Subject: Re: [Emu] Question on EAP-IKEv2

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 04 May 2008 18:55:57 +0300

That's one reason.

The other one is to be able to have a strong password based mechanism.
When you reverse the roles of client and server then you allow the 
server to be authenticated first before you present your "password".

Finally, reversing the roles allows you to offer active user identity 
confidentiality.

Ciao
Hannes

Ali Fessi wrote:
> Hi,
>
> I wonder why the IKEv2 exchange in EAP-IKEv2 is initiated by the server.
>
> (See, RFC 5106, Page 7, Figure 1, message 3)
>
> Is the reason to save two messages, for example, compared to EAP-TLS?
>
> Best,
>   Ali
>
> _______________________________________________
> Emu mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/emu
>   

_______________________________________________
Emu mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/emu

---

From: "Gene Chang (genchang)" <[email-masked]>
Date: Mon, 5 May 2008 08:55:17 -0400

Hannes,
It was my understanding that authenticating the server first is an
essential behavior to prevent disclosing the user identity to an
imposter. This behavior is also part of EAP-FAST and EAP-TTLS.

Gene

------------------------------------------------------------------------
----
Eugene Chang (genchang)
Cisco Systems
Office:   603-559-2978
Mobile:  781-799-0233
Skype:  gene02421

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Hannes Tschofenig
> Sent: Sunday, May 04, 2008 11:56 AM
> To: Ali Fessi
> Cc: [email-masked]
> Subject: Re: [Emu] Question on EAP-IKEv2
> 
> That's one reason.
>