Subject: Re: [HOKEY] [IPsec] IKEv2 and ERP

From: Yoav Nir <[email-masked]>
Date: Sat, 19 Nov 2011 14:07:01 +0200

On Aug 6, 2011, at 10:37 PM, Yoav Nir wrote:

> Hi
> 
> At the meeting in Quebec, I gave a presentation at the hokey meeting about http://tools.ietf.org/html/draft-nir-ipsecme-erx .
> 
> The draft covers using the EAP extensions for re-authentication in IKEv2. The obvious (to me) use-case is a phone connected to a 802.1x network. As you leave the building, the same phone automatically using IKEv2 over a 3G network without the user authenticating, by using the handed-over keys from 802.1x.
> 
> ERP (RFC 5296) works in two cases:
> 1. when the new AAA backend and the old AAA backend are the same, and
> 2. when they are different - you connect to a local EAP server
> 
> There is an open question here. Obviously, when you use EAP for 802.1x or PPP or some other network access, you often connect to a local Authenticator that is not the same as your "home network". But is this relevant in IKEv2?  IKEv2 is used over the Internet. Why would you ever want to connect to a server other than your home (or a server that relies on the same AAA backend)
> 
> In other words: is there a use-case for connecting to a local rather than a home server in IKE, a use-case that uses EAP.
> 
> My feeling is that the answer is no, and there were some phone operators in the room who agreed with me. Someone did bring up the case of host-to-host IPsec, but I don't think that ever uses EAP.
> 
> Does anybody have different thoughts about this?

(crickets)

As there were no replies to this email, and as there was pretty much an uncalled consensus at the HOKEY meeting, I have submitted version -02 of the draft with an extra paragraph in section 3.2 to explain that "roaming to a different EAP server" scenario is probably not relevant.

http://www.ietf.org/internet-drafts/draft-nir-ipsecme-erx-02

I would be happy for this to become a working group item, but if not, I would like to take it to our ADs (not sure which one, as this involves both IPsecME and HOKEY). I would also appreciate any suggestions for the Security Considerations section, other than just moving the rest of section 3.2 into it.

Yoav

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 20 Nov 2011 09:42:42 +0200

Hi Yoav,

motivation for this work seems to have come from 3GPP/3GPP2/WiMAX,
and I strongly suggest that you or your coauthor go back to the
originating organization to validate your use case(s).

I find the new paragraph (top of Sec. 3.2) confusing: I would expect
the IKE negotiation to go to a local network (in the "visited
network") with this gateway being supported by a "home" EAP server.
EAP requests are commonly routed back into the home network. In a
telco network, this backend EAP connectivity most likely would *not*
be over the open Internet.

Lastly, judging by the level of interest so far, I do not see this
draft becoming an ipsecme WG charter item. I do not have any problem
with its being published elsewhere.

Thanks,

Yaron

On 11/19/2011 02:07 PM, Yoav Nir wrote:

Hi

(crickets)

Yoav
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Sun, 20 Nov 2011 10:01:30 +0200

Hi Yaron

Actually the motivation in my case is a smooth transition from a 802.1x local network, to remote access VPN on a 3GPP/WiMax public network and back, and this is a very enterprise network sort of thing. At the HOKEY meeting in QC there were some Telco people, and they didn't seem to think there was another use case.

I do remember the use case of doing IKE with EAP-SIM or EAP-AKA, but IIRC that was also the phone connecting to its home network over the Internet.

Qin: are you aware of cases where IKE is used with anything other than the home network?

Yoav

On Nov 20, 2011, at 9:42 AM, Yaron Sheffer wrote:

Hi Yoav,

motivation for this work seems to have come from 3GPP/3GPP2/WiMAX, and I strongly suggest that you or your coauthor go back to the originating organization to validate your use case(s).

I find the new paragraph (top of Sec. 3.2) confusing: I would expect the IKE negotiation to go to a local network (in the "visited network") with this gateway being supported by a "home" EAP server. EAP requests are commonly routed back into the home network. In a telco network, this backend EAP connectivity most likely would *not* be over the open Internet.

Lastly, judging by the level of interest so far, I do not see this draft becoming an ipsecme WG charter item. I do not have any problem with its being published elsewhere.

Thanks,
    Yaron

Hi

(crickets)

Yoav
_______________________________________________
IPsec mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Tina TSOU <[email-masked]>
Date: Sun, 20 Nov 2011 08:50:22 +0000

Yoav,
I assume the similar use case for enterprise.

Sent from my iPad

On Nov 20, 2011, at 4:02 PM, "Yoav Nir" <[email-masked]<mailto:[email-masked]>> wrote:

Hi Yaron

Yoav

Hi Yoav,

Thanks,
    Yaron

Hi

At the meeting in Quebec, I gave a presentation at the hokey meeting about <http://tools.ietf.org/html/draft-nir-ipsecme-erx> http://tools.ietf.org/html/draft-nir-ipsecme-erx .

(crickets)

<http://www.ietf.org/internet-drafts/draft-nir-ipsecme-erx-02>http://www.ietf.org/internet-drafts/draft-nir-ipsecme-erx-02

Yoav
_______________________________________________
IPsec mailing list
<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>
<https://www.ietf.org/mailman/listinfo/ipsec>https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 20 Nov 2011 18:50:50 +0200

I read the draft once again and I'm a bit more confused than before... 
Here are a few comments:

• The document should clarify what "ERX" means and how ERX relates to ERP.
• The first message of the protocol sequence in Sec. 3 ends with a 
comma. Is it missing a notification?
• "EAP_Initiate/Re-auth message replaces the IDi payload": Omitting IDi 
may or may not be the right decision (it modifies RFC 5996!), but in any 
case a rationale is needed. In order to not break IKEv2, the protocol 
could mandate that the same ID should be used at both levels, i.e. that 
IDi should be identical to the EAP-level identity. I realize that this 
is not ideal.
• The first paragraph of 3.2 is confusing: most deployments would 
probably use a single EAP server *even if* they use multiple IKE/IPsec 
gateways. Hence the last sentence of the paragraph should be dropped.
• More importantly: the issue of identifying the client (e.g. for the 
gateway to generate useful audit records) is important even for the 
"pure enterprise" use case of roaming from 802.11 to IPsec. 
Unfortunately the protocol is incomplete until/unless any of the methods 
defined in this section (e.g. transmitting the client's authorization 
group) is standardized. This is probably just a question of picking the 
right RADIUS TLV. Maybe just need to say that the Class attribute MUST 
be used. In other words, in the absence of IDi the gateway cannot make 
policy decisions even if only a single gateway is used!
• Sec. 4: how is the realm encoded? I think the correct answer is 
"ASCII, with no null termination".

Thanks,
Yaron

On 11/20/2011 10:01 AM, Yoav Nir wrote:
> Hi Yaron
>
> Actually the motivation in my case is a smooth transition from a 
> 802.1x local network, to remote access VPN on a 3GPP/WiMax public 
> network and back, and this is a very enterprise network sort of thing. 
> At the HOKEY meeting in QC there were some Telco people, and they 
> didn't seem to think there was another use case.
>
> I do remember the use case of doing IKE with EAP-SIM or EAP-AKA, but 
> IIRC that was also the phone connecting to its home network over the 
> Internet.
>
>>>> At the meeting in Quebec, I gave a presentation at the hokey meeting abouthttp://tools.ietf.org/html/draft-nir-ipsecme-erx  .
>>>>

---

From: Qin Wu <[email-masked]>
Date: Tue, 22 Nov 2011 16:06:41 +0800

Hi,Yoav:
yes,I am do aware of other cases where IKE is used beyond the home network. 
Here are two example use cases adopted by 3GPP.Thes two use cases only work for roaming scenario.

In both use cases,IKE negotiation happens between WLAN UE and Packet Data Gateway(PDG) or Tunnel
Termination Gateway (TTG). Both PDG and TTG are deployed in 3GPP visited Network.

Also we have two cases where IKE is used with the home network belows. Both PDG and TTG are deployed
in the 3GPP home netwrok. These two cases only work for non-roaming scenario.

Regards!
-Qin
  ----- Original Message -----  
  From: Yoav Nir 
  To: Yaron Sheffer ; Qin Wu 
  Cc: IPsecme WG ; [email-masked] 
  Sent: Sunday, November 20, 2011 4:01 PM
  Subject: Re: [IPsec] IKEv2 and ERP

  Hi Yaron

  Yoav

    Hi Yoav,

    Thanks,
        Yaron

Hi

Yoav

---

From: Yoav Nir <[email-masked]>
Date: Wed, 23 Nov 2011 10:03:56 +0200

Thanks, Qin

I wonder what the rationale is for this. Why would a phone that's already on the Internet connect to the visited network rather than the home network. Is that because of concerns about bandwidth and latency?

Anyway, is there a use case for ERP in those cases?

Yoav

________________________________
From: Qin Wu [mailto:[email-masked]]
Sent: 22 November 2011 10:07
To: Yoav Nir; Yaron Sheffer
Cc: IPsecme WG; [email-masked]
Subject: Re: [IPsec] IKEv2 and ERP

Hi,Yoav:

Regards!
-Qin
----- Original Message -----
From: Yoav Nir<mailto:[email-masked]>
To: Yaron Sheffer<mailto:[email-masked]> ; Qin Wu<mailto:[email-masked]>
Cc: IPsecme WG<mailto:[email-masked]> ; [email-masked]<mailto:[email-masked]>
Sent: Sunday, November 20, 2011 4:01 PM
Subject: Re: [IPsec] IKEv2 and ERP

Hi Yaron

Yoav

Hi Yoav,

Thanks,
    Yaron

Hi

(crickets)

Yoav

---

From: Yoav Nir <[email-masked]>
Date: Wed, 23 Nov 2011 10:07:31 +0200

[resending as plaintext]

Thanks, Qin

 
Yoav

Hi,Yoav:

 

 
Regards!
-Qin

---

From: Qin Wu <[email-masked]>
Date: Wed, 23 Nov 2011 18:02:23 +0800

Apparently neither of the four cases I gave you  describes the phone sits on the Internet.
In ERP, we allow two cases.
If there is no local ER server in the visited network, the peer should communicate directly 
with home ER server through ER capable authenticator.

However if there is a local ER server in the visited network, we allow the peer  initates normal 
EAP exchange with the home EAP server in the home network firstly. In the meanwhile the 
local ER server in the path between the peer and home EAP server ask for keying materials. 
In the subsequent procedure, the peer can communicate locally with the local ER server.

Regards!
-Qin
----- Original Message ----- 
From: "Yoav Nir" <[email-masked]>
To: "Yoav Nir" <[email-masked]>; "'Qin Wu'" <[email-masked]>; "'Yaron Sheffer'" <[email-masked]>
Cc: "'IPsecme WG'" <[email-masked]>; <[email-masked]>
Sent: Wednesday, November 23, 2011 4:07 PM
Subject: RE: [IPsec] IKEv2 and ERP

[resending as plaintext]

Thanks, Qin

 
Yoav

Hi,Yoav:

 

 
Regards!
-Qin