Subject: [Ipsec] EAP_ONLY_AUTHENTICATION -- IDr payload

From: Uma Shankar Ch <[email-masked]>
Date: Fri, 10 Sep 2004 23:46:11 +0530

Can any body answer this.

As, In IKEv2 extended authentication happen as part of AUTH exchange before 
authenticating the
Client by the server.(Of course it is protected)
The IKE responder node should send IDr in response to the third message 
according to
  "draft-eronen-ipsec-ikev2-eap-auth-01.txt" ?

HDR, SK { IDi, [IDr,] EAP_ONLY_AUTHENTICATION,
                    SAi2, TSi, TSr}  -->

                              <--   HDR, SK { IDr, EAP(Request) }

It could have been postponed up till the last message where SAr2, TSi, 
TSr  are sent by responder. My point is why responder should expose his 
identity before authenticating the client in this scenario?

Regards,
Uma
www.intoto.com

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tschofenig Hannes <[email-masked]>
Date: Mon, 13 Sep 2004 10:39:08 +0200

hi uma,
 
let me make sure that i understood your question. you are asking why user
identity confidentiality of the initiator is not provided when using eap in
ikev2?
 
if so, then please take a look at the discussions with regard to this issue
more than one year go:
http://www.sandelman.ottawa.on.ca/ipsec/2003/06/msg00021.html
 
as a short summary: a few people argued that user identity confidentiality
is not important compared to the additional roundtrip caused by the identity
request / identity response. 
 
you mention draft-eronen-ipsec-ikev2-eap-auth-01.txt in this context. this
draft has a different goal (independent from the above discussion).

ciao
hannes

________________________________

	From: Uma Shankar Ch [mailto:[email-masked]] 
	Sent: Friday, September 10, 2004 8:16 PM
	To: [email-masked]
	Subject: [Ipsec] EAP_ONLY_AUTHENTICATION -- IDr payload

	As, In IKEv2 extended authentication happen as part of AUTH exchange
before authenticating the 
	Client by the server.(Of course it is protected)
	The IKE responder node should send IDr in response to the third
message according to
	 "draft-eronen-ipsec-ikev2-eap-auth-01.txt" ?

	
	It could have been postponed up till the last message where SAr2,
TSi, TSr  are sent by responder. My point is why responder should expose his
identity before authenticating the client in this scenario?
	
	Regards,
	Uma
	www.intoto.com <http://www.intoto.com/>