Subject: [eap] Question regarding draft-puthenkulam-eap-binding-01

From: [email-masked] (Wei Wang)
Date: Fri, 28 Feb 2003 03:40:34 -0500

Greetings,

In describing a "man-in-the-middle" attack against TLS protected
EAP authentication, the referred document stated that, "For this
attack to be successful, it is necessary for the tunneled
authentication methods to also be enabled for use outside the
tunnel, and for the same credentials to be used for
authentication inside and outside the tunnel."

It seems that it is not necessary for the same credentials to be
used both inside and outside the tunnel. At least the EAP-TTLS
method has this "anonymity and privacy" feature, in which case,
the user id inside the tunnel does not (or actually,  should
not) be the same as the one outside the tunnel.

Regards,
-- 
Wei Wang                  mailto:[email-masked]
Interlink Networks, Inc.  http://www.interlinknetworks.com