diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c
index 5156436f8..4494f23fd 100644
--- a/src/libcharon/encoding/message.c
+++ b/src/libcharon/encoding/message.c
@@ -1335,8 +1335,8 @@ static char* get_string(private_message_t *this, char *buf, int len)
 		if (payload->get_type(payload) == PLV2_EAP)
 		{
 			eap_payload_t *eap = (eap_payload_t*)payload;
-			uint32_t vendor;
 			eap_type_t type;
+			pen_t vendor;
 			char method[64] = "";
 
 			type = eap->get_type(eap, &vendor);
@@ -1344,7 +1344,8 @@ static char* get_string(private_message_t *this, char *buf, int len)
 			{
 				if (vendor)
 				{
-					snprintf(method, sizeof(method), "/%d-%d", type, vendor);
+					snprintf(method, sizeof(method), "/%d-%N", type,
+							 pen_short_names, vendor);
 				}
 				else
 				{
diff --git a/src/libcharon/encoding/payloads/eap_payload.c b/src/libcharon/encoding/payloads/eap_payload.c
index 3a64e8a85..57d510f8c 100644
--- a/src/libcharon/encoding/payloads/eap_payload.c
+++ b/src/libcharon/encoding/payloads/eap_payload.c
@@ -225,7 +225,7 @@ METHOD(eap_payload_t, get_identifier, uint8_t,
  * @return	the new offset or 0 if failed
  */
 static size_t extract_type(private_eap_payload_t *this, size_t offset,
-					       eap_type_t *type, uint32_t *vendor)
+					       eap_type_t *type, pen_t *vendor)
 {
 	if (this->data.len > offset)
 	{
@@ -246,7 +246,7 @@ static size_t extract_type(private_eap_payload_t *this, size_t offset,
 }
 
 METHOD(eap_payload_t, get_type, eap_type_t,
-	private_eap_payload_t *this, uint32_t *vendor)
+	private_eap_payload_t *this, pen_t *vendor)
 {
 	eap_type_t type;
 
@@ -274,7 +274,7 @@ METHOD(enumerator_t, enumerate_types, bool,
 	type_enumerator_t *this, va_list args)
 {
 	eap_type_t *type;
-	uint32_t *vendor;
+	pen_t *vendor;
 
 	VA_ARGS_VGET(args, type, vendor);
 	this->offset = extract_type(this->payload, this->offset, type, vendor);
@@ -286,7 +286,7 @@ METHOD(eap_payload_t, get_types, enumerator_t*,
 {
 	type_enumerator_t *enumerator;
 	eap_type_t type;
-	uint32_t vendor;
+	pen_t vendor;
 	size_t offset;
 
 	offset = extract_type(this, 4, &type, &vendor);
@@ -391,7 +391,7 @@ eap_payload_t *eap_payload_create_code(eap_code_t code, uint8_t identifier)
 /**
  * Write the given type either expanded or not
  */
-static void write_type(bio_writer_t *writer, eap_type_t type, uint32_t vendor,
+static void write_type(bio_writer_t *writer, eap_type_t type, pen_t vendor,
 					   bool expanded)
 {
 	if (expanded)
@@ -410,11 +410,11 @@ static void write_type(bio_writer_t *writer, eap_type_t type, uint32_t vendor,
  * Described in header
  */
 eap_payload_t *eap_payload_create_nak(uint8_t identifier, eap_type_t type,
-									  uint32_t vendor, bool expanded)
+									  pen_t vendor, bool expanded)
 {
 	enumerator_t *enumerator;
 	eap_type_t reg_type;
-	uint32_t reg_vendor;
+	pen_t reg_vendor;
 	bio_writer_t *writer;
 	chunk_t data;
 	bool added_any = FALSE, found_vendor = FALSE;
diff --git a/src/libcharon/encoding/payloads/eap_payload.h b/src/libcharon/encoding/payloads/eap_payload.h
index 69925a9a9..8c5188548 100644
--- a/src/libcharon/encoding/payloads/eap_payload.h
+++ b/src/libcharon/encoding/payloads/eap_payload.h
@@ -81,13 +81,13 @@ struct eap_payload_t {
 	 * @param vendor	pointer receiving vendor identifier
 	 * @return			EAP method type, vendor specific if vendor != 0
 	 */
-	eap_type_t (*get_type) (eap_payload_t *this, uint32_t *vendor);
+	eap_type_t (*get_type) (eap_payload_t *this, pen_t *vendor);
 
 	/**
 	 * Enumerate the EAP method types contained in an EAP-Nak (i.e. get_type()
 	 * returns EAP_NAK).
 	 *
-	 * @return			enumerator over (eap_type_t type, uint32_t vendor)
+	 * @return			enumerator over (eap_type_t type, pen_t vendor)
 	 */
 	enumerator_t* (*get_types) (eap_payload_t *this);
 
@@ -149,6 +149,6 @@ eap_payload_t *eap_payload_create_code(eap_code_t code, uint8_t identifier);
  * @return 				eap_payload_t object
  */
 eap_payload_t *eap_payload_create_nak(uint8_t identifier, eap_type_t type,
-									  uint32_t vendor, bool expanded);
+									  pen_t vendor, bool expanded);
 
 #endif /** EAP_PAYLOAD_H_ @}*/
diff --git a/src/libcharon/plugins/eap_aka/eap_aka_peer.c b/src/libcharon/plugins/eap_aka/eap_aka_peer.c
index 8cd217d7c..3bdbafc5d 100644
--- a/src/libcharon/plugins/eap_aka/eap_aka_peer.c
+++ b/src/libcharon/plugins/eap_aka/eap_aka_peer.c
@@ -595,7 +595,7 @@ METHOD(eap_method_t, initiate, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_aka_peer_t *this, uint32_t *vendor)
+	private_eap_aka_peer_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return EAP_AKA;
diff --git a/src/libcharon/plugins/eap_aka/eap_aka_server.c b/src/libcharon/plugins/eap_aka/eap_aka_server.c
index 21d0fb2f7..0712ccc20 100644
--- a/src/libcharon/plugins/eap_aka/eap_aka_server.c
+++ b/src/libcharon/plugins/eap_aka/eap_aka_server.c
@@ -638,7 +638,7 @@ METHOD(eap_method_t, process, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_aka_server_t *this, uint32_t *vendor)
+	private_eap_aka_server_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return EAP_AKA;
diff --git a/src/libcharon/plugins/eap_dynamic/eap_dynamic.c b/src/libcharon/plugins/eap_dynamic/eap_dynamic.c
index 4edc1c16e..5ecb187f7 100644
--- a/src/libcharon/plugins/eap_dynamic/eap_dynamic.c
+++ b/src/libcharon/plugins/eap_dynamic/eap_dynamic.c
@@ -83,7 +83,7 @@ CALLBACK(entry_matches_cb, bool,
  * Load the given EAP method
  */
 static eap_method_t *load_method(private_eap_dynamic_t *this,
-								 eap_type_t type, uint32_t vendor)
+								 eap_type_t type, pen_t vendor)
 {
 	eap_method_t *method;
 
@@ -93,8 +93,8 @@ static eap_method_t *load_method(private_eap_dynamic_t *this,
 	{
 		if (vendor)
 		{
-			DBG1(DBG_IKE, "loading vendor specific EAP method %d-%d failed",
-				 type, vendor);
+			DBG1(DBG_IKE, "loading vendor specific EAP method %d-%N failed",
+				 type, pen_names, vendor);
 		}
 		else
 		{
@@ -135,9 +135,9 @@ static void select_method(private_eap_dynamic_t *this)
 			{
 				if (entry->vendor)
 				{
-					DBG2(DBG_IKE, "proposed vendor specific EAP method %d-%d "
+					DBG2(DBG_IKE, "proposed vendor specific EAP method %d-%N "
 						 "not supported by %s, skipped", entry->type,
-						  entry->vendor, who);
+						  pen_names, entry->vendor, who);
 				}
 				else
 				{
@@ -157,8 +157,8 @@ static void select_method(private_eap_dynamic_t *this)
 			}
 			if (entry->vendor)
 			{
-				DBG1(DBG_IKE, "vendor specific EAP method %d-%d selected",
-					 entry->type, entry->vendor);
+				DBG1(DBG_IKE, "vendor specific EAP method %d-%N selected",
+					 entry->type, pen_names, entry->vendor);
 			}
 			else
 			{
@@ -191,7 +191,7 @@ METHOD(eap_method_t, process, status_t,
 	private_eap_dynamic_t *this, eap_payload_t *in, eap_payload_t **out)
 {
 	eap_type_t received_type, type;
-	uint32_t received_vendor, vendor;
+	pen_t received_vendor, vendor;
 
 	received_type = in->get_type(in, &received_vendor);
 	if (received_vendor == 0 && received_type == EAP_NAK)
@@ -246,7 +246,7 @@ METHOD(eap_method_t, process, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_dynamic_t *this, uint32_t *vendor)
+	private_eap_dynamic_t *this, pen_t *vendor)
 {
 	if (this->method)
 	{
@@ -356,7 +356,7 @@ static void get_supported_eap_types(private_eap_dynamic_t *this)
 {
 	enumerator_t *enumerator;
 	eap_type_t type;
-	uint32_t vendor;
+	pen_t vendor;
 
 	enumerator = charon->eap->create_enumerator(charon->eap, EAP_SERVER);
 	while (enumerator->enumerate(enumerator, &type, &vendor))
diff --git a/src/libcharon/plugins/eap_gtc/eap_gtc.c b/src/libcharon/plugins/eap_gtc/eap_gtc.c
index cc6556494..043fea8d9 100644
--- a/src/libcharon/plugins/eap_gtc/eap_gtc.c
+++ b/src/libcharon/plugins/eap_gtc/eap_gtc.c
@@ -186,7 +186,7 @@ METHOD(eap_method_t, process_server, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_gtc_t *this, uint32_t *vendor)
+	private_eap_gtc_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return EAP_GTC;
diff --git a/src/libcharon/plugins/eap_identity/eap_identity.c b/src/libcharon/plugins/eap_identity/eap_identity.c
index 55c702666..1b8422b7c 100644
--- a/src/libcharon/plugins/eap_identity/eap_identity.c
+++ b/src/libcharon/plugins/eap_identity/eap_identity.c
@@ -125,7 +125,7 @@ METHOD(eap_method_t, initiate_server, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_identity_t *this, uint32_t *vendor)
+	private_eap_identity_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return EAP_IDENTITY;
diff --git a/src/libcharon/plugins/eap_md5/eap_md5.c b/src/libcharon/plugins/eap_md5/eap_md5.c
index 2d3e3c29f..7b0b15772 100644
--- a/src/libcharon/plugins/eap_md5/eap_md5.c
+++ b/src/libcharon/plugins/eap_md5/eap_md5.c
@@ -205,7 +205,7 @@ METHOD(eap_method_t, process_server, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_md5_t *this, uint32_t *vendor)
+	private_eap_md5_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return EAP_MD5;
diff --git a/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c b/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c
index 4e3b05da9..2e14bd900 100644
--- a/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c
+++ b/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c
@@ -1316,7 +1316,7 @@ METHOD(eap_method_t, process_server, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_mschapv2_t *this, uint32_t *vendor)
+	private_eap_mschapv2_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return EAP_MSCHAPV2;
diff --git a/src/libcharon/plugins/eap_peap/eap_peap.c b/src/libcharon/plugins/eap_peap/eap_peap.c
index 4ad1e0cdc..577d74786 100644
--- a/src/libcharon/plugins/eap_peap/eap_peap.c
+++ b/src/libcharon/plugins/eap_peap/eap_peap.c
@@ -78,7 +78,7 @@ METHOD(eap_method_t, process, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_peap_t *this, uint32_t *vendor)
+	private_eap_peap_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return EAP_PEAP;
diff --git a/src/libcharon/plugins/eap_peap/eap_peap_peer.c b/src/libcharon/plugins/eap_peap/eap_peap_peer.c
index aef492f16..eed40c0a7 100644
--- a/src/libcharon/plugins/eap_peap/eap_peap_peer.c
+++ b/src/libcharon/plugins/eap_peap/eap_peap_peer.c
@@ -72,7 +72,7 @@ METHOD(tls_application_t, process, status_t,
 	eap_payload_t *in;
 	eap_code_t code;
 	eap_type_t type, received_type;
-	uint32_t vendor, received_vendor;
+	pen_t vendor, received_vendor;
 
 	status = this->avp->process(this->avp, reader, &data,
 							this->ph1_method->get_identifier(this->ph1_method));
@@ -137,8 +137,8 @@ METHOD(tls_application_t, process, status_t,
 	{
 		if (received_vendor)
 		{
-			DBG1(DBG_IKE, "server requested vendor specific EAP method %d-%d "
-						  "(id 0x%02X", received_type, received_vendor,
+			DBG1(DBG_IKE, "server requested vendor specific EAP method %d-%N "
+						  "(id 0x%02X)", received_type, pen_names, received_vendor,
 						   in->get_identifier(in));
 		}
 		else
@@ -175,8 +175,8 @@ METHOD(tls_application_t, process, status_t,
 		default:
 			if (vendor)
 			{
-				DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed",
-							   type, vendor);
+				DBG1(DBG_IKE, "vendor specific EAP method %d-%N failed",
+							   type, pen_names, vendor);
 			}
 			else
 			{
@@ -192,7 +192,7 @@ METHOD(tls_application_t, build, status_t,
 	chunk_t data;
 	eap_code_t code;
 	eap_type_t type;
-	uint32_t vendor;
+	pen_t vendor;
 
 	if (this->out)
 	{
diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.c b/src/libcharon/plugins/eap_peap/eap_peap_server.c
index 691a05b89..c5d97a16a 100644
--- a/src/libcharon/plugins/eap_peap/eap_peap_server.c
+++ b/src/libcharon/plugins/eap_peap/eap_peap_server.c
@@ -168,7 +168,7 @@ METHOD(tls_application_t, process, status_t,
 	eap_payload_t *in;
 	eap_code_t code;
 	eap_type_t type = EAP_NAK, received_type;
-	uint32_t vendor, received_vendor;
+	pen_t vendor, received_vendor;
 
 	status = this->avp->process(this->avp, reader, &data,
 							this->ph1_method->get_identifier(this->ph1_method));
@@ -317,8 +317,8 @@ METHOD(tls_application_t, process, status_t,
 		default:
 			if (vendor)
 			{
-				DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed",
-							   type, vendor);
+				DBG1(DBG_IKE, "vendor specific EAP method %d-%N failed",
+							   type, pen_names, vendor);
 			}
 			else
 			{
@@ -339,7 +339,7 @@ METHOD(tls_application_t, build, status_t,
 	chunk_t data;
 	eap_code_t code;
 	eap_type_t type;
-	uint32_t vendor;
+	pen_t vendor;
 
 	if (this->ph2_method == NULL && this->start_phase2 && this->start_phase2_id)
 	{
diff --git a/src/libcharon/plugins/eap_radius/eap_radius.c b/src/libcharon/plugins/eap_radius/eap_radius.c
index c305375e5..ad7f59581 100644
--- a/src/libcharon/plugins/eap_radius/eap_radius.c
+++ b/src/libcharon/plugins/eap_radius/eap_radius.c
@@ -57,7 +57,7 @@ struct private_eap_radius_t {
 	/**
 	 * EAP vendor, if any
 	 */
-	uint32_t vendor;
+	pen_t vendor;
 
 	/**
 	 * EAP message identifier
@@ -717,7 +717,7 @@ METHOD(eap_method_t, process, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_radius_t *this, uint32_t *vendor)
+	private_eap_radius_t *this, pen_t *vendor)
 {
 	*vendor = this->vendor;
 	return this->type;
diff --git a/src/libcharon/plugins/eap_sim/eap_sim_peer.c b/src/libcharon/plugins/eap_sim/eap_sim_peer.c
index caed69a45..83041b9ea 100644
--- a/src/libcharon/plugins/eap_sim/eap_sim_peer.c
+++ b/src/libcharon/plugins/eap_sim/eap_sim_peer.c
@@ -651,7 +651,7 @@ METHOD(eap_method_t, initiate, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_sim_peer_t *this, uint32_t *vendor)
+	private_eap_sim_peer_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return EAP_SIM;
diff --git a/src/libcharon/plugins/eap_sim/eap_sim_server.c b/src/libcharon/plugins/eap_sim/eap_sim_server.c
index b1fc0b75d..82004bd2b 100644
--- a/src/libcharon/plugins/eap_sim/eap_sim_server.c
+++ b/src/libcharon/plugins/eap_sim/eap_sim_server.c
@@ -552,7 +552,7 @@ METHOD(eap_method_t, process, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_sim_server_t *this, uint32_t *vendor)
+	private_eap_sim_server_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return EAP_SIM;
diff --git a/src/libcharon/plugins/eap_tls/eap_tls.c b/src/libcharon/plugins/eap_tls/eap_tls.c
index d301244e5..3d34d7a84 100644
--- a/src/libcharon/plugins/eap_tls/eap_tls.c
+++ b/src/libcharon/plugins/eap_tls/eap_tls.c
@@ -75,7 +75,7 @@ METHOD(eap_method_t, process, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_tls_t *this, uint32_t *vendor)
+	private_eap_tls_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return EAP_TLS;
diff --git a/src/libcharon/plugins/eap_tnc/eap_tnc.c b/src/libcharon/plugins/eap_tnc/eap_tnc.c
index 2faafb01d..b8dae2e55 100644
--- a/src/libcharon/plugins/eap_tnc/eap_tnc.c
+++ b/src/libcharon/plugins/eap_tnc/eap_tnc.c
@@ -181,7 +181,7 @@ METHOD(eap_method_t, process, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_tnc_t *this, uint32_t *vendor)
+	private_eap_tnc_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return this->type;
diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls.c b/src/libcharon/plugins/eap_ttls/eap_ttls.c
index ea0b8d471..d8ad781f0 100644
--- a/src/libcharon/plugins/eap_ttls/eap_ttls.c
+++ b/src/libcharon/plugins/eap_ttls/eap_ttls.c
@@ -78,7 +78,7 @@ METHOD(eap_method_t, process, status_t,
 }
 
 METHOD(eap_method_t, get_type, eap_type_t,
-	private_eap_ttls_t *this, uint32_t *vendor)
+	private_eap_ttls_t *this, pen_t *vendor)
 {
 	*vendor = 0;
 	return EAP_TTLS;
diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
index 9e2153fe0..4c8d33804 100644
--- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
+++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
@@ -76,7 +76,7 @@ METHOD(tls_application_t, process, status_t,
 	eap_packet_t *pkt;
 	eap_code_t code;
 	eap_type_t type, received_type;
-	uint32_t vendor, received_vendor;
+	pen_t vendor, received_vendor;
 	uint16_t eap_len;
 	size_t eap_pos = 0;
 	bool concatenated = FALSE;
@@ -185,8 +185,8 @@ METHOD(tls_application_t, process, status_t,
 	{
 		if (received_vendor)
 		{
-			DBG1(DBG_IKE, "server requested vendor specific EAP method %d-%d "
-						  "(id 0x%02X)", received_type, received_vendor,
+			DBG1(DBG_IKE, "server requested vendor specific EAP method %d-%N "
+						  "(id 0x%02X)", received_type, pen_names, received_vendor,
 						   in->get_identifier(in));
 		}
 		else
@@ -224,8 +224,8 @@ METHOD(tls_application_t, process, status_t,
 		default:
 			if (vendor)
 			{
-				DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed",
-							   type, vendor);
+				DBG1(DBG_IKE, "vendor specific EAP method %d-%N failed",
+							   type, pen_names, vendor);
 			}
 			else
 			{
@@ -241,7 +241,7 @@ METHOD(tls_application_t, build, status_t,
 	chunk_t data;
 	eap_code_t code;
 	eap_type_t type;
-	uint32_t vendor;
+	pen_t vendor;
 
 	if (this->method == NULL && this->start_phase2)
 	{
diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c
index a128246f2..d7279ce8c 100644
--- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c
+++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c
@@ -164,7 +164,7 @@ METHOD(tls_application_t, process, status_t,
 	eap_payload_t *in;
 	eap_code_t code;
 	eap_type_t type = EAP_NAK, received_type;
-	uint32_t vendor, received_vendor;
+	pen_t vendor, received_vendor;
 
 	status = this->avp->process(this->avp, reader, &data);
 	switch (status)
@@ -292,8 +292,8 @@ METHOD(tls_application_t, process, status_t,
 		default:
 			if (vendor)
 			{
-				DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed",
-							   type, vendor);
+				DBG1(DBG_IKE, "vendor specific EAP method %d-%N failed",
+							   type, pen_names, vendor);
 			}
 			else
 			{
@@ -310,7 +310,7 @@ METHOD(tls_application_t, build, status_t,
 	chunk_t data;
 	eap_code_t code;
 	eap_type_t type;
-	uint32_t vendor;
+	pen_t vendor;
 
 	if (this->method == NULL && this->start_phase2 &&
 		lib->settings->get_bool(lib->settings,
diff --git a/src/libcharon/plugins/tnc_pdp/tnc_pdp.c b/src/libcharon/plugins/tnc_pdp/tnc_pdp.c
index 941afce34..d3a6211be 100644
--- a/src/libcharon/plugins/tnc_pdp/tnc_pdp.c
+++ b/src/libcharon/plugins/tnc_pdp/tnc_pdp.c
@@ -478,7 +478,7 @@ static void process_eap(private_tnc_pdp_t *this, radius_message_t *request,
 	eap_payload_t *in, *out = NULL;
 	eap_method_t *method;
 	eap_type_t eap_type;
-	uint32_t eap_vendor;
+	pen_t eap_vendor;
 	chunk_t data, message = chunk_empty, msk = chunk_empty;
 	chunk_t user_name = chunk_empty, nas_id = chunk_empty;
 	identification_t *group = NULL;
diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index ab382eca5..0c061d4b2 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -370,7 +370,7 @@ static void log_auth(auth_cfg_t *auth)
 				DBG2(DBG_CFG, "   eap-type = %N", eap_type_names, v.u);
 				break;
 			case AUTH_RULE_EAP_VENDOR:
-				DBG2(DBG_CFG, "   eap-vendor = %u", v.u);
+				DBG2(DBG_CFG, "   eap-vendor = %N", pen_names, v.u);
 				break;
 			case AUTH_RULE_XAUTH_BACKEND:
 				DBG2(DBG_CFG, "   xauth = %s", v.str);
diff --git a/src/libcharon/plugins/xauth_eap/xauth_eap.c b/src/libcharon/plugins/xauth_eap/xauth_eap.c
index c1225e964..1e7e0cc53 100644
--- a/src/libcharon/plugins/xauth_eap/xauth_eap.c
+++ b/src/libcharon/plugins/xauth_eap/xauth_eap.c
@@ -114,7 +114,7 @@ static bool verify_eap(private_xauth_eap_t *this, eap_method_t *backend)
 	eap_payload_t *request, *response;
 	eap_method_t *frontend;
 	eap_type_t type;
-	uint32_t vendor;
+	pen_t vendor;
 	status_t status;
 
 	if (backend->initiate(backend, &request) != NEED_MORE)
diff --git a/src/libcharon/sa/eap/eap_manager.c b/src/libcharon/sa/eap/eap_manager.c
index 4c85b88c1..35795d59f 100644
--- a/src/libcharon/sa/eap/eap_manager.c
+++ b/src/libcharon/sa/eap/eap_manager.c
@@ -36,7 +36,7 @@ struct eap_entry_t {
 	/**
 	 * vendor ID, 0 for default EAP methods
 	 */
-	uint32_t vendor;
+	pen_t vendor;
 
 	/**
 	 * Role of the method returned by the constructor, EAP_SERVER or EAP_PEER
@@ -71,7 +71,7 @@ struct private_eap_manager_t {
 };
 
 METHOD(eap_manager_t, add_method, void,
-	private_eap_manager_t *this, eap_type_t type, uint32_t vendor,
+	private_eap_manager_t *this, eap_type_t type, pen_t vendor,
 	eap_role_t role, eap_constructor_t constructor)
 {
 	eap_entry_t *entry = malloc_thing(eap_entry_t);
@@ -111,7 +111,7 @@ CALLBACK(filter_methods, bool,
 {
 	eap_entry_t *entry;
 	eap_type_t *type;
-	uint32_t *vendor;
+	pen_t *vendor;
 
 	VA_ARGS_VGET(args, type, vendor);
 
@@ -152,7 +152,7 @@ METHOD(eap_manager_t, create_enumerator, enumerator_t*,
 }
 
 METHOD(eap_manager_t, create_instance, eap_method_t*,
-	private_eap_manager_t *this, eap_type_t type, uint32_t vendor,
+	private_eap_manager_t *this, eap_type_t type, pen_t vendor,
 	eap_role_t role, identification_t *server, identification_t *peer)
 {
 	enumerator_t *enumerator;
diff --git a/src/libcharon/sa/eap/eap_manager.h b/src/libcharon/sa/eap/eap_manager.h
index 29985a7d6..ca5835210 100644
--- a/src/libcharon/sa/eap/eap_manager.h
+++ b/src/libcharon/sa/eap/eap_manager.h
@@ -45,7 +45,7 @@ struct eap_manager_t {
 	 * @param role			EAP role of the registered method
 	 * @param constructor	constructor function, returns an eap_method_t
 	 */
-	void (*add_method)(eap_manager_t *this, eap_type_t type, uint32_t vendor,
+	void (*add_method)(eap_manager_t *this, eap_type_t type, pen_t vendor,
 					   eap_role_t role, eap_constructor_t constructor);
 
 	/**
@@ -62,7 +62,7 @@ struct eap_manager_t {
 	 * even though it is registered as method with this manager).
 	 *
 	 * @param role			EAP role of methods to enumerate
-	 * @return				enumerator over (eap_type_t type, uint32_t vendor)
+	 * @return				enumerator over (eap_type_t type, pen_t vendor)
 	 */
 	enumerator_t* (*create_enumerator)(eap_manager_t *this, eap_role_t role);
 
@@ -77,7 +77,7 @@ struct eap_manager_t {
 	 * @return				EAP method instance, NULL if no constructor found
 	 */
 	eap_method_t* (*create_instance)(eap_manager_t *this, eap_type_t type,
-									 uint32_t vendor, eap_role_t role,
+									 pen_t vendor, eap_role_t role,
 									 identification_t *server,
 									 identification_t *peer);
 
diff --git a/src/libcharon/sa/eap/eap_method.h b/src/libcharon/sa/eap/eap_method.h
index b1fea9369..b28c5cbb3 100644
--- a/src/libcharon/sa/eap/eap_method.h
+++ b/src/libcharon/sa/eap/eap_method.h
@@ -97,7 +97,7 @@ struct eap_method_t {
 	 * @param vendor	pointer receiving vendor identifier for type, 0 for none
 	 * @return			type of the EAP method
 	 */
-	eap_type_t (*get_type) (eap_method_t *this, uint32_t *vendor);
+	eap_type_t (*get_type) (eap_method_t *this, pen_t *vendor);
 
 	/**
 	 * Check if this EAP method authenticates the server.
diff --git a/src/libcharon/sa/ikev2/authenticators/eap_authenticator.c b/src/libcharon/sa/ikev2/authenticators/eap_authenticator.c
index 23930872b..976ed623d 100644
--- a/src/libcharon/sa/ikev2/authenticators/eap_authenticator.c
+++ b/src/libcharon/sa/ikev2/authenticators/eap_authenticator.c
@@ -115,7 +115,7 @@ struct private_eap_authenticator_t {
  * load an EAP method
  */
 static eap_method_t *load_method(private_eap_authenticator_t *this,
-							eap_type_t type, uint32_t vendor, eap_role_t role)
+							eap_type_t type, pen_t vendor, eap_role_t role)
 {
 	identification_t *server, *peer, *aaa;
 	auth_cfg_t *auth;
@@ -154,7 +154,7 @@ static eap_payload_t* server_initiate_eap(private_eap_authenticator_t *this,
 	auth_cfg_t *auth;
 	eap_type_t type;
 	identification_t *id;
-	uint32_t vendor;
+	pen_t vendor;
 	eap_payload_t *out;
 	char *action;
 
@@ -203,8 +203,8 @@ static eap_payload_t* server_initiate_eap(private_eap_authenticator_t *this,
 			type = this->method->get_type(this->method, &vendor);
 			if (vendor)
 			{
-				DBG1(DBG_IKE, "initiating EAP vendor type %d-%d method (id 0x%02X)",
-					 type, vendor, out->get_identifier(out));
+				DBG1(DBG_IKE, "initiating EAP vendor type %d-%N method (id 0x%02X)",
+					 type, pen_names, vendor, out->get_identifier(out));
 			}
 			else
 			{
@@ -218,8 +218,8 @@ static eap_payload_t* server_initiate_eap(private_eap_authenticator_t *this,
 	}
 	if (vendor)
 	{
-		DBG1(DBG_IKE, "%s EAP vendor type %d-%d method failed",
-					  action, type,	vendor);
+		DBG1(DBG_IKE, "%s EAP vendor type %d-%N method failed",
+					  action, type,	pen_names, vendor);
 	}
 	else
 	{
@@ -248,7 +248,7 @@ static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
 										 eap_payload_t *in)
 {
 	eap_type_t type, received_type, conf_type;
-	uint32_t vendor, received_vendor, conf_vendor;
+	pen_t vendor, received_vendor, conf_vendor;
 	eap_payload_t *out;
 	auth_cfg_t *auth;
 
@@ -320,8 +320,8 @@ static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
 			}
 			if (vendor)
 			{
-				DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeeded, "
-					 "%sMSK established", type, vendor,
+				DBG1(DBG_IKE, "EAP vendor specific method %d-%N succeeded, "
+					 "%sMSK established", type, pen_names, vendor,
 					 this->msk.ptr ? "" : "no ");
 			}
 			else
@@ -340,8 +340,8 @@ failure:
 			type = this->method->get_type(this->method, &vendor);
 			if (vendor)
 			{
-				DBG1(DBG_IKE, "EAP vendor specific method %d-%d failed for "
-					 "peer %Y", type, vendor,
+				DBG1(DBG_IKE, "EAP vendor specific method %d-%N failed for "
+					 "peer %Y", type, pen_names, vendor,
 					 this->ike_sa->get_other_id(this->ike_sa));
 			}
 			else
@@ -361,7 +361,7 @@ static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
 										 eap_payload_t *in)
 {
 	eap_type_t type, conf_type;
-	uint32_t vendor, conf_vendor;
+	pen_t vendor, conf_vendor;
 	auth_cfg_t *auth;
 	eap_payload_t *out;
 	identification_t *id;
@@ -403,8 +403,8 @@ static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
 	{
 		if (vendor)
 		{
-			DBG1(DBG_IKE, "server requested vendor specific EAP method %d-%d ",
-						  "(id 0x%02X)", type, vendor, in->get_identifier(in));
+			DBG1(DBG_IKE, "server requested vendor specific EAP method %d-%N ",
+				 "(id 0x%02X)", type, pen_names, vendor, in->get_identifier(in));
 		}
 		else
 		{
@@ -419,8 +419,8 @@ static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
 		{
 			if (conf_vendor)
 			{
-				DBG1(DBG_IKE, "requesting EAP method %d-%d, sending EAP_NAK",
-					 conf_type, conf_vendor);
+				DBG1(DBG_IKE, "requesting EAP method %d-%N, sending EAP_NAK",
+					 conf_type, pen_names, conf_vendor);
 			}
 			else
 			{
@@ -448,7 +448,8 @@ static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
 
 	if (vendor)
 	{
-		DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed", type, vendor);
+		DBG1(DBG_IKE, "vendor specific EAP method %d-%N failed", type,
+			 pen_names, vendor);
 	}
 	else
 	{
@@ -470,7 +471,7 @@ static bool verify_auth(private_eap_authenticator_t *this, message_t *message,
 	auth_cfg_t *auth;
 	keymat_v2_t *keymat;
 	eap_type_t type;
-	uint32_t vendor;
+	pen_t vendor;
 
 	auth_payload = (auth_payload_t*)message->get_payload(message,
 														 PLV2_AUTH);
@@ -640,7 +641,7 @@ METHOD(authenticator_t, process_client, status_t,
 		}
 		if (this->require_mutual && !this->method->is_mutual(this->method))
 		{	/* we require mutual authentication due to EAP-only */
-			uint32_t vendor;
+			pen_t vendor;
 
 			DBG1(DBG_IKE, "EAP-only authentication requires a mutual and "
 				 "MSK deriving EAP method, but %N is not",
@@ -668,7 +669,7 @@ METHOD(authenticator_t, process_client, status_t,
 			case EAP_SUCCESS:
 			{
 				eap_type_t type;
-				uint32_t vendor;
+				pen_t vendor;
 				auth_cfg_t *cfg;
 
 				if (!this->method)
@@ -693,8 +694,8 @@ METHOD(authenticator_t, process_client, status_t,
 				type = this->method->get_type(this->method, &vendor);
 				if (vendor)
 				{
-					DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeeded, "
-						 "%sMSK established", type, vendor,
+					DBG1(DBG_IKE, "EAP vendor specific method %d-%N succeeded, "
+						 "%sMSK established", type, pen_names, vendor,
 						 this->msk.ptr ? "" : "no ");
 				}
 				else
@@ -745,7 +746,7 @@ METHOD(authenticator_t, is_mutual, bool,
 {
 	if (this->method)
 	{
-		uint32_t vendor;
+		pen_t vendor;
 
 		if (this->method->get_type(this->method, &vendor) != EAP_IDENTITY ||
 			vendor != 0)
diff --git a/src/libstrongswan/eap/eap.c b/src/libstrongswan/eap/eap.c
index 08b17bdf0..cbdf9b68d 100644
--- a/src/libstrongswan/eap/eap.c
+++ b/src/libstrongswan/eap/eap.c
@@ -142,7 +142,7 @@ eap_vendor_type_t *eap_vendor_type_from_string(char *str)
 	enumerator_t *enumerator;
 	eap_vendor_type_t *result = NULL;
 	eap_type_t type = 0;
-	uint32_t vendor = 0;
+	pen_t vendor = 0;
 	char *part, *end;
 
 	/* parse EAP method string of the form: [eap-]type[-vendor] */
@@ -170,7 +170,7 @@ eap_vendor_type_t *eap_vendor_type_from_string(char *str)
 		}
 		errno = 0;
 		vendor = strtoul(part, &end, 0);
-		if (*end != '\0' || errno)
+		if (*end != '\0' || errno || vendor >= PEN_UNASSIGNED)
 		{
 			DBG1(DBG_LIB, "invalid EAP vendor: %s", part);
 			type = 0;
diff --git a/src/libstrongswan/eap/eap.h b/src/libstrongswan/eap/eap.h
index 0907d1ea8..f836a462f 100644
--- a/src/libstrongswan/eap/eap.h
+++ b/src/libstrongswan/eap/eap.h
@@ -28,6 +28,7 @@ typedef enum eap_type_t eap_type_t;
 typedef struct eap_vendor_type_t eap_vendor_type_t;
 
 #include <library.h>
+#include <pen/pen.h>
 
 /**
  * EAP code, type of an EAP message
@@ -74,6 +75,8 @@ enum eap_type_t {
 	EAP_RADIUS = 256,
 	/** not a method, select method dynamically based on client selection */
 	EAP_DYNAMIC = 257,
+	/** make sure the enum is large enough to hold vendor-specific types */
+	EAP_UNASSIGNED = 0xffffffff,
 };
 
 /**
@@ -99,7 +102,7 @@ struct eap_vendor_type_t {
 	/**
 	 * Vendor Id
 	 */
-	uint32_t vendor;
+	pen_t vendor;
 };
 
 /**
diff --git a/src/libstrongswan/pen/pen.c b/src/libstrongswan/pen/pen.c
index d6f12ddd9..f9c524103 100644
--- a/src/libstrongswan/pen/pen.c
+++ b/src/libstrongswan/pen/pen.c
@@ -50,3 +50,38 @@ ENUM_NEXT(pen_names, PEN_UNASSIGNED, PEN_RESERVED, PEN_OPENPTS,
 	"Unassigned",
 	"Reserved");
 ENUM_END(pen_names, PEN_RESERVED);
+
+ENUM_BEGIN(pen_short_names, PEN_IETF, PEN_IETF,
+	"IETF");
+ENUM_NEXT(pen_short_names, PEN_IBM, PEN_IBM, PEN_IETF,
+	"IBM");
+ENUM_NEXT(pen_short_names, PEN_MICROSOFT, PEN_MICROSOFT, PEN_IBM,
+	"MS");
+ENUM_NEXT(pen_short_names, PEN_REDHAT, PEN_REDHAT, PEN_MICROSOFT,
+	"RH");
+ENUM_NEXT(pen_short_names, PEN_PWG, PEN_PWG, PEN_REDHAT,
+	"PWG");
+ENUM_NEXT(pen_short_names, PEN_ALTIGA, PEN_ALTIGA, PEN_PWG,
+	"ALT");
+ENUM_NEXT(pen_short_names, PEN_OSC, PEN_OSC, PEN_ALTIGA,
+	"OSC");
+ENUM_NEXT(pen_short_names, PEN_DEBIAN, PEN_DEBIAN, PEN_OSC,
+	"DEB");
+ENUM_NEXT(pen_short_names, PEN_GOOGLE, PEN_GOOGLE, PEN_DEBIAN,
+	"GOO");
+ENUM_NEXT(pen_short_names, PEN_TCG, PEN_TCG, PEN_GOOGLE,
+	"TCG");
+ENUM_NEXT(pen_short_names, PEN_CANONICAL, PEN_CANONICAL, PEN_TCG,
+	"CAN");
+ENUM_NEXT(pen_short_names, PEN_FEDORA, PEN_FEDORA, PEN_CANONICAL,
+	"FED");
+ENUM_NEXT(pen_short_names, PEN_FHH, PEN_FHH, PEN_FEDORA,
+	"FHH");
+ENUM_NEXT(pen_short_names, PEN_ITA, PEN_ITA, PEN_FHH,
+	"ITA");
+ENUM_NEXT(pen_short_names, PEN_OPENPTS, PEN_OPENPTS, PEN_ITA,
+	"PTS");
+ENUM_NEXT(pen_short_names, PEN_UNASSIGNED, PEN_RESERVED, PEN_OPENPTS,
+	"UNAS",
+	"RES");
+ENUM_END(pen_short_names, PEN_RESERVED);
diff --git a/src/libstrongswan/pen/pen.h b/src/libstrongswan/pen/pen.h
index 6b409669a..23b3212af 100644
--- a/src/libstrongswan/pen/pen.h
+++ b/src/libstrongswan/pen/pen.h
@@ -107,4 +107,9 @@ static inline bool pen_type_is(pen_type_t pen_type,
  */
 extern enum_name_t *pen_names;
 
+/**
+ * short enum names for pen_t.
+ */
+extern enum_name_t *pen_short_names;
+
 #endif /** PEN_H_ @}*/
diff --git a/src/libstrongswan/plugins/plugin_feature.c b/src/libstrongswan/plugins/plugin_feature.c
index 075230ab0..96bbb9a89 100644
--- a/src/libstrongswan/plugins/plugin_feature.c
+++ b/src/libstrongswan/plugins/plugin_feature.c
@@ -412,8 +412,8 @@ char* plugin_feature_get_string(plugin_feature_t *feature)
 		case FEATURE_EAP_SERVER:
 		case FEATURE_EAP_PEER:
 			if (feature->arg.eap.vendor &&
-				asprintf(&str, "%N:%d-%d", plugin_feature_names, feature->type,
-					feature->arg.eap.type, feature->arg.eap.vendor) > 0)
+				asprintf(&str, "%N:%d-%N", plugin_feature_names, feature->type,
+					feature->arg.eap.type, pen_names, feature->arg.eap.vendor) > 0)
 			{
 				return str;
 			}