Subject: RE: EAP Roundtrips (was: Temporary version of the new IKEv2 draft)

From: "Charlie Kaufman" <[email-masked]>
Date: Wed, 24 Mar 2004 10:23:23 -0800

I made the revisions to IKEv2-13 over the weekend without having seen
the discussion of EAP roundtrips on the mailing list Friday. The change
reflects the instructions I got from Ted on 3/16.

I am happy to change it again if that is the working group consensus,
but I'll mention the argument on the other side.

While minimizing round trips has been a priority in designing IKEv2,
minimizing protocol variations has also been a priority. By allowing the
initiator to put the AUTH payload in either of two messages, the
responder is required to accept it in either message. While this does
not substantially complicate an implementation based on a state machine,
it does complicate testing in that both protocol variants would have to
be tested. It was this sort of argument that prevented us from having an
"optional" additional exchange for EAP to prompt for identity (which
arguably offers security advantages in some scenarios).

So if we're going to do this, I want Ted and Barbara to officially
declare consensus. And I guess that means if there are objections,
people should express them now. If that looks like the direction, I'll
post proposed language to the list before doing another revision.

And I hope this can all go on in parallel with IETF last call.

	--Charlie

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Yoav Nir
Sent: Wednesday, March 24, 2004 7:42 AM
To: [email-masked]; Paul Hoffman / VPNC
Subject: EAP Roundtrips (was: Temporary version of the new IKEv2 draft)

Again, regarding section 2.16, I believe it should say, that the 
Initiator MAY send the AUTH payload before the EAP-success message, in 
which case the Responder SHOULD send the AUTH, SAr2, TSi, TSr along 
with the EAP-success.  In this case, the initial SA establishment will 
be shortened to 6 messages.

---

From: Jari Arkko <[email-masked]>
Date: Wed, 24 Mar 2004 22:19:10 +0200

> post proposed language to the list before doing another revision.

Sounds like a good plan. We are by the way still discussing
the issue in the EAP WG list and off-list... We'd really like
to reach a conclusion in the discussion before the IPsec WG
decides what to do. In other words: there's an opinion on the
matter, not expressed yet but coming soon so please wait for
that ;-)

--Jari

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 25 Mar 2004 15:40:44 +0200

> While minimizing round trips has been a priority in designing IKEv2,

If we use EAP, there is quite often user interaction required anyways,
thus saving one round trip after we have asked the password etc from
the user, doesn't have that big effect.

> minimizing protocol variations has also been a priority. By allowing the

I think minimizing protocol variations is more important here, than
one extra round trip when doing EAP. 
-- 
[email-masked]