From emu-bounces@ietf.org Tue May 02 11:44:15 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Fax2s-00061E-Oc; Tue, 02 May 2006 11:44:14 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Fax2r-000619-Bw for emu@ietf.org; Tue, 02 May 2006 11:44:13 -0400 Received: from web54410.mail.yahoo.com ([206.190.49.140]) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1Fax2r-0001Qd-0z for emu@ietf.org; Tue, 02 May 2006 11:44:13 -0400 Received: (qmail 39874 invoked by uid 60001); 2 May 2006 15:42:57 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=o/Ra69EEvBW6PJVnZV/ReW1lQc6VdU8deJhAA5hmyKVS69MLodeeaQwkdTCcyyoF35erEV5hljHFSi9FZM/RJmP9SOwmwl5tSocGh7je40oo+oJxmXuLuvopbAiCoV4/M6ptb90Y/KCTFtjPoNLksdiCTpgSQJXv4gf0FhLraWU= ; Message-ID: <20060502154257.39872.qmail@web54410.mail.yahoo.com> Received: from [67.181.83.189] by web54410.mail.yahoo.com via HTTP; Tue, 02 May 2006 08:42:57 PDT Date: Tue, 2 May 2006 08:42:57 -0700 (PDT) From: "M. Vanderveen" Subject: Re: [Emu] ICV in EAP-PAX To: Thomas Otto , emu@ietf.org In-Reply-To: <200604291208.26523.thomas.g.otto@googlemail.com> MIME-Version: 1.0 X-Spam-Score: 0.5 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Cc: X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0776554808==" Errors-To: emu-bounces@ietf.org --===============0776554808== Content-Type: multipart/alternative; boundary="0-2060179132-1146584577=:38745" Content-Transfer-Encoding: 8bit --0-2060179132-1146584577=:38745 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit I think the confusion arose from the meaning of "may not" as opposed to MAY NOT. Section 3.1 as you quote it essentially says that EAP methods rely on lower layer error detection, as they may possibly have no such error detection (or an incomplete error detection) built in. EAP-SAKE computes an ICV over the entire packet as an added precaution. From the way I'm reading RFC3748 ICVs are allowed, and are even a good idea as it makes the EAP method more robust (at the additional cost of putting in the extra bytes in the one-way hash function input) and less dependent on the lower layer error detection. Michaela Thomas Otto wrote: But RFC 3748 days in Section 3.1 [...] EAP methods may not include a MIC, or if they do, it may not be computed over all the fields in the EAP packet, such as the Code, Identifier, Length, or Type fields. [...] We should discuss whether the ICVs are allowed and/or makes sense. (... I remember EAP-SAKE also computes an ICV over the whole packet ...) --------------------------------- Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less. --0-2060179132-1146584577=:38745 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit
I think the confusion arose from the meaning of "may not" as opposed to MAY NOT. Section 3.1 as you quote it essentially says that EAP methods rely on lower layer error detection, as they may possibly have no such error detection (or an incomplete error detection) built in.
 
EAP-SAKE computes an ICV over the entire packet as an added precaution. From the way I'm reading RFC3748 ICVs are allowed, and are even a good idea as it makes the EAP method more robust (at the additional cost of putting in the extra bytes in the one-way hash function input) and less dependent on the lower layer error detection.
 
Michaela

Thomas Otto <thomas.g.otto@googlemail.com> wrote:
<snip>
But RFC 3748 days in Section 3.1

[...] EAP methods may not
include a MIC, or if they do, it may not be computed over all the
fields in the EAP packet, such as the Code, Identifier, Length,
or Type fields. [...]


<snip>

We should discuss whether the ICVs are allowed and/or makes sense.
(... I remember EAP-SAKE also computes an ICV over the whole packet ...)


Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less. --0-2060179132-1146584577=:38745-- --===============0776554808== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Emu mailing list Emu@ietf.org https://www1.ietf.org/mailman/listinfo/emu --===============0776554808==--