Re: EAP Handling in IKEv2

[Bernard Aboba <aboba@internaut.com>]

> It seems that the main interest is *not* supporting legacy
> authentication methods. I believe that the issue is rather
> supporting legacy credentials, such as passwords or token cards.

Exactly. Since virtually every RADIUS server (including FreeRADIUS)
already supports EAP, the issue is support for legacy credentials
rather than legacy algorithms -- since EAP support allows
algorithms to be easily changed.

I'd also note that in both the "password" and "token card" categories, key
generating methods exist -- although there are some token cards that do
not support key generation.

> If so, it may be possible to keep the credentials as they are but
> replace the existing method with a modified one when running inside IKEv2.
> When running outside IKEv2 or other sort of "EAP tunnels", use the existing
> method as-is.

Yes, this "modified method" approach is one of the proposals for dealing
with non-key generating methods.