Re: EAP Handling in IKEv2

[Charlie_Kaufman@notesdev.ibm.com]

Bernard Aboba <aboba@internaut.com> wrote:
> > If so, it may be possible to keep the credentials as they are but
> > replace the existing method with a modified one when running inside
IKEv2.
> > When running outside IKEv2 or other sort of "EAP tunnels", use the
existing
> > method as-is.
>
> Yes, this "modified method" approach is one of the proposals for dealing
> with non-key generating methods.

Uhhh... have I missed something? Where is this proposal? Since IKE does a
Diffie-Hellman exchange, it will have keying material whether EAP generates
a key or not. Using the EAP key protects against MITM attacks. If there is
no EAP key, then I believe there can be no protection for MITM attacks (as
Radia noted). So what did you have in mind?

      --Charlie