Subject: [eap] Issue 167: Cleartext Passwords in EAP

From: Bernard Aboba <[email-masked]>
Date: Thu, 14 Aug 2003 13:29:33 -0700 (PDT)

Issue 167: Cleartext Passwords in EAP
Submitter name: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: 8/14/2003
Reference:
Document: RFC2284bis
Comment type: T
Priority: S
Section: 5.5, 5.6
Rationale/Explanation of issue:

Reading Section 5.5 and 5.6, it is not made crystal clear that the EAP OTP
and GTC methods are not intended to provide support for cleartexst
passwords.

In Section 5.5, add to the end of the "Description" paragraph:

"The EAP OTP method is intended for use with the One-Time Password system
only, and MUST NOT be used to provide support for cleartext passwords."

In Section 5.6, add to the end of the "Description" paragraph:

"The EAP GTC method is intended for use with the Token Cards supporting
challenge/response authentication and MUST NOT be used to provide support
for cleartext passwords."

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap