Re: EAP Handling in IKEv2

[Bernard Aboba <aboba@internaut.com>]

> > reusing "legacy methods". However, this means that we are willing to
> > *change* the authentication methods traditionally used by the "legacy
> > credentials". If this is a practical approach (namely, it can gain
> > widespread support in corporate organizations, etc) then the solution is
> > very simple and does not require the design of key-generating methods.
> > All is needed is that the modified methods authenticate the "context" in
> > which they are run. Specifically, when run with ikev2 the authenticated
> > information should include a unique "protocol identifier" (such as
> > "ikev2", "rfc-xxxx", "port-yyy", etc). This is the simplest and least
> > "intrusive" solution to the man in the middle problem while allowing use
> > of the same credentials in different contexts.
>
> Yes, this is also one of the proposed approaches for
> dealing with MitM.

I'd like to see this included in the EAP WG MiTM document :(

Hugo -- can we  prevail upon you to do a review of
draft-puthenkulam-eap-binding-02.txt and post this and other relevant
comments to the EAP WG mailing list?