RFC - 4739

Multiple Authentication Exchanges in the Internet Key Exchange (IKEv2) Protocol

Original:	ftp://ftp.isi.edu/in-notes/rfc4739.txt
Authors:	P. Eronen [Nokia], J. Korhonen [TeliaSonera]
Date:	November 2006
Category:	Experimental Standard

---

Referred by:	0 RFC
Refers to:	4 RFC

---

Status

This memo defines an Experimental Protocol for the Internet community. It does not specify an Internet standard of any kind. Discussion and suggestions for improvement are requested. Distribution of this memo is unlimited.

Copyright Notice

Copyright (C) The IETF Trust (2006).

Abstract

The Internet Key Exchange (IKEv2) protocol supports several mechanisms for authenticating the parties, including signatures with public-key certificates, shared secrets, and Extensible Authentication Protocol (EAP) methods. Currently, each endpoint uses only one of these mechanisms to authenticate itself. This document specifies an extension to IKEv2 that allows the use of multiple authentication exchanges, using either different mechanisms or the same mechanism. This extension allows, for instance, performing certificate-based authentication of the client host followed by an EAP authentication of the user. When backend authentication servers are used, they can belong to different administrative domains, such as the network access provider and the service provider.

---