Subject: [eap] EAP SRP method

From: [email-masked] (Keith Burdis)
Date: Mon, 14 Jul 2003 17:41:30 +0100

Hi there

Raif Naffah and I have been working on an SRP SASL mechanism for a while now.
After publishing the most recent draft we were asked by Sam Hartman to specify
a compatible SRP GSS-API specification so that there would be no duplication
of effort - both in terms of review and implementation time.  In modifying the
draft to specify both an SASL and GSS-API mechanism we realised that the
majority of the specification was authentication framework agnostic.  This
made is relatively easy to specify how it could be used with EAP as well.

However, neither Raif or I are EAP experts, so we are unsure whether or not
what we have specified is sufficient.  We have attempted to follow all of the
requirements set out in rfc2284bis, in particular the Security Claims, but we
need people who really know EAP to review this.  The (now misnamed) draft is:

  draft-burdis-cat-srp-sasl-08.txt

Thanks.

  - Keith

PS: I am in Vienna and would be happy to have a face-to-face discussion with
anyone about this.