Subject: [IPsec] IKEv2: Authentication Data

From: "Matthew Cini Sarreo" <[email-masked]>
Date: Thu, 27 Nov 2008 08:18:23 +0100

Hi,

First of all, excuse my inexperience, IKEv2 is my first project of this
kind.

RFC 4306, section 2.15 describes how the Authentication Data field in the
Authentication Payload is constructed (or, in other words, how the data in
the Authentication Data field is created).

There are two scenarios in the section: " When not using extensible
authentication (see section
2.16<http://www.potaroo.net/ietf/idref/rfc4306/#section-2.16>),
the peers are authenticated by having each sign (or MAC using a shared
secret as the key) a block of data". The first scenario is using prf(SK_p(i
or r), ID(i or r)') and the second one being AUTH = prf(prf(Shared
Secret,"Key Pad for IKEv2"), <msg octets>). Does this mean that when using
certificate based authentication, the first scenario is carried out, but
when not (i.e just using a pre-shared key, which, maybe is entered by a user
in some configuration data or is communicated by other means) the second
scenario is used? Also, in this second scenario, it is not clear to me what
<msg octets> is. Is it the concatenation of data as described at the
beginning of section 2.15?

Thanks & Regards,
Matt
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Thu, 27 Nov 2008 10:48:19 +0200

Hi Matthew.

You may want to read the revised document we are writing ( http://tools.ietf.org/html/draft-ietf-ipsecme-ikev2bis 
  ). Section 2.15 there has a some clarifications on these issues.  We  
would appreciate your input about how this can be made even better,  
because this is a work-in-progress.

Regardless, here are some answers to your questions.
The message octets are the same regardless of signing method. They are  
described in the first paragraph of 2.15 ("For the responder...") That  
part is definitely better in the new document.

As for the signing method, there are really three cases:
	• Using shared keys: then it's AUTH = prf(prf(Shared Secret,"Key Pad  
for IKEv2"), <msg octets>)
	• Using certificates: then it's a regular public key signature.
	• Using extensible authentication (EAP): then in message #4, the  
gateway signs with the private key, and in the last pair of messages,  
both parties sign using the EAP MSK value similar to the way shared  
keys are used (this is specified in 2.16)

Hope this helps

Yoav

On Nov 27, 2008, at 9:18 AM, Matthew Cini Sarreo wrote:

> Hi,
>
> First of all, excuse my inexperience, IKEv2 is my first project of  
> this kind.
>
> RFC 4306, section 2.15 describes how the Authentication Data field  
> in the Authentication Payload is constructed (or, in other words,  
> how the data in the Authentication Data field is created).
>
> authentication (see section 2.16), the peers are authenticated by  
> having each sign (or MAC using a shared secret as the key) a block  
> of data". The first scenario is using prf(SK_p(i or r), ID(i or r)')  
> and the second one being AUTH = prf(prf(Shared Secret,"Key Pad for  
> IKEv2"), <msg octets>). Does this mean that when using certificate  
> based authentication, the first scenario is carried out, but when  
> not (i.e just using a pre-shared key, which, maybe is entered by a  
> user in some configuration data or is communicated by other means)  
> the second scenario is used? Also, in this second scenario, it is  
> not clear to me what <msg octets> is. Is it the concatenation of  
> data as described at the beginning of section 2.15?
>
> Thanks & Regards,
> Matt

Email secured by Check Point
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec