Re: [Emu] Question on EAP-IKEv2

["Gene Chang (genchang)" <genchang at cisco.com>]

Hannes,
It was my understanding that authenticating the server first is an
essential behavior to prevent disclosing the user identity to an
imposter. This behavior is also part of EAP-FAST and EAP-TTLS.

Gene

------------------------------------------------------------------------
----
Eugene Chang (genchang)
Cisco Systems
Office:   603-559-2978
Mobile:  781-799-0233
Skype:  gene02421
 
 
 

> -----Original Message-----
> From: emu-bounces at ietf.org [mailto:emu-bounces at ietf.org] On Behalf Of
> Hannes Tschofenig
> Sent: Sunday, May 04, 2008 11:56 AM
> To: Ali Fessi
> Cc: emu at ietf.org
> Subject: Re: [Emu] Question on EAP-IKEv2
> 
> That's one reason.
> 
> The other one is to be able to have a strong password based mechanism.
> When you reverse the roles of client and server then you allow the
> server to be authenticated first before you present your "password".
> 
> Finally, reversing the roles allows you to offer active user identity
> confidentiality.
> 
> Ciao
> Hannes
> 
> 
> 
> Ali Fessi wrote:
> > Hi,
> >
> > I wonder why the IKEv2 exchange in EAP-IKEv2 is initiated by the
server.
> >
> > (See, RFC 5106, Page 7, Figure 1, message 3)
> >
> > Is the reason to save two messages, for example, compared to
EAP-TLS?
> >
> > Best,
> >   Ali
> >
> > _______________________________________________
> > Emu mailing list
> > Emu at ietf.org
> > https://www.ietf.org/mailman/listinfo/emu
> >
> 
> _______________________________________________
> Emu mailing list
> Emu at ietf.org
> https://www.ietf.org/mailman/listinfo/emu
_______________________________________________
Emu mailing list
Emu at ietf.org
https://www.ietf.org/mailman/listinfo/emu