Re: SOI QUESTIONS: 2.2 Perfect forward secrecy (PFS)

[Bill Sommerfeld <sommerfeld@east.sun.com>]

> 2.2 Perfect forward secrecy (PFS)
> 
> 2.2.A) JFK and IKEv2 can provide PFS as well as "imperfect forward
> secrecy" by trading off performance versus the level of PFS provided.
> The funcitonality provided is roughly identical.  Does anyone care
> about the details of how IKEv2 versus JFK provides this functionality?
> Should we just flip a coin?

I think the specs need to be clear about what the forward-secrecy
guarantees are.  In particular, in order to provide forward-secrecy
guarantees to the users of IPsec, SA keying material needs agreed-upon
"destroy-after" dates.

I believe this requires protocol-visible IPsec SA and DH exchange
keying material lifetimes.

I don't believe a separate DH exchange is needed for each SA; I'm
agnostic about whether a separate DH exponent key is required per
peer; i.e., I think the IKE vs JFK differences are immaterial for
this.

					- Bill