Subject: [eap] (no subject)

From: [email-masked] (Bernard Aboba)
Date: Sat, 11 Jan 2003 15:56:26 -0800 (PST)

Issue 68: MIC coverage?
Submitter name: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: January 11, 2003
Document: RFC 2284bis-08
Comment type: T
Priority: S
Section: 2.1, 3.1
Rationale/Explanation of issue:

In order to provide integrity protection and authentication for the EAP
conversation, it may be desirable for an EAP method to be able to
calculate a MIC on the EAP headers as well as the Type-Data field, and
perhaps even previous EAP messages.

For example, in a conversation including an Identity Request/Response,
a Request for EAP Type X, a Nak Response offering alternative Y, and
then EAP Request/Response messages of Type Y, it may be desirable for
method Y to be able to calculate a MIC of all previous EAP messages,
including headers.

Is this prohibited by the multiplexing model? For example, can EAP
methods be assumed to have access to the EAP headers? Does the
multiplexing model imply that EAP messages of types Nak, Notification
Success and Failure are never accessible to the EAP method? What
about EAP Identity-Request?