[IPsec] EAP Mutual Auth and IKE session resumption

Yaron Sheffer <yaronf.ietf@gmail.com> Mon, 21 June 2010 16:31 UTC

DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; b=FbXlV62OkjXx1ZJGV86f/IwBvkS3Kr7Y2UgDBmRoTV8/FK5T2Yw5WwkiKgENhJlul3 7aicazrIKEEZx3VgGCkeQDszrrROHAdnYwzUpGzOfCFACJJnyLRKOSznhJfMJgmTl11V Yfb0mld4gWGWaWKIblXarj+1BAxNMi2zJi/Ik=
Message-ID: <4C1F93DA.4070200@gmail.com>
Date: Mon, 21 Jun 2010 19:31:22 +0300
From: Yaron Sheffer <yaronf.ietf@gmail.com>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100423 Lightning/1.0b1 Thunderbird/3.0.4
MIME-Version: 1.0
To: IPsecme WG <ipsec@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Subject: [IPsec] EAP Mutual Auth and IKE session resumption
Precedence: list

Hi,


EAP-Mutual has just gone through IESG review, but I'd like to make one 
more addition and would appreciate the group's feedback.


The interaction between this draft 
(https://datatracker.ietf.org/doc/draft-ietf-ipsecme-eap-mutual/) and 
session resumption (RFC 5723 <http://tools.ietf.org/html/rfc5723>) is 
simple, but I think should still be pointed out. So I was thinking of 
adding this text at the end of Sec. 3:


    An IKE SA that was set up with this extension can be resumed using 
the mechanism described
    in <xref target="RFC5723"/>. However session resumption does not 
change the authentication
    method. Therefore during the IKE_AUTH exchange of the resumed
    session, this extension MUST NOT be sent by the initiator.

All comments welcome.

Thanks,
     Yaron

[IPsec] EAP Mutual Auth and IKE session resumption Yaron Sheffer
Re: [IPsec] EAP Mutual Auth and IKE session resum… Paul Hoffman