Subject: [Ipsec] RE: Extended Authentication IKEv1 - IKEv2

From: Tschofenig Hannes <[email-masked]>
Date: Mon, 13 Sep 2004 10:38:41 +0200

hi uma, 

the work done in the ipsra working group had a different focus: add secure
legacy authentication without changing ike. as a result see for example pic.

the work on ikev2 and the discovered man-in-the-middle attack problems
caused people to think in a different direction. 

ciao
hannes

________________________________

	From: Uma Shankar Ch [mailto:[email-masked]] 
	Sent: Friday, September 10, 2004 7:32 PM
	To: [email-masked]
	Cc: [email-masked]; Tschofenig Hannes
	Subject: Extended Authentication IKEv1 - IKEv2

	Can IKEv1 be used with any mutual authentication  method using
Xauth? 
	Am not aware of it.
	
	In IKEv2 extended authentication happen as part of AUTH exchange
before authenticating the 
	Client by the server. But, in IKEv1 it happens after establishing
trusted authentication 
	channel with whatever way authentication is configured ( by
pre-shared key or public key 
	certificates) by the administrator. Is it because with IKEv1, we
can't use mutual authenticating 
	method?
	
	In this context, in summary, I have the following questions 
	
	1. What is the rationale of changing the way extended authentication
starts from v1 to v2?
	
	Of course, there would be definitely certain advantages with this
change, but am not able to
	 understand what are those.
	
	 (i) Is that, the repercussion of this change is the text in
Security Considerations section 
	(Section 5) of the draft?
	
	"Use of EAP authentication changes the probing possibilities
somewhat.
	 When EAP authentication is used, the responder proves its identity
	 before the initiator does, so an initiator that knew the name of a
	 valid initiator could probe the responder for both its name and
	 certificates." 
	
	2.  I could not find any text relating to the change of the way
extended authentication happen in  IKEv1 and the proposed standard in IKEv2
in "Appendix A: Summary of changes from IKEv1" of
"draft-ietf-ipsec-ikev2-15.txt".
	
	3. The last minor point.
	
	 (i) Even "draft-ietf-ipsec-ikev2-15.txt" refers [EAP] as RFC 2284
which is obsolete and the 
	new one being  RFC 3748?
	 (ii) In the text wherever applicable, the draft is mentioning
"Extended Authentication ..." 
	it should have been "Extensible Authentication..."
	
	Can any body clarify on this?
	
	-Uma
	
	www.intoto.com <http://www.intoto.com/> 

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec