Subject: [IPsec] EAP Mutual Auth and IKE session resumption

From: Yaron Sheffer <[email-masked]>
Date: Mon, 21 Jun 2010 19:31:22 +0300

Hi,

EAP-Mutual has just gone through IESG review, but I'd like to make one 
more addition and would appreciate the group's feedback.

The interaction between this draft 
(https://datatracker.ietf.org/doc/draft-ietf-ipsecme-eap-mutual/) and 
session resumption (RFC 5723 <http://tools.ietf.org/html/rfc5723>) is 
simple, but I think should still be pointed out. So I was thinking of 
adding this text at the end of Sec. 3:

    An IKE SA that was set up with this extension can be resumed using 
the mechanism described
    in <xref target="RFC5723"/>. However session resumption does not 
change the authentication
    method. Therefore during the IKE_AUTH exchange of the resumed
    session, this extension MUST NOT be sent by the initiator.

All comments welcome.

Thanks,
     Yaron

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 21 Jun 2010 10:49:13 -0700

At 7:31 PM +0300 6/21/10, Yaron Sheffer wrote:
>Hi,
>
>
>EAP-Mutual has just gone through IESG review, but I'd like to make one more addition and would appreciate the group's feedback.
>
>
>The interaction between this draft (https://datatracker.ietf.org/doc/draft-ietf-ipsecme-eap-mutual/) and session resumption (RFC 5723 <http://tools.ietf.org/html/rfc5723>) is simple, but I think should still be pointed out. So I was thinking of adding this text at the end of Sec. 3:
>
>
>   An IKE SA that was set up with this extension can be resumed using the mechanism described
>   in <xref target="RFC5723"/>. However session resumption does not change the authentication

Please respond before Friday so that we move this document forwards. Yaron's other proposed changes to the draft are simple clarifications to clear IESG concerns.

--Paul Hoffman, Director
--VPN Consortium