Timeline for ISAKMP 'master key' PFS (phase I) vs Ipsec session key PFS (Phase II)
Current License: CC BY-SA 4.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 17, 2020 at 20:05 | comment | added | poncho | @Jeroen: the attacker who compromises the device (and learns SKEYID_d) can then recompute the previous KEYMATs (because, if PFS is not being used, all parameters to the prf are in stored state (SKEYID_d) or sent over the wire (protocol, SPI, nonces) | |
| Feb 17, 2020 at 19:57 | comment | added | Jeroen | I am a little fuzzed on the benefit of PFS still. If PFS is used for phase II and an attackers compromises the device after some time, all traffic that has been sent using 'old' KEYMAT is safe because the KEYMAT got discarded after every phase II rekey. If the attacker wants to decrypt stuff long term he will have to capture the KEYMAT before each rekey. This is what you are saying I believe? If PFS is not used then, and an attacker can decrypt phase 1 (because he knows SKEYID_e) how would he be able to decrypt the traffic that had been sent before he compromised the device? | |
| Feb 17, 2020 at 19:00 | history | answered | poncho | CC BY-SA 4.0 |