Subject: Re: [Cfrg] [IPsec] Beginning discussion on secure password-only authentication for IKEv2

From: "Blumenthal, Uri - 0662 - MITLL" <[email-masked]>
Date: Tue, 2 Mar 2010 13:03:40 -0500

I see value in adding a simpler-than-EAP method, and support this effort. But overall it's an extremely difficult task because of IPR.

I personally would hate to see a patent-encumbered solution - and that would disqualify EKE and PAK outright (both held by Alcatel-Lucent, AFAIK). SRP would be the only acceptable (from IPR point of view) candidate that I'm aware of. I've been told that EKE patent is written so broadly that it could cover SRP as well - somebody more knowledgeable should comment on this.

Tnx!

Regards,
Uri

----- Original Message -----
From: [email-masked] <[email-masked]>
To: Hannes Tschofenig <[email-masked]>
Cc: IPsecme WG <[email-masked]>; [email-masked] <[email-masked]>
Sent: Tue Mar 02 12:51:29 2010
Subject: Re: [Cfrg] [IPsec] Beginning discussion on secure password-only authentication for IKEv2

At 7:22 PM +0200 3/2/10, Hannes Tschofenig wrote:
>The challenge I have in understanding the motivation for this work is impacted by ...
>
>1) EAP is not only meant to be used with backend infrastructure.
>2) EAP is an authentication framework and EAP methods exist that support strong-password based authentication.
>3) EAP is implemented by folks in IKEv2 already.
>
>To me it seems that there is the chance to re-use existing mechanisms and to even re-use existing code.

Hannes, it is not really appropriate to re-open closed charter issues. As you know, this was already discussed, at length, in the WG. That's why another part of the new charter has:

- A standards-track IKEv2 extension to allow mutual EAP-based
authentication in IKEv2, eliminating the need for the responder to
present a certificate. The document will define the conditions that
EAP methods need to fulfill in order to use this extension. The
document will recommend, but will not require, the use of EAP methods
that provide EAP channel binding. The proposed starting point for this
work is draft-eronen-ipsec-ikev2-eap-auth-07.txt.

For this thread, please focus on the issues at hand for a secure password-only authentication mode for IKEv2. Thanks!

--Paul Hoffman, Director
--VPN Consortium
_______________________________________________
Cfrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/cfrg

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 2 Mar 2010 13:19:44 -0500

On Tue, 2 Mar 2010 13:03:40 -0500
"Blumenthal, Uri - 0662 - MITLL" <[email-masked]> wrote:

> I see value in adding a simpler-than-EAP method, and support this
> effort. But overall it's an extremely difficult task because of IPR.
> 
> I personally would hate to see a patent-encumbered solution - and
> that would disqualify EKE and PAK outright (both held by
> Alcatel-Lucent, AFAIK). SRP would be the only acceptable (from IPR
> point of view) candidate that I'm aware of.

Note that the EKE patent expires in October 2011.  (At least I think it
does; it was filed in October 1991.)  Depending on when you expect
implementations to appear-- and given how long it takes to produce
standards-track documents in the IETF -- it might not be a problem.

> I've been told that EKE
> patent is written so broadly that it could cover SRP as well -
> somebody more knowledgeable should comment on this.
> 
I've been told that, too, but since I haven't worked for the patent
assignee for almost 13 years, I've never felt any need to (go through
the non-trivial amount of work necessary to) come to my own conclusions.

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 2 Mar 2010 20:32:26 +0200

Whether or not the EKE patent is broad enough, if you search the IPR repository for RFC 2945 (SRP), you will find out that more than one company is happy to post an IPR warning related to SRP. This of course does not prove anything - they're just saying that their patents "might apply". BTW, I also believe the EKE patent expires 10/2011.

Thanks,
	Yaron

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Steven M. Bellovin
> Sent: Tuesday, March 02, 2010 20:20
> To: Blumenthal, Uri - 0662 - MITLL
> Cc: [email-masked]'; [email-masked]'; [email-masked]';
> [email-masked]'
> Subject: Re: [IPsec] [Cfrg] Beginning discussion on secure password-
> only authentication for IKEv2
> 
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
> 
> Scanned by Check Point Total Security Gateway.