Subject: [eap] Question regarding draft-puthenkulam-eap-binding-01

From: [email-masked] ([email-masked])
Date: Fri, 28 Feb 2003 12:47:23 +0200

Wei,

It's not question about the credentials used with the tunnel creation and the authentication method, but that the method can be used without the tunnel. For example you use the same EAP-MD5 credentials with or without the tunnel.

- Dan

> -----Original Message-----
> From: ext Wei Wang [mailto:[email-masked]]
> Sent: 28 February, 2003 10:41
> To: EAP WG
> Subject: [eap] Question regarding draft-puthenkulam-eap-binding-01
> 
> 
> Greetings,
> 
> In describing a "man-in-the-middle" attack against TLS protected
> EAP authentication, the referred document stated that, "For this
> attack to be successful, it is necessary for the tunneled
> authentication methods to also be enabled for use outside the
> tunnel, and for the same credentials to be used for
> authentication inside and outside the tunnel."
> 
> It seems that it is not necessary for the same credentials to be
> used both inside and outside the tunnel. At least the EAP-TTLS
> method has this "anonymity and privacy" feature, in which case,
> the user id inside the tunnel does not (or actually,  should
> not) be the same as the one outside the tunnel.
> 
> Regards,
> -- 
> Wei Wang                  mailto:[email-masked]
> Interlink Networks, Inc.  http://www.interlinknetworks.com
> 
> 
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>