Subject: [Ipsec] IKEv2 and EAP-SIM

From: vamsi <[email-masked]>
Date: Tue, 01 Jun 2004 14:42:53 -0700

Hi All,

In section 2.16 of IKEv2 draft states that, when EAP is used, initiator MUST
     authenticate the server using public key signatures. Some EAP methods 
provide
     mutual authentication. Should n't  this requirement be relaxed to 
support EAP methods
     such as EAP-SIM?  I would prefer the statement such as, if EAP method 
does not
     support mutual authentication, then the initiator MUST authenticate 
the responder
     using public key signatures.

Thanks
Vamsi
CTO Office
Intoto Inc.
www.intoto.com

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Wed, 2 Jun 2004 10:04:23 +0300

See this draft:

http://www.ietf.org/internet-drafts/draft-eronen-ipsec-ikev2-eap-auth 
-01.txt   "Extension for EAP Authentication in IKEv2"

On Jun 2, 2004, at 12:42 AM, vamsi wrote:

>     authenticate the server using public key signatures. Some EAP  
> methods provide
>     such as EAP-SIM?  I would prefer the statement such as, if EAP  
> method does not
>     support mutual authentication, then the initiator MUST  
> authenticate the responder

---

From: Yoav Nir <[email-masked]>
Date: Wed, 2 Jun 2004 10:04:23 +0300

See this draft:

---

From: Uri Blumenthal <[email-masked]>
Date: Wed, 02 Jun 2004 12:33:19 -0400

On 6/1/2004 17:42, vamsi wrote:
> provide mutual authentication. Should not  this requirement be relaxed to 
> support EAP methods such as EAP-SIM? 

It is an open question whether EAP-SIM offers a reliable mutual authentication.
Thus I'd be against relaxing this requirement for a method such as EAP-SIM.

> I would prefer the statement such as, if EAP method does not
> the responder using public key signatures.

In general, I'm ambivalent on this. But since not EAP methods offer equal
strength, perhaps it's best to leave as is...

---

From: "M.Chenna kesava Reddy" <[email-masked]>
Date: Mon, 07 Jun 2004 17:46:29 +0530

Hi All,
In section 4.1 it says that IPsec implementation must permit 
establishment and maintanance of
multiple SA's between a given sender and receiver,with the same 
selectors, it means to say that, do
we need to create the SA's according to the flow and class of service as 
adding one parameter in the
 SA whitch indicates class of service and will be searched for SA for an 
inbound packet.
How can it be locally determined, is it QOS will be done first on the 
IKE packets or any other
mechanism will be avilable to do this.

Thx
mcreddy

---

From: "M.Chenna kesava Reddy" <[email-masked]>
Date: Mon, 07 Jun 2004 17:46:29 +0530

Hi All,

Thx
mcreddy

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 07 Jun 2004 12:08:01 -0400

> establishment and maintanance of multiple SA's between a given
> sender and receiver,with the same selectors, it means to say that,
> do we need to create the SA's according to the flow and class of
> service as adding one parameter in the SA whitch indicates class of
> service and will be searched for SA for an inbound packet.  

if you read further, you'll see that qos markings generated before
IPsec is applies are used as a pseudo-selector and get passed through
to the encrypted packet.

qos is used to select/generate multiple SA's during outbound
processing, but is ignored for ipsec purposes for inbound processing.

so it's purely a local matter for the sender.

						- Bill

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 07 Jun 2004 12:08:01 -0400

- Bill