Subject: [IPsec] password auth methods debate

From: Stephen Kent <[email-masked]>
Date: Wed, 2 Dec 2009 18:44:29 -0500

Folks,

I think there is merit to pursing both the EAP-based and the 
SPSK-based password authentication proposals as WG items.  My 
rationale is:

	- EAP-based methods are well-suited to client-server 
interactions and to enterprise environments that already use 
RADIUS/DIAMATER. Unfortunately, these methods seem ill-suited to peer 
communications, and IPsec is a peer communication architecture, so 
having only these methods available for password-based auth seems 
inappropriate.  Also, Dan has indicated that there are IP clams 
associated with the specific methods that have been cited, which 
makes me leery of relying too heavily in them.

	- a generic password-based scheme seems desirable for peer 
(cs. client-server) contexts, and if such schemes are IP-free, so 
much the better. However, enterprise use of IPsec is primarily for 
road warriors, and thus is a client-server context, and there is a 
strong preference for a RADIUS/DIAMATER compatibility in this context.

So, i see a benefit in this WG pursuing both work items.

Steve