Re: [HOKEY] [IPsec] IKEv2 and ERP

Yaron Sheffer <> Sun, 20 November 2011 07:42 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 0958221F847C; Sat, 19 Nov 2011 23:42:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -102.87
X-Spam-Status: No, score=-102.87 tagged_above=-999 required=5 tests=[AWL=-0.729, BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Ljgh89o-I+Ar; Sat, 19 Nov 2011 23:42:48 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id CC80121F847A; Sat, 19 Nov 2011 23:42:47 -0800 (PST)
Received: by bkbzv15 with SMTP id zv15so6003821bkb.31 for <multiple recipients>; Sat, 19 Nov 2011 23:42:47 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=DToB0fuamUN6HxCikjNVQ5UvtEL5F9UdEit6Li8Dd0Y=; b=Jt0iEnGlkJ0AV2TxGiG45jOYfKp4B963c0oiLTZ9qWlTi56CPr8/2nzkJ+rC4OSTp/ 7+w55QI5YTOOvp8iNXX8rAkVgcjEceynSQvZV7MF3hS5zgmITP/b6yeYawFWn44gFN3n 4VrHhk24In2aAGT5z2dpwOE4nji262ZgMbeJM=
Received: by with SMTP id af9mr9857789bkc.24.1321774966912; Sat, 19 Nov 2011 23:42:46 -0800 (PST)
Received: from [] ( []) by with ESMTPS id c8sm11321214fai.19.2011. (version=SSLv3 cipher=OTHER); Sat, 19 Nov 2011 23:42:46 -0800 (PST)
Message-ID: <>
Date: Sun, 20 Nov 2011 09:42:42 +0200
From: Yaron Sheffer <>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:7.0.1) Gecko/20110929 Thunderbird/7.0.1
MIME-Version: 1.0
To: Yoav Nir <>
References: <> <>
In-Reply-To: <>
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: IPsecme WG <>, "" <>
Subject: Re: [HOKEY] [IPsec] IKEv2 and ERP
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: HOKEY WG Mailing List <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 20 Nov 2011 07:42:49 -0000

Hi Yoav,

motivation for this work seems to have come from 3GPP/3GPP2/WiMAX, and I strongly suggest that you or your coauthor go back to the originating organization to validate your use case(s).

I find the new paragraph (top of Sec. 3.2) confusing: I would expect the IKE negotiation to go to a local network (in the "visited network") with this gateway being supported by a "home" EAP server. EAP requests are commonly routed back into the home network. In a telco network, this backend EAP connectivity most likely would *not* be over the open Internet.

Lastly, judging by the level of interest so far, I do not see this draft becoming an ipsecme WG charter item. I do not have any problem with its being published elsewhere.


On 11/19/2011 02:07 PM, Yoav Nir wrote:
On Aug 6, 2011, at 10:37 PM, Yoav Nir wrote:


At the meeting in Quebec, I gave a presentation at the hokey meeting about" rel="nofollow"> .

The draft covers using the EAP extensions for re-authentication in IKEv2. The obvious (to me) use-case is a phone connected to a 802.1x network. As you leave the building, the same phone automatically using IKEv2 over a 3G network without the user authenticating, by using the handed-over keys from 802.1x.

ERP (RFC 5296) works in two cases:
1. when the new AAA backend and the old AAA backend are the same, and
2. when they are different - you connect to a local EAP server

There is an open question here. Obviously, when you use EAP for 802.1x or PPP or some other network access, you often connect to a local Authenticator that is not the same as your "home network". But is this relevant in IKEv2?  IKEv2 is used over the Internet. Why would you ever want to connect to a server other than your home (or a server that relies on the same AAA backend)

In other words: is there a use-case for connecting to a local rather than a home server in IKE, a use-case that uses EAP.

My feeling is that the answer is no, and there were some phone operators in the room who agreed with me. Someone did bring up the case of host-to-host IPsec, but I don't think that ever uses EAP.

Does anybody have different thoughts about this?

As there were no replies to this email, and as there was pretty much an uncalled consensus at the HOKEY meeting, I have submitted version -02 of the draft with an extra paragraph in section 3.2 to explain that "roaming to a different EAP server" scenario is probably not relevant." rel="nofollow">

I would be happy for this to become a working group item, but if not, I would like to take it to our ADs (not sure which one, as this involves both IPsecME and HOKEY). I would also appreciate any suggestions for the Security Considerations section, other than just moving the rest of section 3.2 into it.

IPsec mailing list" rel="nofollow">