On Fri, 17 Jan 2014, Valery Smyslov wrote:
I don't think this complicates the state machine that much, as it's
clearly distinct by the auth type none payload. My preference is for #1.
Thank you for sharing your opinion. I still think that empty
ID is preferrable, as IMHO it will add less compl
BTW, we have 3 possibility for inidicating "anonymous" ID.
1. Don't send ID Payload at all.
2. Send empty ID Payload (say, Type = 0, Len=0).
3. Send special ID Payload (say, Type=KeyId, Value="anonymous")
For me, case 3 looks the worst, I'd rather to avoid special values.
Case 1 looks the best fr
On Mon, 13 Jan 2014, Valery Smyslov wrote:
I think that using NULL Auth method clearly identifies
anonymous users and allows to distingush them from regular ones.
Adding special "anonymous" ID here seems to be superfluous.
Than you should stick to that and not send any IDs whatsoever.
If we
I think that using NULL Auth method clearly identifies
anonymous users and allows to distingush them from regular ones.
Adding special "anonymous" ID here seems to be superfluous.
Than you should stick to that and not send any IDs whatsoever.
If we mandate ID to always be empty in case of NULL
On Jan 12, 2014, at 7:15 AM, Paul Wouters
wrote:
>> Regarding audit, we can mandate that each record should say something like
>> "Snow White (claimed but unauthenticated identity)".
>
> You are suggesting client side security? I don't understand. If I would
> write software where an ID is sen
On Sat, 11 Jan 2014, Yaron Sheffer wrote:
I regularly use SSH, which binds a public key fingerprint to a DNS name. It's
usable, and not too complicated.
But always requires a human decision.
I believe some limited form of channel binding can work. Specifically, I am
thinking of post facto au
Hi Paul,
I regularly use SSH, which binds a public key fingerprint to a DNS name.
It's usable, and not too complicated.
We can argue why BTNS failed but I don't want to waste our time on that.
I believe some limited form of channel binding can work. Specifically, I
am thinking of post facto
On Fri, 10 Jan 2014, Valery Smyslov wrote:
1) Use of IDs
I don't think we should allow any IDs, as there could be conflicts with
other non-anonymous connections. Or possibly a way to detect which
non-anonymous IDs are accepted at the remote. I was leaning towards
mandating the ID to be "anonymo
Hi Paul,
please, see my comments inline.
This is what we (libreswan) have started implementing as well, although we
called it AUTH_NONE instead of AUTH_NULL. We use private range number 201
for this exchange type. We also followed the PSK exchange method. But
we are still looking at some issues
Hi Paul, Valery,
Regarding IDs, there is value in sending them if you are later able to
confirm the identity, or at least "bind" it to the connection. For
example, if the human owners of the peers make a phone call and exchange
fingerprint values. Or (more far fetched) if both sides use raw pu
On Tue, 24 Dec 2013, Valery Smyslov wrote:
I've just posted a draft, defining NULL Authentication method in IKEv2.
This method may be used for anonymous access or in situations,
when peers don't have any trust relationship, but still want
to get protection at least against passive attacks.
Thi
Hi Valery,
Yes, between EAP+signature (RFC 5996) and EAP+EAP (RFC 5998), there's
very little justification for EAP+null, and it is very likely to create
security issues. I think we should mention EAP, and expressly forbid it
in this context (MUST NOT).
Thanks,
Yaron
On 12/25/2013 07
Hi Yaron,
Hi Valery,
Thanks for posting this draft.
One quick comment: the interaction of your proposal with EAP is not clear
to me, i.e. when one peer uses Null auth and the other uses EAP. There are
cases where this should be forbidden (e.g. MSCHAP, where the
unauthenticated peer can moun
Hi Valery,
Thanks for posting this draft.
One quick comment: the interaction of your proposal with EAP is not
clear to me, i.e. when one peer uses Null auth and the other uses EAP.
There are cases where this should be forbidden (e.g. MSCHAP, where the
unauthenticated peer can mount a dictiona
Hi all,
I've just posted a draft, defining NULL Authentication method in IKEv2.
This method may be used for anonymous access or in situations,
when peers don't have any trust relationship, but still want
to get protection at least against passive attacks.
Regards,
Valery.
- Original Messag
15 matches
Mail list logo
