Re: [IPsec] DH keys calculation performance

2011-08-26 Thread Naveen B N (nbn)
er'; 'Yoav Nir'; 'timo.te...@iki.fi' Cc: 'ipsec@ietf.org'; Prashant Batra (prbatra); 'ipsec-tools-us...@lists.sourceforge.net'; 'ikev2-de...@lists.sourceforge.net'; 'ipsec-tools-de...@lists.sourceforge.net' Subject: RE: [IPsec] DH keys

Re: [IPsec] DH keys calculation performance

2011-08-26 Thread Scott Fluhrer (sfluhrer)
> -Original Message- > From: Naveen B N (nbn) > Sent: Friday, August 26, 2011 1:37 AM > To: Naveen B N (nbn); Scott Fluhrer (sfluhrer); 'Yaron Sheffer'; 'Yoav > Nir' > Cc: 'ipsec@ietf.org' > Subject: RE: [IPsec] DH keys calculation perf

Re: [IPsec] DH keys calculation performance

2011-08-25 Thread Naveen B N (nbn)
er'; 'Yoav Nir'; 'timo.te...@iki.fi' Cc: 'ipsec@ietf.org'; Prashant Batra (prbatra); 'ipsec-tools-us...@lists.sourceforge.net'; 'ikev2-de...@lists.sourceforge.net'; 'ipsec-tools-de...@lists.sourceforge.net' Subject: RE: [IPsec] DH keys

Re: [IPsec] DH keys calculation performance

2011-08-25 Thread Scott Fluhrer (sfluhrer)
c-tools- > us...@lists.sourceforge.net; ikev2-de...@lists.sourceforge.net; ipsec- > tools-de...@lists.sourceforge.net > Subject: RE: [IPsec] DH keys calculation performance > > Hi Scott, > > Please find the queries and comments inline .. > > Scott>- Transporting keying material lack

Re: [IPsec] DH keys calculation performance

2011-08-25 Thread Naveen B N (nbn)
on Sheffer; Yoav Nir Cc: ipsec@ietf.org; Prashant Batra (prbatra) Subject: RE: [IPsec] DH keys calculation performance > -Original Message- > From: ipsec-boun...@ietf.org [mailto:ipsec-boun...@ietf.org] On Behalf > Of Naveen B N (nbn) > Sent: Thursday, August 25, 2011 6:48 AM >

Re: [IPsec] DH keys calculation performance

2011-08-25 Thread Scott Fluhrer (sfluhrer)
different reasons); the IKEv2 designers decided to unify that. > > Thanks and Regards > Naveen > > From: ipsec-boun...@ietf.org [mailto:ipsec-boun...@ietf.org] On Behalf > Of Prashant Batra (prbatra) > Sent: Tuesday, July 26, 2011 6:33 PM > To: Yaron Sheffer; Yoav Nir &g

Re: [IPsec] DH keys calculation performance

2011-08-25 Thread Naveen B N (nbn)
-boun...@ietf.org [mailto:ipsec-boun...@ietf.org] On Behalf Of Prashant Batra (prbatra) Sent: Tuesday, July 26, 2011 6:33 PM To: Yaron Sheffer; Yoav Nir Cc: ipsec@ietf.org Subject: Re: [IPsec] DH keys calculation performance Thanks Yoav and Yaron  for the suggestions. Even I was thinking and

Re: [IPsec] DH keys calculation performance

2011-07-26 Thread Hugo Krawczyk
Regarding Dan's suggestion (*) of using g^x, g^{x+1}, etc as successive DH values, I would like to note the following. This would lead to situations where two parties exchange successive keys of the form g^{xy} and g^{(x+1)(y+1)}=g^{xy}*g^x*g^y*g. In this case, if an attacker learns the key g^{xy}

Re: [IPsec] DH keys calculation performance

2011-07-26 Thread Yoav Nir
>> Cc: ipsec@ietf.org >> Subject: Re: [IPsec] DH keys calculation performance >> >> >> On Jul 25, 2011, at 11:29 PM, Prashant Batra (prbatra) wrote: >> >>> Hello, >>> >>> The DH exchange (Calculation of Public/Private key and t

Re: [IPsec] DH keys calculation performance

2011-07-26 Thread Scott Fluhrer (sfluhrer)
> -Original Message- > From: ipsec-boun...@ietf.org [mailto:ipsec-boun...@ietf.org] On Behalf > Of Yoav Nir > Sent: Tuesday, July 26, 2011 6:40 AM > To: Prashant Batra (prbatra) > Cc: ipsec@ietf.org > Subject: Re: [IPsec] DH keys calculation performance > >

Re: [IPsec] DH keys calculation performance

2011-07-26 Thread Dan Harkins
Hello, On Tue, July 26, 2011 6:03 am, Prashant Batra (prbatra) wrote: > Thanks Yoav and Yaron for the suggestions. > > Even I was thinking and tried generating and storing the key pair well > in the beginning,. This helped to some extent. > > > > The secret calculation is also very expensive

Re: [IPsec] DH keys calculation performance

2011-07-26 Thread Prashant Batra (prbatra)
From: Yaron Sheffer [mailto:yaronf.i...@gmail.com] Sent: Tuesday, July 26, 2011 4:47 PM To: Yoav Nir Cc: Prashant Batra (prbatra); ipsec@ietf.org Subject: Re: [IPsec] DH keys calculation performance You might want to review http://tools.ietf.org/html/rfc5996#section-2.12. Also, session

Re: [IPsec] DH keys calculation performance

2011-07-26 Thread Yaron Sheffer
You might want to review http://tools.ietf.org/html/rfc5996#section-2.12. Also, session resumption (http://tools.ietf.org/html/rfc5723) reduces the computational costs of renewing an IKE SA when a client needs to reconnect to a gateway a second time after some failure.

Re: [IPsec] DH keys calculation performance

2011-07-26 Thread Yoav Nir
On Jul 25, 2011, at 11:29 PM, Prashant Batra (prbatra) wrote: > Hello, > > The DH exchange (Calculation of Public/Private key and the Secret) in > IKEV2 Initial exchange > seems to be very expensive. This is slowing down the overall IKEv2 > tunnel establishment. > Is there a way to optimize it?

Re: [IPsec] DH keys calculation performance

2011-07-25 Thread Vishwas Manral
Hi Prashant, Back in the days we had some acceleration of DH in the hardware http://www.wipo.int/patentscope/search/en/WO2005008999. Other things you can do is put in more CPU or use a lower DH group. Thanks, Vishwas On Mon, Jul 25, 2011 at 8:29 PM, Prashant Batra (prbatra) wrote: > Hello, >

[IPsec] DH keys calculation performance

2011-07-25 Thread Prashant Batra (prbatra)
Hello, The DH exchange (Calculation of Public/Private key and the Secret) in IKEV2 Initial exchange seems to be very expensive. This is slowing down the overall IKEv2 tunnel establishment. Is there a way to optimize it? Regards, Prashant ___ IPsec mai