Subject: Re: [Nea] Pros and cons of EAP and TLVs for L2 PT

From: Andreas Steffen <[email-masked]>
Date: Thu, 14 Jul 2011 21:38:45 +0200

Hello,

for the strongSwan project we implemented TCG EAP-TNC as an inner
protocol, embedded into EAP-TTLS AVPs to transport PB-TNC batches
over an IKEv2 EAP communications channel. The advantage of using an
inner EAP protocol for PT in an IKEv2 context is that within the outer
TLS tunnel the initial EAP-Identity exchange, an ensuing EAP-based
client authentication (e.g. EAP-MD5 or EAP-MSCHAPv2) and finally
EAP-PT can be handled in a consistent way.

If a TLV representation would be used for the PT protocol, then a
differentiation between EAP and TLV packets would have to be made
which reminds somehow me of the chaos Microsoft created with their
mixture of EAP and TLV packets in MS-PEAP.

I would welcome a TLV PT protocol, though, if it would be possible
to have the same PT standard format for both L2/L3 tunneled EAP
and L4 TLS, so that only a single implementation would be required.

Best regards

Andreas

======================================================================
Andreas Steffen                         [email-masked]
strongSwan - the Linux VPN Solution!                www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==