eap Mailing List: Re: Re: SHA-0 Broken

[Mohamad Badra (badra]

Florent Bersani wrote:

> The IMHO interesting question I asked you and that you apparently 
> avoided to answer technically was: "why was IKEv2 invented since we 
> already had TLS"?


I don't like to answer by a technical question I posted it three months 
ago, but it may be a good idea to repeat it here. "Why have we to adopt 
or to add new security mechanisms since we had two very *well studied* 
and *widely implemented* protocols such as IPSec and TLS?".

The real differences between the TLS and IKEv2 come from the 
distinguished requirements of several architectures (included Fixed and 
Wireless) and applications. TLS was first developed to answer specific 
needs of client/server applications (such as credit card number) where 
the authentication was just from the server side. IKE and specially 
IKEv2 has different audience in the network architectures to answer a 
symmetric initiator/responder connexions where the two communicators 
have the same authentication methods. Actually, these two protocols are 
merging with their cryptographic and authentication part: they both 
integrate PSK authentication, Identity Protection, PFS, fast 
negotiation, etc. A lot of work was already done in the IPSec and TLS 
IETF WG to produce a secure, flexible and fast security protocol. (Add 
what do you want to  these three adjectives ;-)      ).

IMHO, a new defined protocol is welcome if, and only if *it can prove* 
its advantages over TLS and IKEv2.

Badra

P.S. If I didn't answer you properly, please forward your question to 
IPSec and TLS mailing list, maybe you will get more info about that.