Subject: [Ipsec] CHILD SA payloads in AUTH exchange request.

From: Jyothi <[email-masked]>
Date: Tue, 19 Oct 2004 13:02:47 +0530

Hi all,

When EAP authentication is used,

Instead of sending CHILD SA payload, CP request  and Traffic selector 
payloads in first AUTH request message, why cant we send those along with 
EAP AUTH request payload???

So that we can avoid sending the CHILD SA information in EAP-AUTH failure.

IKE messages will be as follows:

        Initiator                          Responder
       -----------                        -----------
        HDR, SAi1, KEi, Ni         -->

                                   <--    HDR, SAr1, KEr, Nr, [CERTREQ]

        HDR, SK {IDi, [CERTREQ,] [IDr,]
                 }   -->

                                   <--    HDR, SK {IDr, [CERT,] AUTH,
                                                 EAP }

        HDR, SK {EAP}              -->

                                   <--    HDR, SK {EAP (success)}

        HDR, SK {AUTH, CP(CFG_REQUEST), SAi2, TSi, TSr}  -->

                         <--    HDR, SK {AUTH, CP(CFG_REPLY) SAr2, TSi, TSr }

Awaiting your valuable replies.

Thanks
Jyothi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Tue, 19 Oct 2004 11:33:29 +0200

I guess the historical reason is that originally the Child SA response 
(SAr2, CFG_REPLY, Traffic selectors) was supposed to be sent along with 
the EAP success.  This changed relatively recently.

I don't think it makes much difference in the real world, because EAP 
is typically for authenticating clients.  The SAi2 is not much secret, 
the CFG_REQUEST is usually just a request, and the traffic selectors 
are (myaddress)-(0.0.0.0-255.255.255.255) so there's not much secret 
information there.

I agree that this is a security concern, but not enough so that we need 
to change the protocol at this stage.

On Oct 19, 2004, at 9:32 AM, Jyothi wrote:

> payloads in first AUTH request message, why cant we send those along 
> with EAP AUTH request payload???
>
>  Jyothi_______________________________________________
> Ipsec mailing list
> [email-masked]