Subject: [eap] comments on draft-tschofenig-eap-ikev2-01.txt

From: [email-masked] (Bernard Aboba)
Date: Fri, 4 Jul 2003 07:17:12 -0700 (PDT)

Introduction

Typically an introduction provides an overview of the problem, the general
approach taken to solving it and the reasoning behind selection of the
solution approach.

Reading this draft, I am unsure whether the objective is to create a
single EAP method utilizing basic IKEv2 modes (certificate, pre-shared
key) or whether the goal is to create another tunneling method. Can you
clarify?

Page 4, Message exchange:

When is the EAP Identity exchange necessary/useful in EAP IKEv2?  IKEv2
supports its own (protected) identity exchanges, and the method also
allows nested EAP Identity exchanges.  So you've got a lot of
different (and potentially conflicting) identity information available.

Assuming that asymmetric IKEv2 features aren't used, can the EAP server
play the role of IKEv2 Initiator? This would save a round-trip, no?

Page 6

"   Since the goal of this EAP method is not to establish an IPsec SA
   some payloads used in IKEv2 are omitted. In particularly the
   following messages and payloads are not required:

   - Traffic Selectors
   - IPsec SA negotiation payloads
     (e.g. CREATE_CHILD_SA exchange or SAx2 payloads)
   - ECN Notification
   - Port handling
   - NAT traversal"

Yes, EAP IKEv2 need only carry out IKE SA creation. However, a secure association
does need to be subsequently negotiated. So there is the question of how
the IKE SA is subsequently bound to the (non-IPsec) Phase 2 SA.  Any
thoughts on that?

Since address management is now supported within IKEv2, is the intent to
allow IP address assignment within EAP?

Section 6

How is KEYMAT used to generate the MSK and EMSK?

Section 8

Does EAP IKEv2 utilize Notifications? If not, that should be stated
explicitly.

It would be useful to have a discussion of error handling.  When does the
method terminate with an EAP-IKEv2 method-specific error message? Can an
EAP Failure always be silently discarded prior to method completion?

If the standard means of calculating IKEv2 MACs is used, then the fields
of the EAP header will not be covered.  Are there any security
implications of this?