Subject: [eap] WLAN-SIM Spec Announcements

From: [email-masked] (Wouter Habraken)
Date: Wed, 16 Jul 2003 11:05:38 -0500

Today the WLAN Smart Card Consortium (WLAN-SCC) announced the first
draft version of the WLAN-SIM specification for public comment.

This specification is expected to be supported by all the major SIM
smart card vendors, and enables support for several EAP-SIM functions
directly on the smart card, including identity management, random number
generation and the EAP-SIM challenge and re-authentication functions.

I would encourage anyone interested in EAP and SIM authentication to
review the spec. We would very much appreciate you comments and
feedback.

Spec (150kb pdf): http://www.wlansmartcard.org/specs/WLAN-SIM_V01.PDF
(PR: http://www.wlansmartcard.org/html/news.html)

This spec is the first of several planned by the WLAN-SCC.  Others will
provide support for additional authentication methods (see the
urien-eap-smartcard IETF draft), configuration management, QOS and VoIP.

Cheers,

Wouter Habraken
Raak Technologies
[email-masked]

---

From: [email-masked] (Tom Porcher)
Date: Thu, 17 Jul 2003 11:14:16 -0400

This is a multi-part message in MIME format.
--------------060308040302010401050906
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Wouter,

Thank you for publishing this specification.  I have been implementing 
EAP/SIM for Funk Software and I have a number of comments.

Is there a forum for discussing this specification?  The EAP 
mailing-list is probably not the right venue for further discussions of 
this specific a topic.

   1. General - use of numbers - Some of the numbers appear to be
      hexadecimal, while others appear to be decimal.  I would recommend
      explictly stating that all numbers are decimal unless indicated
      otherwise.  Those numbers in hexadecimal should be noted as such.
   2. 2 References - Can you tell me how to get [3] and [4]?  For [3],
      the spec number TS 102.221 is out of the range of available
      specifications from 3GPP.  For [4], there is no information on the
      publisher.
   3. 5.2 PIN Management - If this is implemented on a SmartCard that
      also supports "traditional" GSM SIM operations, is the PIN the
      same as the GSM PIN?
   4. 5.3 Get-Preferred-Identity - this "may" require PIN access
      rights?  I think this MUST require PIN access rights.
   6. 5.5 Get-Preferred-Identity - this appears to be the same function
      as Select-Identity of type '13'.  If this is intnetional, I think
      it is confusing to list it as a seperate function.  Anyone
      implementing EAP/SIM would need to know that they are the same.
   7. 5.4 Select-Identity - This MUST require PIN access rights also.
   8. 5.4 Select-Identity - The EAP/SIM identity as specified in [0]
      includes a username and an "@realm" portion.  The "@realm" is not
      used by EAP/SIM but may be needed to direct the request to a
      particular server.  This part would normally be supplied by the
      EAP/SIM client.  How is the "@realm" portion supplied to the
      selected identity?  Does it differ for the different identity types?
   9. 5.4 Select-Identity - is the "permanent identity" always based on
      the IMSI as recommended in [0] (i.e. 1<IMSI>@realm) or can it take
      other forms?  Does it always include the "1" and the "@realm"?
  10. 5.6 Process-EAP - also requires GET CURRENT VERSION to set the
      authenticator's version list before executing this command.
  11. 5.6 Process-EAP - AT_CHECKCODE not supported - is it ignored if
      received or does it cause an error?
  12. 5.6 Process-EAP - authentication type 01 - does this use only the
      IMSI in the operation or the identity based on the IMSI (i.e.
      1<IMSI>@realm)?
  13. 5.6 Process-EAP - authentication type 01 - how is this useful? 
      The cryptographic operations need to use the EAP/SIM Identity
      actually used in the EAP/Request/Identity or EAP/SIM/Start
      message, so a Select-Identity is required in any case.  If this
      does not serve a purpose I would suggest removing it.
  14. 5.8 - Get-Current-Version - this command also sets the version
      list received from the authenticator.  This is not clear from
      either the name or the description. In addition to adding this to
      the description, I would suggest using "Version List Length"
      instead of "XX" as the description of the Lc parameter and make
      Version-Type 1 say "get version and set version list for EAP/SIM".
  15. 5.8 - Get-Current-Version - should state that this command is
      required before Process-EAP.
  16. 5.8 - Get-Current-Version - is the version reported as '00', '01'
      or '01', '00'?  That isn't clear from '0001'.
  17. 5.8 - Get-Current-Version - there is no specific error code for
      "version not supported" if the authenticator's version list does
      not contain a supported version.  Is this checked?  A specific
      error code for this condition would be useful.
  18. 5.8 - Get-Current-Version - This should require PIN access rights
      since executing it can affect an authentication in progress.

Thank you.
                     --Tom Porcher

-- 
Tom Porcher          | [email-masked]    voice: 978.371.3980 x108
Consulting Engineer  | http://www.funk.com   fax: 978.371.3990
Funk Software, Inc.  | Concord, Massachusetts, USA, Earth

Wouter Habraken wrote:

>_______________________________________________
>eap mailing list
>[email-masked]
>http://mail.frascone.com/mailman/listinfo/eap
>  
>

--------------060308040302010401050906
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
  <title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
<title></title>
Wouter,<br>
<br>
Thank you for publishing this specification.&nbsp; I have been implementing
EAP/SIM for Funk Software and I have a number of comments.<br>
<br>
Is there a forum for discussing this specification?&nbsp; The EAP
mailing-list is probably not the right venue for further discussions of
this specific a topic.<br>
<ol>
  <li>General - use of numbers - Some of the numbers appear to be
hexadecimal, while others appear to be decimal.&nbsp; I would recommend
explictly stating that all numbers are decimal unless indicated
otherwise.&nbsp; Those numbers in hexadecimal should be noted as such.<br>
  </li>
  <li>2 References - Can you tell me how to get [3] and [4]?&nbsp; For [3],
the spec number TS 102.221 is out of the range of available
specifications from 3GPP.&nbsp; For [4], there is no information on the
publisher.</li>
  <li>5.2 PIN Management - If this is implemented on a SmartCard that
also supports "traditional" GSM SIM operations, is the PIN the same as
the GSM PIN?</li>
  <li>5.3 Get-Preferred-Identity - this "may" require PIN access
rights?&nbsp; I think this MUST require PIN access rights.</li>
  <li value="6">5.5 Get-Preferred-Identity - this appears to be the
same function as Select-Identity of type '13'.&nbsp; If this is intnetional,
I think it is confusing to list it as a seperate function.&nbsp; Anyone
implementing EAP/SIM would need to know that they are the same.<br>
  </li>
  <li>5.4 Select-Identity - This MUST require PIN access rights also.<br>
  </li>
  <li>5.4 Select-Identity - The EAP/SIM identity as specified in [0]
includes a username and an "@realm" portion.&nbsp; The "@realm" is not used
by EAP/SIM but may be needed to direct the request to a particular
server.&nbsp; This part would normally be supplied by the EAP/SIM client.&nbsp;
How is the "@realm" portion supplied to the selected identity?&nbsp; Does it
differ for the different identity types?</li>
  <li>5.4 Select-Identity - is the "permanent identity" always based on
the IMSI as recommended in [0] (i.e. 1&lt;IMSI&gt;@realm) or can it
take other forms?&nbsp; Does it always include the "1" and the "@realm"?</li>
  <li>5.6 Process-EAP - also requires GET CURRENT VERSION to set the
authenticator's version list before executing this command.<br>
  </li>
  <li>5.6 Process-EAP - AT_CHECKCODE not supported - is it ignored if
received or does it cause an error?</li>
  <li>5.6 Process-EAP - authentication type 01 - does this use only the
IMSI in the operation or the identity based on the IMSI (i.e.
1&lt;IMSI&gt;@realm)?</li>
  <li>5.6 Process-EAP - authentication type 01 - how is this useful?&nbsp;
The cryptographic operations need to use the EAP/SIM Identity actually
used in the EAP/Request/Identity or EAP/SIM/Start message, so a
Select-Identity is required in any case.&nbsp; If this does not serve a
purpose I would suggest removing it.</li>
  <li>5.8 - Get-Current-Version - this command also sets the version
list received from the authenticator.&nbsp; This is not clear from either
the name or the description. In addition to adding this to the
description, I would suggest using "Version List Length" instead of
"XX" as the description of the Lc parameter and make Version-Type 1 say
"get version and set version list for EAP/SIM".</li>
  <li>5.8 - Get-Current-Version - should state that this command is
required before Process-EAP.<br>
  </li>
  <li>5.8 - Get-Current-Version - is the version reported as '00', '01'
or '01', '00'?&nbsp; That isn't clear from '0001'.</li>
  <li>5.8 - Get-Current-Version - there is no specific error code for
"version not supported" if the authenticator's version list does not
contain a supported version.&nbsp; Is this checked?&nbsp; A specific error code
for this condition would be useful.</li>
  <li>5.8 - Get-Current-Version - This should require PIN access rights
since executing it can affect an authentication in progress.</li>
</ol>
Thank you.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; --Tom Porcher<br>
<pre class="moz-signature" cols="1000">-- 
Tom Porcher          | <a class="moz-txt-link-abbreviated"
 href="mailto:[email-masked]">[email-masked]</a>    voice: 978.371.3980 x108
Consulting Engineer  | <a class="moz-txt-link-freetext"
 href="http://www.funk.com">http://www.funk.com</a>   fax: 978.371.3990
Funk Software, Inc.  | Concord, Massachusetts, USA, Earth
</pre>
<br>
<br>
Wouter Habraken wrote:<br>
<blockquote type="cite"
 cite="[email-masked]">
  <pre wrap="">Today the WLAN Smart Card Consortium (WLAN-SCC) announced the first
draft version of the WLAN-SIM specification for public comment.

Spec (150kb pdf): <a
 class="moz-txt-link-freetext"
 href="http://www.wlansmartcard.org/specs/WLAN-SIM_V01.PDF">http://www.wlansmartcard.org/specs/WLAN-SIM_V01.PDF</a>
(PR: <a
 class="moz-txt-link-freetext"
 href="http://www.wlansmartcard.org/html/news.html">http://www.wlansmartcard.org/html/news.html</a>)

Cheers,

Wouter Habraken
Raak Technologies
<a class="moz-txt-link-abbreviated"
 href="mailto:[email-masked]">[email-masked]</a>

_______________________________________________
eap mailing list
<a class="moz-txt-link-abbreviated" href="mailto:[email-masked]">[email-masked]</a>
<a class="moz-txt-link-freetext"
 href="http://mail.frascone.com/mailman/listinfo/eap">http://mail.frascone.com/mailman/listinfo/eap</a>
  </pre>
</blockquote>
<br>
<pre class="moz-signature" cols="1000">
</pre>
</body>
</html>

--------------060308040302010401050906--