Subject: [eap] Re: Issue 74

From: [email-masked] (Bernard Aboba)
Date: Sun, 16 Feb 2003 08:11:14 -0800 (PST)

Here is another shot at resolving Issue 74:

"7.13 Message Integrity Checks

Typically, EAP methods such as EAP-TLS [RFC2716] treat message
integrity check (MIC) failures as a fatal error. However,
it is also possible to develop EAP methods that support
per-packet MICs, and respond to verification failures by
silently discarding the offending packet.

If a per-packet Message Integrity Check (MIC) is employed
within an EAP method, then peers, authentication
servers, and authenticators not operating in pass-through
mode MUST validate the MIC and SHOULD silently discard
any message that fails verification. Alternatively, a
MIC validation failure MAY be considered a fatal error.

In this document, the descriptions of EAP message handling
assume that per-packet MIC validation, where it occurs,
is effectively performed as though it occurs before
examining any of the EAP message fields (such as 'Code').

Today, EAP methods commonly define MICs that cover more than one
EAP packet. For example, EAP methods such as EAP-TLS [RFC2716]
define a MIC covering an extended PDU that could be split
into multiple fragments, or that can cover portions of earlier
messages (FINISHED message).

Once an EAP method derives keys it may be desirable to
exchange MICs that cover otherwise unauthenticated packets,
(such as the Identity Request/Response, Notification
Request/Response or Nak Response) so as to be able to
detect forgeries after the fact.

Where the MIC covers more than one EAP packet, a failure
to validate the MIC will typically be considered a fatal error."

---

From: [email-masked] (John Vollbrecht)
Date: Mon, 17 Feb 2003 16:15:25 -0500

I think that this is good text, but belongs in an appendix for methods.  I 
don't think anything is needed in EAP RFC other than to say that Intgegrity 
checking is not supported in the EAP layer.  Methods may support it.

-- John

--On Sunday, February 16, 2003 8:11 AM -0800 Bernard Aboba 
<[email-masked]> wrote:

> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap

---

From: [email-masked] (Bernard Aboba)
Date: Mon, 17 Feb 2003 12:07:20 -0800 (PST)

> I think that this is good text, but belongs in an appendix for methods.

Can you clarify what an "appendix for method" is?

> I don't think anything is needed in EAP RFC other than to say that
> Integrity checking is not supported in the EAP layer.  Methods may support it.

But an Appendix is part of the document, isn't it?