RE: Re[2]: PPP over IPSec (without L2TP)?

[Pyda Srisuresh <[e-mail]>]

--- Stephen Kent <[e-mail]> wrote:
<... stuff deleted>
> 
> The statement about user vs. machine authentication is incorrect, and
> consistent with the misunderstanding of IPsec expressed by some of the L2TP
> partisans.  If you read RFC 2401 carefully you will note that IPsec
> supports individual user authentication, in both modes.
> 

User vs. Machine authentication is really a key management protocol 
issue (i.e., IKE) - somewhat orthogonal to IPsec architecture (RFC 2401).

However, I do agree with Steve that there is a lot of misunderstanding 
on the issue of User vs. Machine authentication. IKE does not restrict
from having multiple phase-I SAs between the same pair of SecGW nodes, 
one SA for each user that wishes to authenticate from his/her 
local GW to remote gateway. It is not necessary to perform the authentication
in 2 phases - i.e., device-to-device authentication, followed by user-to-device
authentication.

The reason we have the XAUTH and HYBRID-AUTH drafts out is because IKE
mandates symmteric forms of authentication and that is lot harder to 
accomplish with legacy systems. XAUTH tries to solve the problem by
doing the authentication in 2 phases - Symmetric authentication between
devices, followed  by user authentication. HYBRID authentication solves 
the problem by allowing asymmetric authetications in the IKE protocol.

Hope this helps clarify the misunderstanding. Thanks.

> Steve
> 

cheers,
suresh

=====

__________________________________________________
Do You Yahoo!?
Bid and sell for free at http://auctions.yahoo.com