Multiple Authentication Exchanges in the Internet Key Exchange (IKEv2) Protocol

The Internet Key Exchange (IKEv2) protocol supports several mechanismsfor authenticating the parties, including signatures with public-keycertificates, shared secrets, and Extensible Authentication Protocol(EAP) methods. Currently, each endpoint uses only one of thesemechanisms to authenticate itself. This document specifies anextension to IKEv2 that allows the use of multiple authenticationexchanges, using either different mechanisms or the same mechanism.This extension allows, for instance, performing certificate-basedauthentication of the client host followed by an EAP authentication ofthe user. When backend authentication servers are used, they canbelong to different administrative domains, such as the network accessprovider and the service provider. This memo defines an ExperimentalProtocol for the Internet community.