Re: SOI QUESTIONS: 2.2 Perfect forward secrecy (PFS)

[Henry Spencer <henry@spsystems.net>]

On Tue, 18 Jun 2002, Theodore Ts'o wrote:
> 	In the past, the working group has pretty much decided that
> perfect forwrd secrecy as a possiblity is a requirement, so that isn't a
> uestion here.  The concept of being able to trade off performance
> with the level of PFS provided is a relative new possibility...

I have no strong feelings about the details of that, but I do want to put
in a plug on a slightly related point:  however the details work, two
conforming implementations should interoperate (policy permitting) without
prearranged agreement on PFS mode. 

This is one place where IKE falls down badly.  The choice of PFS or no PFS
is neither negotiated nor announced in the protocol, yet the two ends must
agree exactly or communication mysteriously fails.  (This is an empirical
fact; I haven't examined the details to sort out just how it happens.)

                                                          Henry Spencer
                                                       henry@spsystems.net