Experimental evaluation of the performance costs of different IKEv2 authentication methods

This paper presents an experimental evaluation of the costs of different IKEv2 authentication methods. The studied methods are pre-shared keys (PSK), extensible authentication protocol (EAP) using MD5 and TLS, which are typically referred to as EAP-MD5 and EAP-TLS, respectively. For the EAP-based methods RADIUS is used as AAA server. Different lengths of certificate chains are studied in the EAP-TLS case. The paper first presents a brief overview of the considered authentication methods. Then, an experimental comparison of the costs for computations and message transfers associated with the authentication methods are provided. The measurement results illustrate the practical costs involved for IKEv2 authentication, and show the performance implications of using different authentication methods. EAP-TLS is several times more demanding than both PSK and EAP-MD5. When EAP-TLS is used, the length of certificate chains also has a considerable impact on performance.