should just be a traffic selector content, or should this be in notify content?

D

And there was some discussion back and forth between mostly taro Nick Oh am I forgetting and Valerie. Yes, and it didn't really give me enough guidance to go for one or the other, so I was I was hoping to if we could have some kind of discussion and maybe if the author, some more guidance on what to do.

A

They're, given an individual yeah, the problem, I think, is that everybody had a different understanding. What liability I place a keys? What kinda libel labels you have if they're hierarchy? If there are they, you know just a number to add there and I think before we can actually no decide or think about what would be a suitable way to express them in there. You know in the packets. We actually need to solve that issue. We need to understand what we had sorted so things.

D

A little bit more clarity on that, so indeed I thought that was a possibility of hierarchy, but talking more about especially about the deployed use cases we have with with SELinux. Basically there's no hierarchy, so you either match or you don't match the questions who do want to support other security system that do have a hierarchy.

A

One of the exact side together most of the cases I. What I understand is that they have labels and the label is you? Have you all know? There is no hierarchy, it's just yes,.

D

Because because the promote hierarchies is that under specifying is usually just as bad as over specifying so you don't want it downgrade or upgrade to the level. So it's really just an exact match for.

K

This pose so actually every star is that currently and what label is is removed. So probably, if you give more examples and most cases of which are more no closer to real life use of label it. If you say it will be easier, but anyway anyway, I think that if if label is if a security label is presented,.

G

K

In the night in the packet, for example, like myself label that it better to be negotiated, you can see traffic selector because it's a part of the packet right.

G

K

Significant because we already have traffic selector just exactly for this purpose, to initiate.

D

K

D

The problem was that selectors have other properties and then we have to define all those other properties of selectors. Well, we really only are it's sort of defining a match: selector didn't match Lecter, so it's actually a really simple selector, not a full traffic. Selector Wow.

K

That is that you need to define if you need to support globally, to be shaking it, to define a new traffic select and it's the end different, how to merge them and how to how to use them.

A

Document, if you are just going to have exactly one label for them, it's very easy. You just send you know traffic search of its start and end at the same time. There's no narrowing it has. It has the exactly matched. If you want to say, okay, any label codes to me. You say you know zero. Do whatever the Maxima. Of course the question is East Eli labels, you know fixed length or not. That's the one question: are they integral from material to 32-bit integers or are they strange or what they are? No.

D

No they're variable length levels, but like there's sort of string representations of things okay, then it gets a little bit uglier in.

A

Traffic characters I think yeah, except, but of course, even if that you can always make the exact match, you know, that's it start and end are always saying.

D

So if I'm correct I'm, hearing two voices in favor of traffic selector type, so who isn't who was in favor of to notify payload, let's the WTO, wasn't it.

A

I, don't remember what well, supposing it that for the accident.

G

A

One of the problem was that it was think about the people are saying you know what would be you know. The meaning of the label is also, if you actually actually negotiate or is it something that actually just charged material? Okay, this is the label on what you see when I'm strands meeting, and if you have some mapping. Yes, then for that actually do you know that I would also be okay, so.

D

There's not a negotiation right. This is a statement like I need this label. It's either I need this label or I need no label. Maybe I don't care about the label balls but I'll slap it on.

F

A

Actually I said notify would also be okay. I says it it's it's it's just it's one of those choices. Has you know some properties are different.

A

Some of our notes, one of the good thing about notified, is that it's very easy to ignore, which means that if you try to propose it to somebody who doesn't support it, they just ignore it and return you a trophic structure without a label without the notify in the back, and then you can talk to oh yeah, okay, so he didn't support the label, so it either is miss configuration he sent or you know, owner can I get either tear down like I, say I basically see if I don't use it, because there's no label or against us okay, so they don't support label like that.

A

Just sent anything what my label says: I can send them because I mean that's in my end anyway, confer to say: okay, I'm gonna using T. This is the traffic with this label. I've got to be sending to this ipsec I say, and this means that he's going to be doing that anyway, all the traffic coming out there. You hate going to be label attack with that label and he actually did actually the labels, don't actually really. You could actually do it quite easily bit local it.

A

Unless you have a you know, you want to actually match the labels. On the other end, of course, in some cases you have a security gate for a sequel to create a both of them are using different labels, and they are just you know: local, okay, everything coming from this. You know: si is labeled as outside party one and everything going there Hamas to have a label outside party run to be able to charge me to do this. Essay and I don't care what they are using in their end.

A

Yeah, that's not a label that you're negotiating over there. If you say yes,.

D

A

Mean I mean that could be one of the cases where you actually, you could have your own, both of dates. In some case you have a you know some party who's. You know you are some external party where you actually don't want to negotiate the labels, and then you have an internal party. You have a you know, branch office where you actually assume that there actually might be coming. You know multiple different labels from different essays and you actually want to them, keep them in sync.

A

But then you, you have a different policy, for they say: okay, these parts must match exactly or I, don't care what the other one proposed, but you guys still propose. Actually they label all the time, and if it does other internal three-prong, then you just continue. So that's what I actually could be further notified, but I mean that's something that actually is best for I said: there's pros and cons in both of those. Yes.

D

There have been for three months. So that's why I'm here I.

A

Think, actually, it's you know, III, don't think, there's helping people. Actually you know giving you oh it's the you know a for what so you pick one and you know try to see what happens. Okay, all right so so.

D

Just one record I will go with traffic slacker them because that seems to be a more preferred way.

A

Alright, then we have the final presentation, I think or did I miss somebody else again. Nobody jumping up, but they want so I will actually check my agenda later so Daniel I think I saw him coming in.

Q

So ESP header compression you.

A

Had the cursor.

Q

So this is a draft, as has been quite for quite a while. Now the idea is them. So we call this EHC and the primary the architecture of this draft is that we're building a flexible framework, that's actually easier to read here than on the screen. Yes, so we're building a flexible framework to compress ESP.

Q

So the how it works is that we have a strategy that defines how to orchestrate rules and rules associated with context can compress almost every field in the ESP. Of course, when you compress, you have also to be able to decompress. On the other hand, so that's why we remain we compress and we remain compliant with ESP. So the document defines EHC rules. Yes, you can't text the strategy and some parameters, as I said to strategy. So that's the in this example. We have one strategy, which is the I TSP.

Q

If you count few parameters which we called the IDS become text, those parameters are going to be used to define which rules are going to be applied and which parameters associate for each rules. It looks quite complex from here but I'm at the end. Well, it's we don't have that much complexity. These are the different rules we apply and the different attribute we use, and that has to be specified in some cases. In some other cases, they can be directly read from the essay already.

Q

So it means you don't have to specify those, and this is actually well the rule that has to be seen. Well, if you say, if you're in suppose, you want to compress so something only in the tunnel mode, then you have to specify the mode. But of course, when you apply that you can read the mode from the essay which means just by never during the compression, it can't be done automatically. So in the case of a single UDP session, this is the kind of compressing you can achieve. So you have the packet.

A

Q

This is what you can compress so I mean there is a significant gain that can be achieved. Of course, it's a maximum, so it's not applicable in ever cases, but that's up to what you can achieve and now just so that implicit IV is on the on its way. So you can even really remove this.

Q

So, but so the primary motivation was for IOT devices, but we also find it useful for standard VPN so for a standard VPN. These are some of the parameters you can configure and provide until you achieve 32 bits. Well, it's an ipv6 so but no no bits bytes. So it's a it's kind of significant, even an even in a non IOT use case.

Q

So while this one hardly fit into the slide- and this one is completely integrated into the slides there and again, you can promote this since a few minutes, so compression may not apply at all so well, we were almost done until someone raised an issue that yeah. If we can't compress the packet, how would we signal that? So, for example, when you have a fragmentation or UDP option, you don't really know how to compress, and you compress those so you basically have to send an information saying yeah.

Q

This packet is not compressed, so don't apply your security policies so how you we could. This is the I think. That's the only updates from of this draft is that so we had two solutions while two solutions we envisioned once, which is adding a special bit so usually that's a byte that says don't compress and the other one was reducing an existing field. So it could be protocol or next header, but I'm. We we just realize how many they are left and say. Well, maybe not a good idea.

Q

So two remaining I think we had was the SPI and the SPI means that. Well, you have a trace, a one is just for compressed and one for uncompressed, so why it seems to kind of work now, and so we have to sa, went for the compress traffic and one for the non compressed.

Q

So we have a new IPSec mode, which is a eh decompress, but that's a most most mostly being used when you agree, because when you're negotiator I say you have to agree, then are you gonna use a compressed mode and so on? So the discussion we have now or more? Should we use an additional mode which is itse compressed or should we just provide? The strategy were you're using in our case there is only one, but in the future there might be additional one, sir, and once you pick up, it's gonna be automatically compressed.

Q

So that's a but I think that's more related to the ike negotiation of this header compression, but I think so far and that's the only things we we have discussed during the last ATF. So the current status is that we have the two drafts almost ready. In an hour view, we had one publication of an implosion in Kentucky and well. We should have another implementation, a riot but I'm. This shoot has been a shoot for two years, because any time we had the student leaving but before the project starts.

Q

So it's not because of the project.

Q

So yeah, that's where we are so one one implementation, one academic publication and a draft that have been evolving through different comments and review. Agree have received so far and so I think we're ready for adoption and ready to reach the milestone for November. So.

H

I think the the one snag is where we're waiting on the charter to be approved. Okay,.

A

Yeah I think I think it would better to wait for that before we actually start adopting. You know craft.

G

A

Are in the new charter because he it might be the estus not only details that? Oh no, no, we don't allow it's a question. Tommy.

E

Polly Apple yeah just question: could you get back slide so right, so I I do like the solution that you chose here. I like the idea of a new IPSec mode for this I. Think that works quite well. Has that been added yet to the Ike document, how we negotiate that.

Q

On the previous version for sure and I Pro I had a PhD strategy. Mm-Hmm.

G

Q

Which means I could have at least notify payload and then, when you select one.

E

But this would be a property of the child si right, and so, if I wanted, multiple I would need multiple child disease. I would essentially have my compression child to say in my nonk Java, say: yeah. Okay in just four do you would be in like we have for transport or compression yeah yeah? It's.

A

A transport guess is just.

E

Like the one for use transport, yeah.

A

E

Great so I like that, a lot as far as deploying this, if we know we're in a situation in which we're not going to be allowing IP fragmentation and we're not going to be using UDP options, it would be reasonable to only negotiate the compressed childís, a cracker like it is optional to have to you. Just may drop packets.

A

And take that into your own accent, one of things you can also do you can create the other I say when you first time see pockets having UDP option answer, oh that three Gert.

A

So I mean either one.

G

Can create their safer waters in Japan, they say the pockets.

A

I can't compressed, they can actually, you know, say doc wire on a treadmill, a shape or non porous rock great okay, so they're.

E

They'll be good to if that's not mentioned already night document talk.

A

E

That kind of workflow dynamically, like Bayview, are mainly think your and just do compressed start with that, and then maybe add an extra child to say if you need it. Okay,.

Q

Right yeah, we can add that wherever it is.

K

I will it's a good idea to have to say, but there is one drawback: you need to perform difficult meant right and since you are trying to know they.

A

K

You have the same keys.

A

K

A

K

Do anyway, but you don't have.

A

K

There and the other thing is that you usually an exchanged, the one channel, they say in Ike, also you and Wayne to perform a childís a result this well anyway, it's more computing resource, you save bandwidth, but you spend more computer resource on exciting news. A yes.

Q

K

Q

Then roughly the focus was to reduce the bandwidth, because I think the it's around I mean if you send one byte more. It's a 10,000 time more than a competition.

Q

The competition costs much less than sending an additional bite, but.

K

Q

K

Q

Maybe just using.

K

The same Keys is different with two different experience now, using.

Q

The C&C disease.

K

Q

Said the defilement would be for the hike negotiation. The first one.

K

Knows but but just supply additional spi. This is a for use in compressed, so you will have well it's just an idea.

A

You can't use the exactly same keys because I made a situational person and so on needs to be different, for you, I mean otherwise. You have a nonce, collisions and so on, but you could have confronted. You know Kim at twice to canary to different, but then you need to have something different, that you have the SPI, a very firm you work, but I think actually much cleaner. The just to do a charter sacred, shall they start to pocket exchange and it doesn't need to do differ. Hellman yeah,.

Q

So the different manner I understand that we may not need well. We might do that to twice but I'm. It's not necessary that we use exactly the same keys for the two is.

Q

Alright, is it a renegotiation, okay,.

A

So then we go to the next one, which is open discussion I have at least one it I think for myself.

A

So this is their given not working as a working group share pattern into it. Also, I posted a email couple of days ago about adding this or allocating numbers. For you know, I enter numbers for 12,000 and 16,000 bit. Groups for a mod p and regional dynamics are asking what to get your feedback, because I'm a little bit. You know this kind of conflicts here, because I'm working group chair- I am eighty Ayana expert, probably one who's going to be writing the draft or RFC fight.

A

There is going to be one, so I want to know if there's any other people who are actually think this is a good idea or bad idea before I just go and do it myself or should I just ignore it so that the reason there is I attended in the email list and every most people biggest reason is that there is, you know people say: oh, we need to have a shot. We need to have a 256-bit security because of the comms and computers.

A

They don't know what the two five six is, except that it's a number and they know two five, six Oh a yes to faxes, feels that one so to 512. We love that one more P, okay, we don't have any more P that feels that one we could have a 8,000 bit. Species 200 bits, not enough. 16,000 would be enough, but we don't have that one as a higher number. We have generated the Krug's when we created the old.

A

You know extra allocated extra, more big groups, but we didn't include them that because it was I think at that time it was about 30 seconds to do it now, it's about half a second. It actually would be actually doable to do.

A

Use it in some cases when you have not, when you have, you know a thousand customers, but if you have a site-to-site VPN, you know with one VPN link, then you can actually do it even it, of course, there's a issues with fragmentation of the pocket, but okay site to site, VPN old, usually have a good internet and not behind Nats, and not behind captive portals or anything like that. That would destroy fragments and so on. So do people think it is a good idea, bad idea. What should I do.

D

Well, Paris I think it's okay, as long as I say really good instruction in the document. I say do not add this to your list of default proposals, because we know that some implementations at everything they implemented their proposals, which leads to you, know, giant explosion of of components, and it will indeed lead to like our let's use the highest number, because there must be the most secure and then you're actually running this everywhere, instead of only in this case as you want it, but and I'm willing to help you with the document. It.

R

Daniel, a nice tie Sara if you're just doing this to check a box for this is safe against quantum computers, it's kind of a false sense of security, because those are not necessarily decision.

A

No I, don't think, actually is a force sensor security. We see that actually do offer you two five six bits of security. The difference is that with quantum computers, none of our are good about what piece or elliptic curves is safe. I mean that reason why you actually were equal to 56 is false. The reason that this fact that it actually do provide 256 bits of security is valid.

R

Does the diffie-hellman provide 256 bits of quantum security, though, as well I, don't know no.

A

I mean none of them, none of them I present to doesn't provide. You know, I, don't know how much, how many bits of security it provides when you have a quantum computers currently right. So it's also so none of the security requirements we have is valid for that. No.

R

I know so, if we're saying that this does provide 256 bits of quantum security and they're just, but we don't actually know that it not a. We say it provides 200 256 bits of security.

A

When you don't have a quantum computers, okay,.

R

But if they're checking the box that they want this in case of a quantum computer, then they're checking a box yeah.

A

No they're checking their box to foxy. It's it's a security, they don't actually care. Okay, it was like the most.

G

A

They don't they don't understand the reason why it's? Why why 5 6 is better than you know, white white? Oh, why you need, for example, or some people actually say that you must be able to do two five six. They usually don't say that you have to do it. They said you must be able. Okay, that's fine. This is actually one of the reasons we were actually in 15, for as we are running out of 5, but 15 4. We have now working this stuff in I Triple E.

A

All we need to add a is 2 5 6 ECM to the spec, because 256 is required for some per uses, some governments or something required that everything must be able to do. No.

R

You're not sure, just when you were talking here, you said because they're scared of quantum computers and that's the requirement for somebody.

A

Gave them somebody said to 5 6, p, 2, /, 6, 6 and region day. Somebody said to 5: 6 is the quantum computers, but the requirement is just 2, 5 6, usually ok,.

K

Well, it is my cell phone is plus I. Think it's ok. If we define this, you might be grouped just for formal reasons, as you described I'm, not sure, is there really useful, but let let it be well, why not I just want to say? Is it the public key experience?

K

All of these groups are a huge, quite huge as I exceed typical IP packet size and they probably will cause fragmentation and it will make using them in their lives in some, at least in some circumstances, a little bit difficult, let let's say so so but anyway, let let's define them. Why not all.

D

D

Ciphers, a small different topic- if we're done with this part, is reddit, so I also have a case where customers want to roll out IPSec, but if they find authentication little bit hard to do so, they first go like what, let's do mutual know first and roll that out and then later on. They want to update to use certificates other things and then and do authenticated. So now, you've got this this cloud structure.

D

It has all these off, no notes that are talking to each other, and then you slightly want to upgrade them whenever you configure new notes to have like say certificate, so what we ended up doing is doing the same trick. That is used in the in the No PPK case, where we basically sent a second earth payload one with the certificate of one for earth know and on the other side can pick like I have. Since we brought seem to be supporting authenticated, we can just bump our connection from Earth node to authenticate it.

D

So we've done this. We've implemented this and it's working. The question is raised sort of squatting on a private use number. Should we just put this in a draft and push it out and allocate a number for it.

H

Anyone interested in that solution.

K

Though, can you please bring these to the list because it's it's easy to read and to think you can test.

E

Tommy Polly Apple that sounds interesting enough. I guess the one concern I'm trying to think of here is would having that other option, potentially encourage people to use the wrong one. Like would could someone end up choosing the null off instead, if they don't know what they're doing like.

E

That's true right right but like by doing this like, should we be advertising to people or encouraging, or should we be making it easier to deploy no loss education for Ike, rather than just saying guys figure out how to do authentication I understand how, for your use case, that's it makes sense right now, but is that something that we want to keep encouraging long term are making easy.

H

Yeah, so I think we will want to take that to the list. Maybe you could summarize yeah, hey I think we still have a couple more, no well all right! Well, I! Guess we'll we'll end it here. Thank you. Everyone we will I'm getting the minutes posted as soon as possible. Thank.

J

J

A

Thanks for the note keeper Santoni.