Subject: [eap] Re: Peer to Peer mutual authentication

From: [email-masked] (Bernard Aboba)
Date: Sun, 27 Apr 2003 23:44:12 -0700 (PDT)

>   - How to identify the initiator. As a responder, I can send my identity
>     in the Identity Response, but what if we are running a shared secret
>     method and I have different shared secrets for you and someone else?
>     I would need to know your identity before I can proceed with the
>     execution of the method.

In practice, there are some implementations where the authenticator sends
its Identity in the Identity Request, and the peer responds with an
Identity Response. However, since this is peer to peer it would probably
make more sense to choose a method that had its own identity exchange
built-in. That way it might be possible to support identity privacy.

>     from a client, which I believe is solved with information from the
>     link layer (SSID).

A hint from the link layer (SSID) is preferred because it is available
prior to authentication, but some EAP implementations also provide a hint
in the Identity Request.

> Two, we could do it at the link-layer level.
> For instance, the initiator could be chosen to be the peer with the
> smallest MAC address

That's what comes to mind. For example, both sides can send an
EAPOL-Start to the 8021X multicast address, and then the peer
with the lowest MAC address can respond with an EAP-Request
(authenticator role).