Subject: EAP Handling in IKEv2

From: "Hannes Tschofenig" <[email-masked]>
Date: Thu, 1 May 2003 14:32:10 +0200

Dear all,

in Section 2.16 you mention the mechanism for protecting against
man-in-the-middle attacks:

" For EAP methods that create a shared key as a side effect of

authentication, that shared key MUST be used by both the Initiator

and Responder to generate an AUTH payload using the syntax for shared

secrets specified in section 2.15. This shared key MUST NOT be used

for any other purpose.

"

This covers the case where the EAP method establishes a session key.

Which procedure do you suggest for cases where EAP methods do not create a
session key such as the One-Time Password (OTP)?

Ciao

Hannes

---

From: [email-masked]
Date: Sat, 10 May 2003 18:23:34 -0400

"Hannes Tschofenig" <[email-masked]> wrote:
>for any other purpose."

For EAP methods that don't generate session keys, the AUTH payloads are
not sent. I'll make that clearer in the spec.

      --Charlie