Geoffrey Huang writes: > It's starting to sound like existing methods, to be sure. I'm skeptical > of introducing yet another form of authentication. This would add to the > complexity of the overall system. To frame it in terms of a requirement, > I propose that any leaf-to-leaf communication has to be done with existing > (already defined) authentication methods: for instance, either > certificates or pre shared key.
Yes, we do want to use existing authentication methods. The question is can we use existing credentials. We cannot securely reuse existing pre-shared keys, as that would require sharing keys between peers who normally do not share keys. We cannot easily reuse EAP crendentials, as most of the leafs (especially the road warrior cases) do not have trust relationship with the EAP server, so they cannot verify other ends EAP credentials. We can reuse existing certificates and public/private key pairs, but if any other authentication methods are needed, we need to provide solution how peers can get some kind of temporary credentials they can use with the existing authentication methods to authenticate them to another peer. For that the private/public key pair (with or without certificates) is the most convinient one. -- [email protected] _______________________________________________ IPsec mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipsec
