Re: EAP Handling in IKEv2

[Charlie_Kaufman@notesdev.ibm.com]

"Hannes Tschofenig" <Hannes.Tschofenig@siemens.com> wrote:
>in Section 2.16 you mention the mechanism for protecting against
>man-in-the-middle attacks:
>
>" For EAP methods that create a shared key as a side effect of
>authentication, that shared key MUST be used by both the Initiator
>and Responder to generate an AUTH payload using the syntax for shared
>secrets specified in section 2.15. This shared key MUST NOT be used
>for any other purpose."
>
>This covers the case where the EAP method establishes a session key.
>
>Which procedure do you suggest for cases where EAP methods do not create a
>session key such as the One-Time Password (OTP)?

For EAP methods that don't generate session keys, the AUTH payloads are
not sent. I'll make that clearer in the spec.

      --Charlie