Re: Secure legacy authentication for IKEv2

[Derrell Piper <ddp@xxxxxxxxxxxxxxxxx>]

On Thursday, January 23, 2003, at 06:52  PM, 
Charlie_Kaufman@xxxxxxxxxxxxxxxx wrote:

> I would say the client MUST must an AUTH payload *if* the legacy
> authentication
> method establisheds a shared key with the server, and it MUST be in the
> first message from client->server after the client has enough 
> information
> to generate it. For a given authentication method, that should always 
> be in
> the same message.

> I wouldn't repeat it in subsequent messages.

But it might be that the subsequent EAP exchange generates a new key.  
For generality, I think it should be shown as optional on subsequent 
messages...  Basically, send it when it's first known and if/when it's 
changed.

Derrell