Subject: [Ipsec] Reauthentication in IKEv2

From: Jyothi <[email-masked]>
Date: Thu, 28 Oct 2004 09:35:47 +0530

Hi all,

I have some questions regarding the Reauthentication in IKEv2.

1. CREATE_CHILD_SA exchange is supported.

In this when the IKE SA lifetime is completed, we use CREATE_CHILD_SA 
exchange and form new IKE SA keys.

Is it required to reauthenticate the peer may be after some time???

If reauthentication is required, in case of EAP authentication, it says 
that CLIENT may use the EAP Fast reauthentication ID in IKE exchange.

In this case IKE policy lookup may fail, if we are searching with the 
received identity.

If reauthentication is required, what is the best way to proceed??

May be the responder has to maintain some mapping between policy identity 
and EAP negotiated identity.

2. CREATE_CHILD_SA exchange is not supported

In this case, peer will always authenticate.

If EAP authentication is used, do we have to go for EAP re-authentication???

Awaiting your responses.

Thanks in advance,
Jyothi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Thu, 28 Oct 2004 10:51:12 +0200

Hi Jyothi.

As others have said, in IKEv2 there is only re-keying, no 
re-authentication.  If you want the client to re-authenticate, than the 
client needs to re-do the initial exchange.  The gateway cannot be the 
initiator, especially in the case of EAP.

The missing piece is a way for the gateway to inform the client that 
the client needs to re-authenticate.  I think this draft solves this 
issue, but when I first published it, there was little interest in the 
WG.  I guess not many see gateway-controlled (or periodic) 
re-authentication as important.  If you feel differently, please let me 
know.

http://www.ietf.org/internet-drafts/draft-nir-ikev2-auth-lt-00.txt

Yoav

On Oct 28, 2004, at 6:05 AM, Jyothi wrote:

> If reauthentication is required, in case of EAP authentication, it 
> says that CLIENT may use the EAP Fast reauthentication ID in IKE 
> exchange.
>
> May be the responder has to maintain some mapping between policy 
> identity and EAP negotiated identity.
>

---

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Fri, 29 Oct 2004 12:20:18 -0700

Hi all,

> I would suggest to leave the initiation of re-authentication to external
entity (outside IKE).

-- Yes That is right.

received identity.

>I would assume that EAP methods, following NAI format for IDs would have
same 'realm' name for permanent and fast re-authentication identities.
'realm' can be used to select the responder IKE policy. At the configuration
time, Initiators (Clients) should have prior knowledge that the responder
identifies the IKE policy based on partial information. Only then, it should
honor EAP client to overwrite IDi value.  If the responder identifies the
IKE policy on full information, Initiator should always use the same
Identification always. In this case, there is a possibility of full
re-authentication by EAP. But, in general, I would assume that, EAP is used
in remote access scenarios and 'realm' specific policy search would be used.

 

Awaiting your responses.

Thanks in advance,

Jyothi

Ipsec mailing list

[email-masked]