eap Mailing List: Re: What about PSK with TLS and IKEv2?

[T. Charles Clancy (clancy]

> The RFC 2246 defines resumed handshake so that the session can be
> resumed if it is still in the memory (cache). One TLS-PSK contribution
> requires to copy the session to the disk instead of the cache.

True, but the TLS resume still requires 2 round trips, and as much
computation as a full reauthentication.  In the PSK case, I don't think
the TLS resume is all that useful.

> So where is the overcomplicated things in that; especially where TLS is
> used with almost all EAP methods.

Just because other methods use it doesn't mean it's the right thing to do
in the PSK case.  TLS was designed for public-key environments, and I
agree it's probably the right thing to use for public-key authentication.

We obviously have a difference of opinion, and aren't going to change each
others' mind.  The pros and cons can be argued from both directions.

[ t. charles clancy ]--[ tcc [at] umd.edu ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]