Re: [Ipsec] Reauthentication in IKEv2

[Geoffrey Huang <ghuang at cisco.com>]

Bill Sommerfeld wrote:
> On Wed, 2004-11-10 at 20:27, Geoffrey Huang wrote:
>
>
> > I can see arguments from both sides, I guess.  Even with your re-auth 
> > scheme, a value of "0" seconds could mean "do it now," right?
>
>
> I'd think so; I'd also hope that the encoding should also allow for
> "reauth in 8 hours" notifications as well.
>
> As was pointed out in the secsh working group yesterday for a related
> user-authentication timeout, there are also accessibility concerns here;
> some people enter text *very* slowly; 3 minutes may not be sufficient
> for some.  

Yes, but as was pointed out earlier, you don't need this "re-auth in X 
seconds" scheme to achieve this.  You could simply have the server send 
a reauth_now message ahead of time.

I'm not disagreeing with you -- I'm just pointing out that the 2 main 
schemes I've read about in this thread differ only in *how* they 
communicate the reauth message.  One scheme says "re-auth in X number of 
seconds," whereas the other simply says "re-auth right now."

-g


> 						- Bill

_______________________________________________
Ipsec mailing list
Ipsec at ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec