ISAKMP 'master key' PFS (phase I) vs Ipsec session key PFS (Phase II) A question for the crypto-experts to help out a somewhat confused guy: why does PFS (perfect forward secrecy) also exist in phase II as well as in phase I?

Rationale:
 In phase I ISAKMP, the result of main mode is following keying material:

SKEYID_d = prf(SKEYID, g^xy | CKY-I | CKY-R | 0)

SKEYID_a = prf(SKEYID, SKEYID_d | g^xy | CKY-I | CKY-R | 1)

SKEYID_e = prf(SKEYID, SKEYID_a | g^xy | CKY-I | CKY-R | 2)

SKEYID_d is used in phase II to come up with a session key.
g^xy is the DH (Diffie-Hellman) shared secret.

So there is already PFS in phase I by design. Each time someone establishes a new IPsec VPN tunnel, a new DH shared secret g^xy will be used to compute SKEYID_d, right? Hence, the session key in phase II will also be unique. This is PFS right there?

So if we also do DH in phase II we have double PFS? What is the point?
So there is already PFS in phase I by design. Each time someone establishes a new IPsec VPN tunnel, a new DH shared secret g^xy will be used to compute SKEYID_d, right? Hence, the session key in phase II will also be unique. This is PFS right there?


No, you do not recompute a fresh SKEYID_d for every Quick Mode; instead, a value for SKEYID_d is assigned when the IKE Security Association is created (just like all the other SKEYID values), and is thereafter constant for the duration of the SA.

Hence, that wouldn't meet the definition of Perfect Forward Secrecy; the idea behind it is if the adversary captures the device (and learns everything it knows), he would not learn any previous keys (of course, he would learn any current keys).

In this case, the adversary would learn the value SKEYID_d; the IPsec keys are derived in IKEv1 from prf(SKEYID_d, [ g(qm)^xy | ] protocol | SPI | Ni_b | Nr_b).  If the attacker captures the device (and so learns the SKEYID_e value, and so is able to decrypt the IKE traffic), he learns the values of protocol, SPI, Ni_b and Nr_b (as they are all sent through the encrypted session).

So, if the PFS option is not used, the attacker can learn the IPsec keying material, and read all the traffic.  If the PFS option is (properly) used, then the attacker cannot learn g(qm)^xy, and so does not get the keying material.

I made these comments in the context of IKEv1; similar reasoning applies to IKEv2 (the current version of IKE)