Subject: [eap] Checkcode in EAP SIM and EAP AKA

From: <[email-masked]>
Date: Wed, 13 Aug 2003 18:11:35 +0300

Hi All,

The latest versions of EAP SIM and EAP AKA 
(draft-haverinen-pppext-eap-sim-11.txt and draft-arkko-pppext-eap-aka-10.txt)
include a new optional attribute AT_CHECKCODE which can be used for the
integrity protection of the very first messages (Start messages in EAP SIM and 
AKA-Identity messages in EAP AKA). The message authentication code
attribute AT_MAC cannot be used in these messages because keys are not
available yet. The checkcode attribute does not break compatibility because 
it is a so-called skippable attribute. 

The purpose of this attribute is mainly to protect any future extensions to
the very first messages. Currently all the relevant fields in these messages
are protected by including them in key derivation. A good example
of a future extension is version negotiation attributes to EAP AKA. 
Protected version negotiation is already included in EAP SIM.

However, we have received requests not to include AT_CHECKCODE in
the next versions of EAP SIM, because there does not seem to be
any realistic extensions to the first messages in prospect. The version 
negotiation feature already allows for extensions because the version 
number can be incremented if the Start messages need to 
be extended. Hence, in the next draft revision, we are going to remove 
the specification of AT_CHECKCODE from EAP SIM and at the same time
forbid any extensions to the Start messages in protocol version 0x01.
AT_CHECKCODE will still be included in EAP AKA.

This does not change technical compatibility. 
Different versions of EAP SIM and EAP AKA documents have been 
technically compatible as of draft-haverinen-pppext-eap-sim-06.txt and 
draft-arkko-pppext-eap-aka-05.txt.

Regards,
Henry

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap