Subject: AW: [Ipsec] EAP_ONLY_AUTHENTICATION; is it still valid?

From: "Tschofenig, Hannes" <[email-masked]>
Date: Tue, 23 Aug 2005 10:33:33 +0200

hi satoshi, 

thanks for our feedback. please find a few comments below: 

> Hi all,
> 
> While I was trying to figure out how to do EAP w/o CERT, I found
> description on EAP_ONLY_AUTHENTICATION notification payload in
> draft-eronen-ipsec-ikev2-eap-auth-03.txt. Is this notify (or I-D I
> may say) still a valid type in terms of IKEv2 standard track?

what do you mean by valid? 
where do you see a problem? 

> 
> Relating to this topic, I'm a bit confused with the sequence below;
> IKEv2 w/ EAP sequence (just copied from IKEv2-17).
> 
>     Initiator                          Responder
>    -----------                        -----------
>     HDR, SAi1, KEi, Ni         -->
> 
>                                <--    HDR, SAr1, KEr, Nr, [CERTREQ]
> 
>     HDR, SK {IDi, [CERTREQ,] [IDr,]
>              SAi2, TSi, TSr}   -->
> 
>                                <--    HDR, SK {IDr, [CERT,] AUTH,
>                                              EAP }
> 
>     HDR, SK {EAP}              -->
> 
>                                <--    HDR, SK {EAP (success)}
> 
>     HDR, SK {AUTH}             -->
> 
>                                <--    HDR, SK {AUTH, SAr2, TSi, TSr }
> 
> If CERT is not used with EAP, how do we derive the AUTH payload in
> message 4?

with ikev2 the responder uses pk-based authentication to the initiator.
if the cert payload is not included in message 4 then the initiator is
assumed to know the certificate (based on the identity of the
responder). 

with draft-eronen-ipsec-ikev2-eap-auth-03.txt the auth payload of
message 4 is delayed to a later message (see section 3 of
draft-eronen-ipsec-ikev2-eap-auth-03.txt). 

ciao
hannes

> 
> Thanks,
> Satoshi Inoue
> 
> _______________________________________________
> Ipsec mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ipsec
> 

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Satoshi Inoue <[email-masked]>
Date: Tue, 23 Aug 2005 19:52:46 +0900

Hi Hannes,

Thanks for your response.

On Tue, 23 Aug 2005 10:33:33 +0200

> what do you mean by valid? 

I wanted to know whether it's gonna be a proposed standard or not.
Or at least, whether it's well confirmed/clarified by the list. The
value for this notify type is not assigned yet, that's another
worry for me.

> assumed to know the certificate (based on the identity of the

Okay. Let me focus on EAP w/o using certificates. If
EAP_ONLY_AUTHENTICATION is considered as a proposed standard (or
well confirmed/clarified), shouldn't the message 4 of AUTH payload
be optional in IKEv2-17 too?

Another thing, isn't it possible to include this notify payload in
IKEv2-17, or at least, in clarification document? I do not want to
see too many separated RFC/I-Ds for IKEv2, like it was in IKEv1.

> draft-eronen-ipsec-ikev2-eap-auth-03.txt). 

AUTH payload of message 4 is omitted, not delayed. AUTH payload of
message 7 and 8 is derived from EAP generated key, right?

Thanks,
Satoshi Inoue