Re: [IPsec] I-D Action: draft-ietf-ipsecme-ikev1-algo-to-historic-08.txt

Tero Kivinen <kivinen@iki.fi> Wed, 23 November 2022 12:11 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Message-ID: <25470.3527.51755.35718@fireball.acr.fi>
Date: Wed, 23 Nov 2022 14:10:47 +0200
From: Tero Kivinen <kivinen@iki.fi>
To: Paul Wouters <paul@nohats.ca>
Cc: ipsec@ietf.org
In-Reply-To: <d5250375-e220-6b1c-ca6f-357d6c12674a@nohats.ca>
References: <166878243717.63383.13722856524693664615@ietfa.amsl.com> <d5250375-e220-6b1c-ca6f-357d6c12674a@nohats.ca>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipsec/r6XCmvXXbYhgd19CNxIpZbk3tU8>
Subject: Re: [IPsec] I-D Action: draft-ietf-ipsecme-ikev1-algo-to-historic-08.txt
Precedence: list

Paul Wouters writes:
> ps. Re-reading this draft, does anyone remember why we deprecated DH22
> (1024-bit MODP Group with 160-bit Prime Order Subgroup) but not DH2
> (also 1024 bit MODP)

>From 8247:
...
   Group 2 or the 1024-bit MODP Group has been downgraded from MUST- in
   RFC 4307 to SHOULD NOT.  It is known to be weak against sufficiently
   funded attackers using commercially available mass-computing
   resources, so its security margin is considered too narrow.  It is
   expected in the near future to be downgraded to MUST NOT.

...
   Groups 22, 23, and 24 are MODP groups with Prime Order Subgroups that
   are not safe primes.  The seeds for these groups have not been
   publicly released, resulting in reduced trust in these groups.  These
   groups were proposed as alternatives for groups 2 and 14 but never
   saw wide deployment.  It has been shown that group 22 with 1024-bit
   MODP is too weak and academia have the resources to generate
   malicious values at this size.  This has resulted in group 22 to be
   demoted to MUST NOT.  Groups 23 and 24 have been demoted to SHOULD
   NOT and are expected to be further downgraded in the near future to
   MUST NOT.  Since groups 23 and 24 have small subgroups, the checks
   specified in the first bullet point of Section 2.2 of "Additional
   Diffie-Hellman Tests for the Internet Key Exchange Protocol Version 2
   (IKEv2)" [RFC6989] MUST be done when these groups are used.
...

I.e., the main reason being that group 2 was only MUST algorithm
before, and moving it from MUST to MUST NOT while we do not have any
oher algorithms as MUST was considered bad. Also the group is formed
inin a deterministic way which should not make it possible that the
group is created to be weak from the beginning.

There were no such concerns for the group 22, and also as there is no
way of knowing whether that group is generated as weak group that is
even more reason to make it MUST NOT.
-- 
kivinen@iki.fi

[IPsec] I-D Action: draft-ietf-ipsecme-ikev1-algo… internet-drafts
Re: [IPsec] I-D Action: draft-ietf-ipsecme-ikev1-… Paul Wouters
Re: [IPsec] I-D Action: draft-ietf-ipsecme-ikev1-… Tero Kivinen
Re: [IPsec] I-D Action: draft-ietf-ipsecme-ikev1-… John Mattsson
Re: [IPsec] I-D Action: draft-ietf-ipsecme-ikev1-… Paul Wouters
Re: [IPsec] I-D Action: draft-ietf-ipsecme-ikev1-… Tero Kivinen
Re: [IPsec] I-D Action: draft-ietf-ipsecme-ikev1-… Paul Wouters
Re: [IPsec] I-D Action: draft-ietf-ipsecme-ikev1-… Daniel Migault