RFC 4739
Multiple Authentication Exchanges in the Internet Key Exchange (IKEv2) Protocol
RFC 4739: Multiple Authentication Exchanges in the Internet Key Exchange (IKEv2) Protocol ✨
Okay bestie, this one is RFC 4739 💖 It was published in November 2006 by the Network Working Group. The authors are P. Eronen (Nokia) and J. Korhonen (TeliaSonera). It's an Experimental doc, and it doesn't obsolete or update any other RFCs (none are listed in its header). Let's get into it 🦋
Status of This Memo 🎀
This memo defines an Experimental Protocol for the Internet community, so it's not an Internet standard of any kind. They're asking for discussion and suggestions for improvement, and distribution of the memo is unlimited 💅
Copyright Notice 🌸
Copyright (C) The IETF Trust (2006).Abstract 💜
Okay so IKEv2 has a bunch of ways to authenticate the two parties: signatures with public-key certificates, shared secrets, and Extensible Authentication Protocol (EAP) methods 🔐 The catch is that right now, each endpoint only uses one of these to prove who it is. This doc adds an extension that lets you do multiple authentication exchanges, either with different mechanisms or with the same one. It's giving flexibility ✨ For example, you can certificate-authenticate the client host first and then run an EAP authentication for the user. And when backend authentication servers are involved, they can live in different administrative domains, like the network access provider and the service provider 👑
Table of Contents 📋
1. Introduction ....................................................3
1.1. Usage Scenarios ............................................4
1.2. Terminology ................................................5
2. Solution ........................................................5
2.1. Solution Overview ..........................................5
2.2. Example 1: Multiple EAP Authentications ....................6
2.3. Example 2: Mixed EAP and Certificate Authentications .......7
2.4. Example 3: Multiple Initiator Certificates .................8
2.5. Example 4: Multiple Responder Certificates .................8
3. Payload Formats .................................................9
3.1. MULTIPLE_AUTH_SUPPORTED Notify Payload .....................9
3.2. ANOTHER_AUTH_FOLLOWS Notify Payload ........................9
4. IANA Considerations .............................................9
5. Security Considerations .........................................9
6. Acknowledgments ................................................10
7. References .....................................................10
7.1. Normative References ......................................10
7.2. Informative References ....................................101. Introduction ✨
IKEv2 [IKEv2] has several mechanisms for the parties involved in the IKE_SA (IKE security association) 🔑 These include signatures with public-key certificates, shared secrets, and Extensible Authentication Protocol (EAP) methods.
Right now, each endpoint only uses one of these to authenticate itself. But there are situations where deciding whether to allow access in IKEv2 needs more than one of these methods 🧐
Like, you might need to authenticate both the host (machine) asking for access and the user who's actually using that host. Those two authentications use two separate sets of credentials (like certificates and their private keys), and they might even use different mechanisms entirely 💅
Another example: when an operator hosts a Virtual Private Network (VPN) gateway service for a third party, the client might need to be authenticated to both the operator (for billing) and the third party's Authentication, Authorization, and Accounting (AAA) server (for access to the third party's internal network) 💖
This document specifies an extension to IKEv2 that allows the use of multiple authentication exchanges, using either different mechanisms or the same mechanism. For instance, it allows certificate-based authentication of the client host followed by an EAP authentication of the user 🦋
Each authentication exchange that needs to talk to backend AAA servers can go to different backend AAA servers, which could even be in different administrative domains 🌈 But the details of how the IKEv2 gateway talks to those backend authentication servers are out of scope for this doc. Specifically, it doesn't change any existing AAA protocols, and it doesn't require any particular AAA protocol ✨
Now, with several EAP authentications, it's important to know that they are not a "sequence" (as described in Section 2.1 of [EAP]). They're separate, independent EAP conversations, and they usually end on different EAP servers 🙈 Multiple authentication methods inside a single EAP conversation are still prohibited, as described in Section 2.1 of [EAP]. Using multiple independent EAP conversations is kind of like the separate Network Access Provider (NAP) and Internet Service Provider (ISP) authentication exchanges planned for [PANA]. And finding the right EAP server for each conversation is based on AAA routing 🧚
1.1. Usage Scenarios 🍓
Figure 1 shows an operator-hosted VPN scenario that could benefit from two-phase authentication within the IKEv2 exchange. First, the client authenticates to the Network Access Provider (NAP) and gets access to the NAP-hosted VPN gateway. That first authentication involves the NAP's backend AAA server. After that, the client starts a second authentication round, which also involves the Third Party's backend AAA server. If both authentications succeed, the required IPsec tunnels get set up and the client can reach protected networks behind the Third Party 🔥
Client *Network Access Provider*
+---------+ +---------+ +-----+
| | | NAP's | | NAP |
|Protected| IPsec SAs | Tunnel | AAA Protocol | AAA |
|Endpoint |<------------------>|Endpoint |<------------>|Serv/|
| | | | |Proxy|
+---------+ +---------+ +-----+
^ ^
IPsec or / AAA |
Leased Line / Protocol |
/ |
v |
+---------+ *Third Party* v
|3rd Party| +-----+
Protected | Tunnel | | 3rd |
Subnet <----|Endpoint | |Party|
| | | AAA |
+---------+ +-----+
Figure 1: Two-phase authentication used to gain access to
the Third Party network via Network Access Provider. AAA
traffic goes through NAP's AAA server.The NAP's AAA server can proxy the AAA traffic to the Third Party's backend AAA server 💅 Or, the AAA traffic from the NAP's tunnel endpoint could go straight to the Third Party's backend AAA servers. But honestly, that's more or less an AAA routing issue 🤷♀️
1.2. Terminology 📖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [KEYWORDS].
The terms and abbreviations "authenticator", "backend authentication server", "EAP server", and "peer" in this document are to be interpreted as described in [EAP] 💜
When messages containing IKEv2 payloads are described, optional payloads are shown in brackets (for instance, [FOO]), and a plus sign indicates that a payload can be repeated one or more times (for instance, FOO+) 🎀
2. Solution 💖
2.1. Solution Overview 🌸
Both peers announce support for this IKEv2 extension by including a MULTIPLE_AUTH_SUPPORTED notification in the IKE_SA_INIT response (responder) and in the first IKE_AUTH request (initiator) 🫶
If both peers support this extension, either one can say it wants a second authentication by including an ANOTHER_AUTH_FOLLOWS notification in any IKE_AUTH message that contains an AUTH payload. That tells the other peer it wants to authenticate another set of credentials. The next IKE_AUTH message sent by this peer will contain a second identity payload (IDi or IDr) and kicks off another authentication exchange. The IKE_AUTH phase only counts as successful if all the individual authentication exchanges complete successfully ✅
Both peers are assumed to know which credentials they want to present, so there's no negotiation about things like what type of authentication to do. Same as in IKEv2, EAP-based authentication is always requested by the initiator (by leaving out the AUTH payload) 🦋
The AUTH payloads are calculated as specified in [IKEv2] Sections 2.15 and 2.16. Here, IDi' refers to the latest IDi payload sent by the initiator, and IDr' refers to the latest IDr payload sent by the responder. If EAP methods that don't generate shared keys are used, it's possible to end up sending several AUTH payloads with identical contents. When that happens, the AUTH payload's only job is to delimit the authentication exchanges, and to make sure the IKE_SA_INIT request/response messages weren't modified 🧚✨
2.2. Example 1: Multiple EAP Authentications 🎀
Okay so, bestie, this example shows certificate-based authentication of the responder, followed by an EAP authentication exchange ✨ (messages 1-10). When the first EAP exchange is wrapping up and the initiator is sending its AUTH payload, the initiator says "hey, I want another auth round" by sending an ANOTHER_AUTH_FOLLOWS notification (message 9) 💅
Then the second authentication exchange kicks off 🦋. The initiator sends a fresh IDi payload with no AUTH payload (message 11), which basically means "EAP time, babe" 🌸. Another EAP exchange follows (messages 12-18), and it's giving full main character energy 👑
Initiator Responder
----------- -----------
1. HDR, SA, KE, Ni -->
<-- 2. HDR, SA, KE, Nr, [CERTREQ],
N(MULTIPLE_AUTH_SUPPORTED)
3. HDR, SK { IDi, [CERTREQ+], [IDr],
SA, TSi, TSr, N(MULTIPLE_AUTH_SUPPORTED) } -->
<-- 4. HDR, SK { IDr, [CERT+], AUTH,
EAP(Request) }
5. HDR, SK { EAP(Response) } -->
<-- 6. HDR, SK { EAP(Request) }
7. HDR, SK { EAP(Response) } -->
<-- 8. HDR, SK { EAP(Success) }
9. HDR, SK { AUTH,
N(ANOTHER_AUTH_FOLLOWS) } -->
<-- 10. HDR, SK { AUTH }
11. HDR, SK { IDi } -->
<-- 12. HDR, SK { EAP(Request) }
13. HDR, SK { EAP(Response) } -->
<-- 14. HDR, SK { EAP(Request) }
15. HDR, SK { EAP(Response) } -->
<-- 16. HDR, SK { EAP(Success) }
17. HDR, SK { AUTH } -->
<-- 18. HDR, SK { AUTH, SA, TSi, TSr }Example 1: Certificate-based authentication of the responder, followed by two EAP authentication exchanges. 🧚
2.3. Example 2: Mixed EAP and Certificate Authentications 💜
Next up is the mixed vibe 💅. Here, both the initiator and the responder get authenticated first using certificates (or shared secrets), and then an EAP authentication exchange follows.
Initiator Responder
----------- -----------
1. HDR, SA, KE, Ni -->
<-- 2. HDR, SA, KE, Nr, [CERTREQ],
N(MULTIPLE_AUTH_SUPPORTED)
3. HDR, SK { IDi, [CERT+], [CERTREQ+], [IDr], AUTH,
SA, TSi, TSr, N(MULTIPLE_AUTH_SUPPORTED),
N(ANOTHER_AUTH_FOLLOWS) } -->
<-- 4. HDR, SK { IDr, [CERT+], AUTH }
5. HDR, SK { IDi } -->
<-- 6. HDR, SK { EAP(Request) }
7. HDR, SK { EAP(Response) } -->
<-- 8. HDR, SK { EAP(Request) }
9. HDR, SK { EAP(Response) } -->
<-- 10. HDR, SK { EAP(Success) }
11. HDR, SK { AUTH } -->
<-- 12. HDR, SK { AUTH, SA, TSi, TSr }Example 2: Certificate-based (or shared-secret-based) authentication of the initiator and the responder, followed by an EAP authentication exchange. 🌈
2.4. Example 3: Multiple Initiator Certificates 🦋
This one is a plot twist 😭: the initiator has two different certificates (and their matching private keys), and it authenticates both of them to the responder.
Initiator Responder
----------- -----------
1. HDR, SA, KE, Ni -->
<-- 2. HDR, SA, KE, Nr, [CERTREQ],
N(MULTIPLE_AUTH_SUPPORTED)
3. HDR, SK { IDi, [CERT+], [CERTREQ+], [IDr], AUTH,
SA, TSi, TSr, N(MULTIPLE_AUTH_SUPPORTED),
N(ANOTHER_AUTH_FOLLOWS) } -->
<-- 4. HDR, SK { IDr, [CERT+], AUTH }
5. HDR, SK { IDi, [CERT+], AUTH } -->
<-- 6. HDR, SK { SA, TSi, TSr }Example 3: Two certificate-based authentications of the initiator, and one certificate-based authentication of the responder. 🍓
2.5. Example 4: Multiple Responder Certificates 🌸
Same energy, flipped roles 🙈: the responder has two different certificates (and matching private keys), and it authenticates both of them to the initiator.
Initiator Responder
----------- -----------
1. HDR, SA, KE, Ni -->
<-- 2. HDR, SA, KE, Nr, [CERTREQ],
N(MULTIPLE_AUTH_SUPPORTED)
3. HDR, SK { IDi, [CERT+], [CERTREQ+], [IDr], AUTH,
SA, TSi, TSr, N(MULTIPLE_AUTH_SUPPORTED) } -->
<-- 4. HDR, SK { IDr, [CERT+], AUTH,
N(ANOTHER_AUTH_FOLLOWS) }
5. HDR, SK { } -->
<-- 6. HDR, SK { IDr, [CERT+], AUTH,
SA, TSi, TSr }Example 4: Two certificate-based authentications of the responder, and one certificate-based authentication of the initiator. ✨
3. Payload Formats 🎀
3.1. MULTIPLE_AUTH_SUPPORTED Notify Payload 🫶
The MULTIPLE_AUTH_SUPPORTED notification gets included in the IKE_SA_INIT response or the first IKE_AUTH request. It's basically how a peer says "yep, I speak this spec" 💖. The Notify Message Type is MULTIPLE_AUTH_SUPPORTED (16404). The Protocol ID and SPI Size fields MUST be set to zero, and there's no data attached to this Notify type 🍓.
3.2. ANOTHER_AUTH_FOLLOWS Notify Payload 🦋
The ANOTHER_AUTH_FOLLOWS notification payload goes inside an IKE_AUTH message that contains an AUTH payload. It's how the peer tells you it wants to keep going with another authentication exchange 🔥. The Notify Message Type is ANOTHER_AUTH_FOLLOWS (16405). The Protocol ID and SPI Size fields MUST be set to zero, and there's no data attached to this Notify type 💅.
4. IANA Considerations 🌈
This document defines two new IKEv2 notifications, MULTIPLE_AUTH_SUPPORTED and ANOTHER_AUTH_FOLLOWS. Their values get allocated from the "IKEv2 Notify Message Types" namespace defined in [IKEv2] ✨.
This document does not define any new namespaces for IANA to manage 🧚.
5. Security Considerations 💀
Okay, this section is serious, bestie 😭. Security considerations for IKEv2 are discussed in [IKEv2]. The reader is strongly encouraged to pay special attention to the considerations around EAP methods that don't generate shared keys. On top of that, using multiple authentication exchanges creates at least one new security consideration 🔥.
Here's the tea: in normal IKEv2, the responder authenticates the initiator before revealing its identity (except when EAP is used). When multiple authentication exchanges are used to authenticate the initiator, the responder has to reveal its identity before all of the initiator's authentication exchanges are finished 🙈💀.
6. Acknowledgments 🫶
The authors would like to thank Bernard Aboba, Jari Arkko, Spencer Dawkins, Lakshminath Dondeti, Henry Haverinen, Russ Housley, Mika Joutsenvirta, Charlie Kaufman, Tero Kivinen, Yoav Nir, Magnus Nystrom, Mohan Parthasarathy, and Juha Savolainen for their valuable comments 💜.
7. References 📚
7.1. Normative References 👑
[IKEv2] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol",
RFC 4306, December 2005.
[KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", RFC 2119, March 1997.7.2. Informative References 🧚
[EAP] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
Levkowetz, "Extensible Authentication Protocol (EAP)",
RFC 3748, June 2004.
[PANA] Yegin, A., Ohba, Y., Penno, R., Tsirtsis, G., and C.
Wang, "Protocol for Carrying Authentication for Network
Access (PANA) Requirements", RFC 4058, May 2005.Authors' Addresses 🌸
Pasi Eronen
Nokia Research Center
P.O. Box 407
FIN-00045 Nokia Group
Finland
EMail: pasi.eronen@nokia.com
Jouni Korhonen
TeliaSonera
P.O. Box 970
FIN-00051 Sonera
Finland
EMail: jouni.korhonen@teliasonera.comFull Copyright Statement ✨
Copyright (C) The IETF Trust (2006).
This document is subject to the rights, licenses and restrictions in BCP 78. Apart from what BCP 78 says, the authors keep all their rights 🦋.
This document and the information in it are provided on an "AS IS" basis. THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST, AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 💅.
Intellectual Property 🔥
The IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to apply to the implementation or use of the technology in this document, or on whether any license under those rights could or could not be available. It also doesn't claim to have made any independent effort to find such rights 🙈. Info on how rights work for RFC documents is in BCP 78 and BCP 79 📚.
Copies of IPR disclosures sent to the IETF Secretariat, any assurances of licenses that will be available, and the results of any attempt to get a general license or permission for implementers or users to use these proprietary rights can be found in the IETF's online IPR repository at http://www.ietf.org/ipr 🌈.
The IETF invites anyone interested to bring to its attention any copyrights, patents, patent applications, or other proprietary rights that could cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org 💜.
Acknowledgement 🫶
Funding for the RFC Editor function is currently provided by the Internet Society 🎀✨
📦 where this page comes from
- ietf: rfc4739 2006-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms