Subject: RE: [Ipsec] Reauthentication in IKEv2

From: [email-masked]
Date: Thu, 28 Oct 2004 16:32:35 +0300

Jari Arkko wrote:
>
> I support this draft too. Or maybe not the exact details
> (see below) but I'd like to have this functionality.
> 
> Why would "please re-authenticate now" notification
> not be simpler than a lifetime scheme? It would also
> support other re-authentication policies than time-based
> ones...

Actually, the scheme in Yoav's draft supports other policies as 
well: the responder can send a new AUTH_LIFETIME with a zero
or small value to mean "please re-authenticate now".

If the policy is time-based 99% of the time, then Yoav's
scheme is IMHO simpler, since it doesn't need any extra
messages (the lifetime can be sent in IKE_AUTH phase).
But actually both approaches are very simple, so there's
no big difference either...

(BTW, knowing how much time is remaining allows the initiator 
more options when to do the reauthentication; e.g. intelligent 
UI that takes into account what the user is doing, or something
like that.)

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Jari Arkko <[email-masked]>
Date: Thu, 28 Oct 2004 19:38:29 +0300

> or small value to mean "please re-authenticate now".

Ok, I'm convinced.

--Jari