Subject: [eap] Proposed resolution of Issue 118: Mutual Authentication

From: [email-masked] (Bernard Aboba)
Date: Tue, 29 Apr 2003 11:45:03 -0700 (PDT)

The text of Issue 118 is enclosed below. Based on the discussion so far,
it does not appear that any additional text is required in RFC 2284bis to
address this (though additional text might be added in IEEE 802.1X). As a
result, my recommendation is that this issue be rejected. Any objections?

-----------------------------------------------------------------------
Issue 118: Mutual Authentication
Submitter name: Dror Caspi
Submitter email address: [email-masked]
Date first submitted: April 21, 2003
Reference:
Document: EAP-02
Comment type: T
Priority: 2
Section: Various
Rationale/Explanation of issue:

Having looked at the drafts of RFC2284bis, EAP-Archie and IEEE-802.1aa,
it seems that most of the attention is given to systems where there is a
distinction between an authenticator and a peer/supplicant. This
distinction still exists even where mutual authentication is proposed
(e.g., EAP-Archie).

But what happens when both parties are peers (e.g., two bridge devices)?
The possibility of role reversal is mentioned (i.e., run a session
where one system is Authenticator and the other Peer, and then reverse
the role). However it seems quite cumbersome; a single session of a
protocol such as EAP-Archie would seem to provide the required
authentication - yet there needs to be a mechanism to (randomly?) decide
which party plays which role.

Probably some of the above is misunderstanding on my part. However
there seems to be a need for some explanatory text in the standards, if
not for actual changes to accommodate peer-to-peer mutual authentication.

Requested change:

Add explanatory text about peer-to-peer mutual authentication. Modify
the standards if required.