<div dir="ltr"><div><div><div><div>Dear Noel,<br></div> As per RFC 5216 , <a href="https://tools.ietf.org/html/rfc5216">https://tools.ietf.org/html/rfc5216</a><br></div> EAP TLS peer should add TLS_certificate_verify while sending its certificate. Private key is used there. It contains signed authentication response to the EAP server.<br></div> Can yo uplease help answering the original query.<br><br></div>Sequence flow from RFC is copied here below for quick reference.<br><div><div><div><br><pre class="gmail-newpage"> Authenticating Peer Authenticator
------------------- -------------
<- EAP-Request/
Identity
EAP-Response/
Identity (MyID) ->
<- EAP-Request/
EAP-Type=EAP-TLS
(TLS Start)
EAP-Response/
EAP-Type=EAP-TLS
(TLS client_hello)->
<- EAP-Request/
EAP-Type=EAP-TLS
(TLS server_hello,
TLS certificate,
[TLS server_key_exchange,]
TLS certificate_request,
TLS server_hello_done)
EAP-Response/
EAP-Type=EAP-TLS
(TLS certificate,
TLS client_key_exchange,
TLS certificate_verify,
TLS change_cipher_spec,
TLS finished) ->
<- EAP-Request/
EAP-Type=EAP-TLS
(TLS change_cipher_spec,
TLS finished)
EAP-Response/
EAP-Type=EAP-TLS ->
<- EAP-Success
</pre><br></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 20, 2016 at 3:44 PM, Noel Kuntze <span dir="ltr"><<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 19.10.2016 23:13, Ravi Kanth Vanapalli wrote:<br>
> Server has issued a self signed certificated for the UE. UE is supposed to share this cert via EAP-TLS authentication when server requests a certificate<br>
> Server has shared the private key to the UE via secure means. This signature is used for for signature verification in EAP-TLS<br>
</span>Don't share the private key. The design of TLS does not require that. And what signature? The signature of the self signed certificate?<br>
<div class="HOEnZb"><div class="h5"><br>
><br>
> Does this kind of setup work for EAP-TLS authentication in strongswan ? I mean, when UE is trying to find a private key using the API find_private_key() in file tls_peer.c, it returns null.<br>
<br>
</div></div><span class="HOEnZb"><font color="#888888">--<br>
<br>
Mit freundlichen Grüßen/Kind Regards,<br>
Noel Kuntze<br>
<br>
GPG Key ID: 0x63EC6658<br>
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
<br>
<br>
</font></span></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><font color="#666666">Regards,</font></div>
<div><br><font color="#666666">RaviKanth VN Vanapalli</font></div><div><font color="#666666">Ph: (469) 999 7567</font></div>
<div><font color="#666666">Email: </font><a href="mailto:vvnrk.vanapalli@gmail.com" target="_blank"><font color="#666666">vvnrk.vanapalli@gmail.com</font></a></div></div></div>
</div>