Subject: [eap] EAPv2?

From: [email-masked] (John Vollbrecht)
Date: Thu, 13 Feb 2003 18:01:25 -0500

--On Monday, January 27, 2003 11:23 AM +0200 [email-masked] wrote:

> On 20 Jan 2003, Bernard Aboba wrote:
>
> > Overall, it is important to understand that PANA (and IEEE 802.11i for
> > that matter) represent very major extensions to the existing EAP usage
> > model. RFC 2284 was created with the assumption that the underlying
> > physical medium was secure, as was IEEE 802.1X (which was created for
> > use with wired networks only).  Where EAP is run over wireless that is
> > not the case. This greatly expands the potential security
> > vulnerabilities.
> >
> > IEEE 802.11i has put in substantial effort to address these issues:
> > addition of a "third leg" of mutual auth and key derivation
> > between the NAS and client; proper key wrapping between the AAA server
> > and NAS; definition of the key hierarchy, both for individual sessions,
> > and for fast handoff; support for pre-authentication; EAP method
> > requirements.
> >
> > To get an idea of what you're up against, I would suggest a careful
> > reading of IEEE 802.11i.
>
> Given that many people seem to be interested in using EAP in
> environments where the underlying medium is not secure, and getting it
> right seems to be very difficult, would there be any point or interest
> in developing "EAPv2"?
>
> Some ideas what properties this "EAPv2" could have:
>
> - Designed to be used in environments where the underlying
>   medium is not secure.
> - Designed and specified so that it is easy to "embed" EAPv2 in
>   other protocols (EAPv1 was designed to be extensible, but it
>   was not intended as a "building block" for other protocols).
> - Maybe better support for mutual authentication and method
>   negotiation related to it.
> - EAPv2 records could be transported as an EAPv1 method, so it could
>   be used in PPP/802.1X environments without changing NAS boxes.
> - Clear specification of behavior (state machines, etc.), so that
>   EAPv2 would be simpler and easier to implement than EAPv1.
>
> Clearly, the main target of this work would not be PPP, or even
> 802.1X/11i, but new protocols which would like to reuse an existing
> "building block" (PANA, PIC, others?).
>
> What do you think, is there demand for this kind of work?  Are people
> interested in thinking more about this? If so, how should the thing
> get started? (Perhaps some of the more difficult issues in 2284bis
> could be postponed to this "EAPv2", so we can get 2284bis accepted
> sooner? Or maybe this isn't a good idea...)
>

I am interested.  One possibility would be to start in the AAAARCH Research 
Group.  I think this would be a reasonable thing to do, and would allow 
archtiteture and research issues to be discussed and documented.

Would others be interested in doing this?

> Best regards,
> Pasi
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap