Subject: [eap] EAPv2?

From: [email-masked] ([email-masked])
Date: Mon, 27 Jan 2003 11:23:13 +0200

On 20 Jan 2003, Bernard Aboba wrote:

> Overall, it is important to understand that PANA (and IEEE 802.11i for
> that matter) represent very major extensions to the existing EAP usage
> model. RFC 2284 was created with the assumption that the underlying
> physical medium was secure, as was IEEE 802.1X (which was created for use
> with wired networks only).  Where EAP is run over wireless that is not the
> case. This greatly expands the potential security vulnerabilities.
>
> IEEE 802.11i has put in substantial effort to address these issues:
> addition of a "third leg" of mutual auth and key derivation
> between the NAS and client; proper key wrapping between the AAA server and
> NAS; definition of the key hierarchy, both for individual sessions, and
> for fast handoff; support for pre-authentication; EAP method requirements.
>
> To get an idea of what you're up against, I would suggest a careful
> reading of IEEE 802.11i.

Given that many people seem to be interested in using EAP in
environments where the underlying medium is not secure, and getting it
right seems to be very difficult, would there be any point or interest
in developing "EAPv2"?

Some ideas what properties this "EAPv2" could have:

- Designed to be used in environments where the underlying 
  medium is not secure.
- Designed and specified so that it is easy to "embed" EAPv2 in 
  other protocols (EAPv1 was designed to be extensible, but it 
  was not intended as a "building block" for other protocols).
- Maybe better support for mutual authentication and method 
  negotiation related to it.
- EAPv2 records could be transported as an EAPv1 method, so it could
  be used in PPP/802.1X environments without changing NAS boxes.
- Clear specification of behavior (state machines, etc.), so that
  EAPv2 would be simpler and easier to implement than EAPv1.

Clearly, the main target of this work would not be PPP, or even
802.1X/11i, but new protocols which would like to reuse an existing
"building block" (PANA, PIC, others?). 

What do you think, is there demand for this kind of work?  Are people
interested in thinking more about this? If so, how should the thing
get started? (Perhaps some of the more difficult issues in 2284bis
could be postponed to this "EAPv2", so we can get 2284bis accepted
sooner? Or maybe this isn't a good idea...)

Best regards,
Pasi