Re: ikev2-07: last nits

[Francis Dupont <Francis.Dupont@enst-bretagne.fr>]

 In your previous mail you wrote:

   (5) Page 29 2.17

   Current text:
   
    For CREATE_CHILD_SA exchanges with PFS the keying material is defined as:
    
         KEYMAT = prf+(SK_d, g^ir (ph2) | Ni | Nr )
   
   Proposed text: erase g^ir (ph2)
   
   Explanation: this is a leftover from 06. You erased g^ir from other places
   where it was unneeded but this one stayed. If I understand correctly, the
   value SK_d used in this derivation is computed in section 2.18 using

=> I am afraid that you are wrong here: section 2.18 is about
CREATE_CHILD_SAs rekeying IKE SAs, section 2.17 is about
CREATE_CHILD_SA in general (i.e., for IKE SAs and IPsec SAs),
and KEYMAT is (this is not written in the draft!) for IPsec SAs only.

   SKEYSEED which, in turn, is already derived from g^ir (new) . 
   Thus re-using g^ir (ph2) (here `ph2' and `new' refer to the same thing) 
   under SK_d is of no help (and spoils the theoretical analysis).
   
=> in fact there are at least two improvements to do:
 - explain again what is a CHILD_SA (the term is introduced in the overview)
 - as a consequence make clearer that KEYMAT is the keying material
   of the being established IPsec SA pair.

Regards

Francis.Dupont@enst-bretagne.fr