Subject: RE: [Ipsec] CHILD SA payloads in AUTH exchange request.

From: [email-masked]
Date: Tue, 19 Oct 2004 18:24:41 +0300

Having this information available during the EAP exchange
may also make it easier to use a RADIUS or Diameter AAA server 
for e.g. assigning IP addresses.

(BTW, these payloads are sent before the responder is
authenticated even when EAP is not used.)

Best regards,
Pasi

> -----Original Message-----
> From: Yoav Nir
> Sent: Tuesday, October 19, 2004 12:33 PM
> To: Jyothi
> Cc: [email-masked]
> Subject: Re: [Ipsec] CHILD SA payloads in AUTH exchange request.
> 
> 
> I guess the historical reason is that originally the Child SA 
> response (SAr2, CFG_REPLY, Traffic selectors) was supposed to 
> be sent along with the EAP success.  This changed relatively 
> recently.
> 
> I don't think it makes much difference in the real world, 
> because EAP is typically for authenticating clients. The SAi2 
> is not much secret, the CFG_REQUEST is usually just a request, 
> and the traffic selectors are (myaddress)-(0.0.0.0-255.255.255.255) 
> so there's not much secret information there.
> 
> I agree that this is a security concern, but not enough so 
> that we need to change the protocol at this stage.
> 
> On Oct 19, 2004, at 9:32 AM, Jyothi wrote:
> 
> >  Hi all,
> >
> >  When EAP authentication is used,
> >
> > Instead of sending CHILD SA payload, CP request and 
> > Traffic selector payloads in first AUTH request message, 
> > why cant we send those along with EAP AUTH request 
> > payload???
> >
> > So that we can avoid sending the CHILD SA information in 
> > EAP-AUTH failure.
> >
> >  IKE messages will be as follows:
> >
> >        Initiator                          Responder
> >        -----------                        -----------
> >         HDR, SAi1, KEi, Ni         -->
> >
> >                                    <--    HDR, SAr1, KEr, 
> Nr, [CERTREQ]
> >
> >         HDR, SK {IDi, [CERTREQ,] [IDr,]
> >                  }   -->
> >
> >                                    <--    HDR, SK {IDr, 
> [CERT,] AUTH,
> >                                                  EAP }
> >
> >         HDR, SK {EAP}              -->
> >
> >                                    <--    HDR, SK {EAP (success)}
> >
> >         HDR, SK {AUTH, CP(CFG_REQUEST), SAi2, TSi, TSr}  -->
> >
> >                          <--    HDR, SK {AUTH, CP(CFG_REPLY) SAr2, 
> > TSi, TSr }
> >
> >
> >  Awaiting your valuable replies.
> >
> >  Thanks
> >  Jyothi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec