Subject: Clarification of EAP authentication in IKEv2?

From: [email-masked]
Date: Thu, 18 Dec 2003 11:14:58 +0200

(I'm sending this again, since for some reason my 
post on Tuesday didn't come through.)

Hi,

IKEv2-11, Section 2.16 says:

   In addition to authentication using public key signatures and
   shared secrets, IKE supports authentication using methods
   defined in RFC 2284 [EAP]. Typically, these methods are
   asymmetric (designed for a user authenticating to a server),
   and they may not be mutual. For this reason, these protocols
   are typically used to authenticate the initiator to the
   responder and are used in addition to a public key signature
   based authentication of the responder to the initiator.

Recently, some people have interpreted the last sentence as
"public key signature based authentication of the responder 
MUST be used".

Another possible interpretation is that _typically_ the responder 
is authenticated with public key signatures (for the reasons 
given earlier in the paragraph), but other alternatives (such 
as EAP method that provides mutual authentication, or even 
shared secret) may be possible in some circumstances.

Any comments?

Personally, I support the latter interpretation; since otherwise
only initiator authentication is extensible, not responder 
(and I think this would be an unnecessary limitation... after all,
if the point of EAP is to allow users to choose an authentication 
method that best suits their needs, why should this be limited 
to initiator authentication?). 

This could be perhaps clarified by adding the following 
paragraph below the sequence diagram:

   If the authentication of the responder is based solely on a
   mutually authenticating EAP method, the responder omits the
   AUTH payload from message 4. Alternatively, the responder 
   can be authenticated using either public key signatures or 
   a shared secret, in which case the AUTH payload in message 4 
   is calculated as described in Section 2.15.

Best regards,
Pasi

---

From: Michael Richardson <[email-masked]>
Date: Fri, 19 Dec 2003 11:03:45 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Pasi" == Pasi Eronen <[email-masked]> writes:
    Pasi> Recently, some people have interpreted the last sentence as "public
    Pasi> key signature based authentication of the responder MUST be used".

    Pasi> Another possible interpretation is that _typically_ the responder
    Pasi> is authenticated with public key signatures (for the reasons given
    Pasi> earlier in the paragraph), but other alternatives (such as EAP
    Pasi> method that provides mutual authentication, or even shared secret)
    Pasi> may be possible in some circumstances.

  An EAP method that provided mutual authentication would authenticate the
EAP authenticator, not the IKEv2 responder. 

  I do not think that we provided EAP<->IKEv2 channel bindings.

    Pasi> Personally, I support the latter interpretation; since otherwise
    Pasi> only initiator authentication is extensible, not responder (and I
  
  That's what most people want.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

---

From: Jari Arkko <[email-masked]>
Date: Fri, 19 Dec 2003 22:17:41 +0200

(resent, some of my e-mails do not make it to the list.)

> Personally, I support the latter interpretation; since otherwise

I agree.

>    is calculated as described in Section 2.15.

This text looks good to me.

--Jari

---

From: Jari Arkko <[email-masked]>
Date: Fri, 19 Dec 2003 20:27:08 +0200

I agree.

--Jari

---

From: Jari Arkko <[email-masked]>
Date: Thu, 18 Dec 2003 14:26:48 +0200

I agree.

--Jari