Subject: [Ipsec] certificate payloads/requests in IKEv2

From: "Michael Richardson" <[email-masked]>
Date: Mon, 26 Sep 2005 00:05:12 -0400

-----BEGIN PGP SIGNED MESSAGE-----

Is it permissible to send a certificate payload or certificate request
when the authentication method is PSK?

It is forbidden?

I don't ask for any reason. I just changed some code in IKEv1 to log
the reason for not sending a certificate as being because, we are using
PSK.  

- -- 
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 26 Sep 2005 13:13:51 +0300

> when the authentication method is PSK?

It is allowed both in IKEv1 and IKEv2. In IKEv1 certifiate and
certificate request payloads are allowed in any packet, as long as
they do not extend the basic exchange (i.e. certificate request cannot
be in the last message sent by the responder, as initiator cannot
answer to it).

In the IKEv2 you do not even know what method the other end is going
to use to authenticate himself, so you can include certificate
requests there. The certificate payload says you SHOULD be included in
an exchange if certificates are available to the sender...

> It is forbidden?

I do not think so. 

> the reason for not sending a certificate as being because, we are using

Not sending them when you have only PSK configured to the other end is
probably preferred, as it makes the packets smaller (i.e. no
fragmentation). 
-- 
[email-masked]