Subject: [eap] Proposed resolution to Issue 121

From: [email-masked] (Bernard Aboba)
Date: Tue, 10 Jun 2003 22:40:51 -0700 (PDT)

In Issue 121 we have defined the circumstances in
which the peer may eventually conclude that a Success packet
has been lost. In those same circumstances, the proposed
change allows the peer to conclude that a Success packet
has been lost, without having to wait the full timeout period.
It therefore represents an optimization.

Here are the proposed fixes:

In Section 3.4, Change:

"Lower layer failure indications provided to EAP by the lower layer
MUST be processed and will cause an EAP exchange in progress to be
aborted. However, lower layer success indications MUST NOT affect EAP
message processing so that an EAP implementation MUST NOT conclude
that authentication has succeeded based on those indications."

To:

"Section 4.2 defines the circumstances in which a peer,
having concluded an EAP method with successful acknowledged
result indications, may conclude that a Success packet has
been lost after expiration of a timeout. In those same
circumstances, if a peer receives a lower layer success
indication as defined in Section 7.12, it MAY conclude that
a Success packet has been lost without waiting for a timeout."

In Section 7.12, change:

" [c] IEEE 802.11 wireless LANs. In IEEE 802.11, link layer
indications include Disassociate and Deauthenticate frames (link
failure indications), and Association and Reassociation Response
frames (link success indications). These messages are not
authenticated or integrity protected, and although they are not
forwardable, they are spoofable by an attacker within range."

To:

" [c] IEEE 802.11 wireless LANs. In IEEE 802.11, link layer
indications include Disassociate and Deauthenticate frames (link
failure indications), and the first message of the 4-way handshake
(link success indication). These messages are not
authenticated or integrity protected, and although they are not
forwardable, they are spoofable by an attacker within range."