Re: SOI QUESTIONS: 2.2 Perfect forward secrecy (PFS)

[Jean-Jacques Puig <jean-jacques.puig@int-evry.fr>]

Hi,

Paul Hoffman / VPNC <paul.hoffman@vpnc.org> wrote:

> In the typical VPN scenario (either gateway-to-gateway or remote-access WAN):
> 
> - PFS is a real requirement for some but not all user scenarios

 I agree. PFS support is, IMO, a requirement for scenarios involving gateways, especially in VPNs.
But not everybody will need PFS, and we can expect (in some scenarios) the SA lifetime to be big enough for their use and no key derivation required.

	Should'nt PFS / Imperfect PFS / No PFS be negotiated in the exchanges of IKEv2 ?

If not, I stand for PFS as a requirement.

--
Jean-Jacques Puig