Subject: Re: [IPsec] Reauthentication extension for IKEv2

From: David Wierbowski <[email-masked]>
Date: Tue, 16 Sep 2008 10:09:10 -0400

>> What do you think about such an extension? Already considered something
>> similar, or does your reauthentication procedure work hassle-free? I'm
>> wondering if we are the only ones facing these problems or if such an
>> extension would gain broader acceptance...
>
>The first question I have is why are you doing reauthentication at
>all?
>
>What is the benefits of the reauthentication?
>
>What is the benefits of the reauthentication that can be done WITHOUT
>user intervention (i.e. no user typing in password or pin code or
>fingerprint or similar)?
>
>I myself can only really see benefits from reauthentication when it
>does require that user is really sitting there on the machine, and
>gives something that the machine itself cannot give. In those cases
>the user is required to type in something or do something anyways,
>thus it does not really matter if the communications is interrupted
>for second if user must stop his work for much longer time to type in
>his passphrase or pin code.
>
>The RFC 4478 simply skips this question and says "With some IPsec
>peers, particularly in the remote access scenario, it is desirable to
>repeat the mutual authentication periodically. The purpose of this is
>to limit the time that security associations (SAs) can be used by a
>third party who has gained control of the IPsec peer."
>
RCF 4718 States:
   While rekeying the IKE_SA may be important in some environments,
   reauthentication (the verification that the parties still have access
   to the long-term credentials) is often more important.

Bottom line is that some implementers believe reauthentication
makes sense.  Given that it seems as if Martin's request for an
extension is reasonable.  As I pointed out in  the past there is
no way to detect the simultaneous reauthentication of an IKE_SA.
Such an extension would solve that issue.

>In most cases if third party has gained control of the IPsec peer he
>will also get control of all authentication information inside the
>peer, including private keys and pre shared keys. Only way to make
>sure that he does not get access to those is to protect them with
>passphrase, or pin code or similar that is only known by the user.
>
>This is also said out in the RFC 4478: "However, in the remote access
>scenario it is usually up to a human user to supply the
>authentication credentials ..."
>
>Because of this I do not think there is that much requirement for
>reauthentication protocol that is faster than what we already have.

Dave Wierbowski

z/OS Comm Server Developer

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec