[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Shared Secret mismatch in AM3/MM5
On Thu, 28 Oct 1999, Walker, Jesse wrote:
> Rick,
>
> I don't know what the designers were thinking, but consider
> man-in-the-middle for a minute. In order to defeat it, the IKE
> authentication proof has to demonstrate the peer's knowledge of both the
> shared secret and the negotiated Diffie-Hellman keying material. The design
> of IKE does this quite effectively by binding the two together in a single
> hash. If you remove the binding, then you reenable man-in-the-middle if you
> don't introduce some other means to tie them together.
>
> -- Jesse
>
But that kind of definition of SKEYID excludes nodadic users in the main
mode with pre-shared key for authentication.
Jianying
References: