[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Secure legacy authentication for IKEv2

At 3:06 PM +0300 12/20/02, Valery Smyslov wrote: 
draft suggests that no negotiation of LAM type is possible between client
and server:
server can just accept or reject LAM type that client proposed, and he has
no means
to indicate to client which LAM type he is willing to do. This can lead to
situation,
when client will have to perform up to 4 connection attempts with different
LAM types.
Not only will it delay the connection setup, but also it will put an
unnecessary load
to server - for each attempt he will have to do both DH and RSA/DSA.

Er, do you really think that the client and server haven't agreed out of band which legacy auth mechanism they will do? In the real world, companies tell their users which auth mechanism they will use, and the information needed to do it.

I think better way to handle this situation is to allow server to change LAM
type
if he doesn't like what client proposed.

This adds a lot of complexity for a usage model that no one seems to have. Am I wrong here? Do any of the VPN makers out there have customers who want to do legacy auth negotiation?

--Paul Hoffman, Director
--VPN Consortium