Subject: [eap] Re: [802.1] Re: 802.1X interface variable

From: Bernard Aboba <[email-masked]>
Date: Fri, 9 Jan 2004 07:50:25 -0800 (PST)

> does this mean that TLS host only authorization is not going to be allowed?
> I think this is being used to allow access to walled garden environments.

The TLS protocol does not support "client only" authentication.  In any
case it says "support", not "use".

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: John Vollbrecht <[email-masked]>
Date: Fri, 09 Jan 2004 09:29:15 -0500

--On Friday, January 2, 2004 6:50 PM -0800 Bernard Aboba 
<[email-masked]> wrote:

>
> > I think we should require it to avoid possible vulnerability in design
> > of future EAP authentication methods, and requiring it should not be a
> > problem since many existing mutually authenticating methods (e.g.,
> > EAP-TLS, PEAP, EAP-TTLS, EAP-SIM, EAP-AKA, EAP-IKEv2, EAP-Archie) are
> > already capable of deriving keys.
>
> Yes.  Actually in section 7.10 it already states that methods supporting
> key derivation MUST also support mutual authentication.
>

> > > Methods supporting mutual authentication MUST also
> > > support key derivation and protected result indications."
> >
> > I agree on adding the text.
>
> I will add this to the proposed resolution of Issue 207.  Together, I
> think this makes it unnecessary to add another AAA attribute.
>
> =>IEEE 802.1 Email List user information:
> http://www.ieee802.org/1/email-pages/

---

From: John Vollbrecht <[email-masked]>
Date: Sat, 10 Jan 2004 13:44:26 -0500

--On Friday, January 9, 2004 7:50 AM -0800 Bernard Aboba 
<[email-masked]> wrote:

>> does this mean that TLS host only authorization is not going to be
>> allowed? I think this is being used to allow access to walled garden
>> environments.
>
But does it support "host only" authentication?  If so, then presumably 
this is not mutual authentication but does derive keys.  I think this is 
allowed - am I  wrong?