Subject: [eap] EAP(Request, Identity)

From: [email-masked] (Antonio Forzieri)
Date: Fri, 21 Mar 2003 11:04:44 +0100

Hi to all,
I'm a people of the IPsec WG. In these days we are discussing about some 
issues about EAP, which is going to be including in IKEv2. The main 
problem we have is this:

Does the autheticator need to know the peer's identity before sending an 
EAP(Request,MD5)? Or we can send that EAP message without knowing the 
initiator identity? Is it possible a scenario like this?

	Peer					Authenticator
        ------			  	       ---------------
				    <--	      EAP(Request,MD5)
        IDi, EAP(Response,MD5)       -->
				    <--	      EAP(Success/Failure)

EAP messages are encapsulated in IKEv2, and IDi is carried by a special 
IKEv2 payload type (Identity).
Will this solution work?

-- 
------------------------------------------------
Antonio Forzieri
CEFRIEL - Politecnico di Milano
Tesista Area E-Service Tecnologies
Tel: 02-23954.334 - email: [email-masked]
ICQ# 177683894
------------------------------------------------

---

From: [email-masked] (Antonio Forzieri)
Date: Fri, 21 Mar 2003 11:51:27 +0100

Jo Hermans wrote:
First of all thanks a lot for your answer.

> For MD5-challenge, it's possible if the identity is passed together with 
> the response/md5 (inside the encapsulating RADIUS message for instance) 
> or is determined from the response-message itself (source-ip-address, 
> caller-id, whatever, ...). Or if you would use always the same identity 
> somehow.

Ok! It sounds fine for me. So the Authenticator can send 
EAP(Request,MD5) without knowing the peer's ID (right?).
Is it possible only for MD5 AUTH? Or is it possible for a generic method 
which uses EAP? (OTP, GTC)

I guess that with OTP the authenticator should know the peer's identity 
before sending the "challenge", is it right?