denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

describe EAP-TTLS phase2 start options using the phase2_piggyback parameter

Browse Source
This commit is contained in:
Andreas Steffen
2010-08-16 19:29:39 +02:00
parent cf95e162f2
commit f9a2d4bfcb
2 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/rw-eap-ttls-only/description.txt
+7 -2
View File
@@ -2,5 +2,10 @@ The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gatewa
The strong mutual authentication is based on <b>EAP-TTLS</b> only (without a separate IKEv2
authentication) with the gateway being authenticated by a server certificate during the
EAP-TLS tunnel setup (phase1 of EAP-TTLS). This tunnel protects the ensuing weak client
authentication based on <b>EAP-MD5</b> (phase2 of EAP-TTLS). <b>carol</b> presents the
correct MD5 password and succeeds whereas <b>dave</b> chooses the wrong password and fails.
authentication based on <b>EAP-MD5</b> (phase2 of EAP-TTLS).
<p/>
With the default setting <b>charon.plugins.eap-ttls.phase2_piggyback = no</b> the server
<b>moon</b> passively waits for the clients to initiate phase2 of the EAP-TTLS protocol by
sending a tunneled orphan EAP Identity response upon the reception of the server's TLS
Finished message. Client <b>carol</b> presents the correct MD5 password and succeeds
whereas client <b>dave</b> chooses the wrong password and fails.
testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/description.txt
+6 -4
View File
@@ -2,7 +2,9 @@ The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gatewa
The strong mutual authentication is based on <b>EAP-TTLS</b> only (without a separate IKEv2
authentication) with the gateway being authenticated by a server certificate during the
EAP-TLS tunnel setup (phase1 of EAP-TTLS). This tunnel protects the ensuing weak client
authentication based on <b>EAP-MD5</b> (phase2 of EAP-TTLS). The server <b>moon</b>
piggybacks the tunneled EAP Identity request which starts phase2 of EAP-TTLS right onto
the TLS Finished message. <b>carol</b> presents the correct MD5 password and succeeds
whereas <b>dave</b> chooses the wrong password and fails.
authentication based on <b>EAP-MD5</b> (phase2 of EAP-TTLS).
<p/>
With the setting <b>charon.plugins.eap-ttls.phase2_piggyback = yes</b> the server <b>moon</b>
initiates phase2 of the EAP-TTLS protocol by piggybacking a tunneled EAP Identity request
right onto the TLS Finished message. Client <b>carol</b> presents the correct MD5 password
and succeeds whereas client <b>dave</b> chooses the wrong password and fails.