Is JFK DOS proof when PFS is required?

[Michael Choung Shieh <mshieh@netscreen.com>]

The second message of JFKi and JFKr requires DH operation:
JFKi:
Message 2, R->I:  Ni, Nr, g^r, GRPINFOr, IDr,
                     SIG{r}(g^r, GRPINFOr), HMAC{HKr}(Ni, Nr, g^i, g^r)
JKTr:
Message 2, R->I:  Ni, Nr, g^r, GRPINFOr, HMAC{HKr}(Ni, Nr, g^r)


Although the authors lessen the fact by introducing "forward secrecy
interval".  However, when PFS is required, the responder will need to
generate g^r (and SIG() in JFKi) for every ike message 1 from any sources
thus subject to DOS attack.

Without PFS, once the DH is compromised, multiple tunnels across multiple
peers are compromised, since Ni and Nr are sent in clear.  This will be a
major problem when implementing the protocol.

Michael Shieh