Re: EAP Handling in IKEv2

[Radia Perlman - Boston Center for Networking <Radia.Perlman@sun.com>]

If it doesn't create a session key you really can't protect
against man-in-the-middle.

Radia


"Hannes Tschofenig" <Hannes.Tschofenig@siemens.com> wrote:
>Dear all,
>
>
>
>in Section 2.16 you mention the mechanism for protecting against
>man-in-the-middle attacks:
>
>" For EAP methods that create a shared key as a side effect of
>
>authentication, that shared key MUST be used by both the Initiator
>
>and Responder to generate an AUTH payload using the syntax for shared
>
>secrets specified in section 2.15. This shared key MUST NOT be used
>
>for any other purpose.
>
>"
>
>This covers the case where the EAP method establishes a session key.
>
>Which procedure do you suggest for cases where EAP methods do not create a
>session key such as the One-Time Password (OTP)?
>
>
>
>Ciao
>
>Hannes
>