Subject: [AAA-WG]: Issue 353

From: "Glen Zorn" <[email-masked]>
Date: Wed, 23 Oct 2002 11:56:21 -0700

Section 2 of draft-ietf-aaa-eap-00.txt says:

2.  Extensible Authentication Protocol Support in Diameter

   The Extensible Authentication Protocol (EAP) [RFC2284] provides a
   standard mechanism for support of various authentication methods.
   Through the use of EAP, support for a number of authentication
   schemes may be added, including smart and token cards, Kerberos
   [RFC1510], public-key, one-time passwords [RFC1938], and others.

   This document describes the Command-Code values and AVPs that are
   required for an EAP packet to be encapsulated within the Diameter
   protocol. Since authentication occurs between the EAP client and its
   home Diameter server, end-to-end authentication is achieved, reducing
   the possibility for fraudulent authentication, such as replay and
   man-in-the-middle attacks. End-to-end authentication also provides
   for mutual (bi-directional) authentication, which is not possible
   with PAP and CHAP in a roaming PPP environment.

Issue 353 says (in part):

Page 2, section 2, last sentence:

Change "with PAP and CHAP in a roaming PPP environment." to
"with PAP, CHAP or EAP-MD5."

The problem is that mutual authentication _is_ possible in a roaming PPP
environment using PAP, CHAP or EAP-MD5, under certain constraint which may
be inconvenient, but it is possible.  To avoid  endless discussions of PPP
minutiae, I suggest the following text:

2.  Extensible Authentication Protocol Support in Diameter

   The Extensible Authentication Protocol (EAP) [RFC2284] provides a
   standard mechanism for support of various authentication methods.
   Through the use of EAP, support for a number of authentication
   schemes may be added, including smart and token cards, Kerberos
   [RFC1510], public-key, one-time passwords [RFC1938], and others.

   This document describes the Command-Code values and AVPs that are
   required for an EAP packet to be encapsulated within the Diameter
   protocol. Since authentication occurs between the EAP client and its
   home Diameter server, end-to-end authentication is achieved, reducing
   the possibility of replay and man-in-the-middle attacks and
   simplifying the satisfaction of requirements for mutual authentication
   in roaming environments.