From secmech-bounces@lists.ietf.org Sat Nov 05 14:38:40 2005 Received: from localhost.cnri.reston.va.us ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EYTs8-0003Hn-So; Sat, 05 Nov 2005 14:38:40 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EYTs8-0003Hi-53 for secmech@megatron.ietf.org; Sat, 05 Nov 2005 14:38:40 -0500 Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA16279 for ; Sat, 5 Nov 2005 14:38:16 -0500 (EST) Received: from p130.piuha.net ([193.234.218.130]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1EYU7M-0001WJ-7R for secmech@ietf.org; Sat, 05 Nov 2005 14:54:26 -0500 Received: from [127.0.0.1] (p130.piuha.net [193.234.218.130]) by p130.piuha.net (Postfix) with ESMTP id 9C00A89871 for ; Sat, 5 Nov 2005 21:38:10 +0200 (EET) Message-ID: <436D099D.80207@piuha.net> Date: Sat, 05 Nov 2005 21:35:57 +0200 From: Jari Arkko User-Agent: Mozilla Thunderbird 1.0 (X11/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: secmech@ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.3 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit Cc: Subject: [SECMECH] Updated agenda X-BeenThere: secmech@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Security mechanisms BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secmech-bounces@lists.ietf.org Errors-To: secmech-bounces@lists.ietf.org TIME & DATE: THURSDAY, November 10, 2005 0900-1130 Morning Session I AGENDA: INTRO AND BACKGROUND (15 min) o Agenda bashing, notes takers, blue sheets (Chairs, 5 min) o Background and relation to past SECMECH BOF and EAP WG work (Sam Hartman, 5 min) o EAP methods market situation (chairs, 5 min) TECHNICAL REQUIREMENTS (25 min) o EAP methods technical requirements (Bernard Aboba 15 min) o EAP methods, IEEE requirements (TBD & unconfirmed, 10 min) METHODS AND CLASSES OF METHODS (70 min) o Overview of proposed methods, credential types, and uses (Pasi Eronen, 20 min) o EAP TLS issues and limitations (Aboba, 10 min) o PSK and IKEv2 (Hannes Tschofenig, 15 min) o PAX update, channel bindings (Charles Clancy, 15 min) o POTP (David Mitton, 10 min) DISCUSSION AND WAY FORWARD (40 min) o Proposed charter (chairs, 10 min) o Discussion (30 min) _______________________________________________ SECMECH mailing list SECMECH@lists.ietf.org https://www1.ietf.org/mailman/listinfo/secmech From secmech-bounces@lists.ietf.org Tue Nov 08 10:19:13 2005 Received: from localhost.cnri.reston.va.us ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EZVFg-00071R-VZ; Tue, 08 Nov 2005 10:19:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EZVFd-00071J-Js for secmech@megatron.ietf.org; Tue, 08 Nov 2005 10:19:11 -0500 Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA11014 for ; Tue, 8 Nov 2005 10:18:42 -0500 (EST) Received: from p130.piuha.net ([193.234.218.130]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1EZVVS-0006W3-0Z for secmech@ietf.org; Tue, 08 Nov 2005 10:35:31 -0500 Received: from [127.0.0.1] (p130.piuha.net [193.234.218.130]) by p130.piuha.net (Postfix) with ESMTP id 86BFE89871; Tue, 8 Nov 2005 17:18:53 +0200 (EET) Message-ID: <4370B34D.4010105@piuha.net> Date: Tue, 08 Nov 2005 16:16:45 +0200 From: Jari Arkko User-Agent: Mozilla Thunderbird 1.0 (X11/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Thomas Otto References: <200511080910.20517.t.otto@sharevolution.de> In-Reply-To: <200511080910.20517.t.otto@sharevolution.de> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Content-Transfer-Encoding: 7bit Cc: secmech@ietf.org Subject: [SECMECH] FW: [eap] EMU BOF X-BeenThere: secmech@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Security mechanisms BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secmech-bounces@lists.ietf.org Errors-To: secmech-bounces@lists.ietf.org Thomas Otto wrote: >Hi all! > >Regarding the EMU BOF on Thursday. > >It is widely accepted that there is need for more standardized EAP >methods. Also for an pre-shared key based method. > >Florent Bersani has done a lot of work in this direction, and although >this has been in early 2004, the analysis is still up-to-date. > >The respective I-Ds are > >1) draft-bersani-eap-synthesis-sharedkeymethods-00.txt >e.g. available here: >http://ietfreport.isoc.org/idref/draft-bersani-eap-synthesis-sharedkeymethods/ > >2) draft-bersani-eap-sharedkeymethods-doctemplate-00.txt >e.g. available here: >ietfreport.isoc.org/idref/draft-bersani-eap-sharedkeymethods-doctemplate/ > >A second note. Although we agree that a pre-shared key EAP method must >be standardized, it is to discuss which features this method has to offer. > >I have collected my thoughts on this issue and put them into slides, >available here >http://www.tu-bs.de/~y0013790/IETF64-EMU-PresharedKeyMethods.pdf >and the source >http://www.tu-bs.de/~y0013790/IETF64-EMU-PresharedKeyMethods.ppt > >Probably they motivate a discussion at the EMU BOF. > >Thomas > > >_______________________________________________ >eap mailing list >eap@lists.frascone.com >http://lists.frascone.com/mailman/listinfo/eap > > > > _______________________________________________ SECMECH mailing list SECMECH@lists.ietf.org https://www1.ietf.org/mailman/listinfo/secmech From secmech-bounces@lists.ietf.org Wed Nov 09 02:40:36 2005 Received: from localhost.cnri.reston.va.us ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EZkZQ-0008WV-86; Wed, 09 Nov 2005 02:40:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EZkZO-0008W9-II for secmech@megatron.ietf.org; Wed, 09 Nov 2005 02:40:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA19756 for ; Wed, 9 Nov 2005 02:40:07 -0500 (EST) Received: from moutng.kundenserver.de ([212.227.126.188]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1EZkpJ-0003LA-LX for secmech@ietf.org; Wed, 09 Nov 2005 02:57:05 -0500 Received: from p213.54.66.249.tisdip.tiscali.de [213.54.66.249] (helo=[192.168.0.6]) by mrelayeu.kundenserver.de (node=mrelayeu7) with ESMTP (Nemesis), id 0ML2Dk-1EZkZD1PN7-0000cX; Wed, 09 Nov 2005 08:40:23 +0100 From: Thomas Otto To: eap@frascone.com, secmech@ietf.org Date: Wed, 9 Nov 2005 08:40:25 +0100 User-Agent: KMail/1.8.92 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200511090840.25449.t.otto@sharevolution.de> X-Provags-ID: kundenserver.de abuse@kundenserver.de login:3105fcefe481186a11ed9e9de1ccc56f X-Spam-Score: 0.2 (/) X-Scan-Signature: 7aefe408d50e9c7c47615841cb314bed Content-Transfer-Encoding: 7bit Cc: MCV@flarion.com Subject: [SECMECH] PSK-based EAP methods (correction) X-BeenThere: secmech@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Security mechanisms BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secmech-bounces@lists.ietf.org Errors-To: secmech-bounces@lists.ietf.org The slides about preshared key methods, http://www.tu-bs.de/~y0013790/IETF64-EMU-PresharedKeyMethods.pdf do not mention EAP-MAKE2. I apologize for this, and updated them just now. Thomas _______________________________________________ SECMECH mailing list SECMECH@lists.ietf.org https://www1.ietf.org/mailman/listinfo/secmech From secmech-bounces@lists.ietf.org Wed Nov 09 21:42:09 2005 Received: from localhost.cnri.reston.va.us ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ea2O9-0003Jq-Om; Wed, 09 Nov 2005 21:42:09 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ea2O8-0003I2-CY for secmech@megatron.ietf.org; Wed, 09 Nov 2005 21:42:08 -0500 Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA28894 for ; Wed, 9 Nov 2005 21:41:40 -0500 (EST) Received: from p130.piuha.net ([193.234.218.130]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Ea2eF-0002S4-MI for secmech@ietf.org; Wed, 09 Nov 2005 21:58:49 -0500 Received: from [127.0.0.1] (p130.piuha.net [193.234.218.130]) by p130.piuha.net (Postfix) with ESMTP id CF3C289863 for ; Thu, 10 Nov 2005 04:41:36 +0200 (EET) Message-ID: <4372A4D0.9020104@piuha.net> Date: Thu, 10 Nov 2005 03:39:28 +0200 From: Jari Arkko User-Agent: Mozilla Thunderbird 1.0 (X11/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: secmech@ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 Content-Transfer-Encoding: 7bit Cc: Subject: [SECMECH] new agenda X-BeenThere: secmech@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Security mechanisms BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secmech-bounces@lists.ietf.org Errors-To: secmech-bounces@lists.ietf.org We have most of our presentation materials for tomorrow's meeting up at the IETF proceedings site. The URL is https://datatracker.ietf.org/public/meeting_materials.cgi?meeting_num=64 We also have reorganized the agenda a little bit. Here's the latest agenda: INTRO AND BACKGROUND (15 min) o Agenda bashing, notes takers, blue sheets (Chairs, 5 min) o Background and relation to past SECMECH BOF and EAP WG work (Sam Hartman, 5 min) o Goals for the BoF (chairs, 5 min) TECHNICAL REQUIREMENTS (45 min) o EAP methods technical requirements (Bernard Aboba 15 min) o EAP methods, IEEE requirements (Chairs channeling Dorothy Stanley, 10 min) o Overview of proposed methods, credential types, and uses (Pasi Eronen, 20 min) DISCUSSION (40 min) o Discussion - Work Needed? (40 min) METHODS AND CLASSES OF METHODS (50 min) o EAP TLS issues and limitations (Aboba, 10 min) o PSK and IKEv2 (Hannes Tschofenig, 10 min) o PAX update, channel bindings (Charles Clancy, 15 min) o Shared secret methods (Thomas Otto, 5 min) o POTP (David Mitton, 10 min) _______________________________________________ SECMECH mailing list SECMECH@lists.ietf.org https://www1.ietf.org/mailman/listinfo/secmech From secmech-bounces@lists.ietf.org Wed Nov 09 21:47:18 2005 Received: from localhost.cnri.reston.va.us ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ea2T8-0005NB-Cx; Wed, 09 Nov 2005 21:47:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ea2T7-0005N3-1y for secmech@megatron.ietf.org; Wed, 09 Nov 2005 21:47:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA29196 for ; Wed, 9 Nov 2005 21:46:49 -0500 (EST) Received: from p130.piuha.net ([193.234.218.130]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Ea2jE-0002aX-CZ for secmech@ietf.org; Wed, 09 Nov 2005 22:03:57 -0500 Received: from [127.0.0.1] (p130.piuha.net [193.234.218.130]) by p130.piuha.net (Postfix) with ESMTP id 27F4789863 for ; Thu, 10 Nov 2005 04:47:01 +0200 (EET) Message-ID: <4372A615.7010507@piuha.net> Date: Thu, 10 Nov 2005 03:44:53 +0200 From: Jari Arkko User-Agent: Mozilla Thunderbird 1.0 (X11/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: secmech@ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Content-Transfer-Encoding: 7bit Cc: Subject: [SECMECH] Re: new agenda X-BeenThere: secmech@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Security mechanisms BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secmech-bounces@lists.ietf.org Errors-To: secmech-bounces@lists.ietf.org Oh. Some errors were still in the previous agenda. Here's the one that we intend to use: INTRO AND BACKGROUND (15 min) o Agenda bashing, notes takers, blue sheets (Chairs, 5 min) o Background and relation to past SECMECH BOF and EAP WG work (Sam Hartman, 5 min) o Goals for the BoF (chairs, 5 min) TECHNICAL REQUIREMENTS (45 min) o EAP methods technical requirements (Bernard Aboba 15 min) o EAP methods, IEEE requirements (Chairs channeling Dorothy Stanley, 10 min) o Overview of proposed methods, credential types, and uses (Pasi Eronen, 20 min) DISCUSSION (40 min) o Discussion - Work Needed? (40 min) METHODS AND CLASSES OF METHODS (50 min) o EAP TLS issues and limitations (Aboba, 10 min) o PSK and IKEv2 (Hannes Tschofenig, 10 min) o PAX update, channel bindings (Charles Clancy, 15 min) o MAKE2 (Michaela Vanderveen, 5 min) o POTP (David Mitton, 10 min) _______________________________________________ SECMECH mailing list SECMECH@lists.ietf.org https://www1.ietf.org/mailman/listinfo/secmech From secmech-bounces@lists.ietf.org Thu Nov 10 06:26:25 2005 Received: from localhost.cnri.reston.va.us ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EaAZU-0007vL-QA; Thu, 10 Nov 2005 06:26:24 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EaAZS-0007sG-Mv for secmech@megatron.ietf.org; Thu, 10 Nov 2005 06:26:22 -0500 Received: from swip.net (mailfe08.tele2.fr [212.247.154.236]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA25608 for ; Thu, 10 Nov 2005 06:25:52 -0500 (EST) X-T2-Posting-ID: TlrHmwDFCX01iQZd0Fm6v3T8FBlCqve5GwI1mWaefYU= Received: from [80.170.70.45] (HELO DELL.tele2.fr) by mailfe08.swip.net (CommuniGate Pro SMTP 5.0.1) with ESMTP id 5920392 for secmech@lists.ietf.org; Thu, 10 Nov 2005 12:25:49 +0100 Message-Id: <5.2.1.1.0.20051110122529.03731388@pop.tele2.fr> X-Sender: eu968071@pop.tele2.fr X-Mailer: QUALCOMM Windows Eudora Version 5.2.1 Date: Thu, 10 Nov 2005 12:25:50 +0100 To: secmech@ietf.org From: Pascal Urien Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Cc: Subject: [SECMECH] Are EAP-Methods RFIDs ? X-BeenThere: secmech@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Security mechanisms BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secmech-bounces@lists.ietf.org Errors-To: secmech-bounces@lists.ietf.org Hi Everybody, The TLS resume mode (RFC 2246, section 7.3) is a nice candidate for the PSK authentication class. The pre shared key is equal to the master secret, and is associated to a session-id that works like a login (EAP-ID,...). From a cryptographic point of view, some security proof are available, see for example http://www.cl.cam.ac.uk/users/lcp/papers/Auth/tls.pdf (4.6 Session Resumption) According to TLS properties many crypto suites can be used in order to proof the knowledge of the PSK (e.g the master secret), like RC4, DES, 3xDES, AES, ECC, . Because no certificates are used,.the number of exchanged bytes is quite small, around 200 bytes So what is wrong with EAP-TLS, with resume mode as PSK EAP method ? In EAP-TLS, EAP-SIM or EAP-AKA it's very easy to get, with no protection, the user ID, for example its permanent EAP-ID, certificates or full identity. It's mean that even when these protocols claim anonymity properties, it's possible to collect user's identities, which in many case is an issue for privacy. concerns. Are EAP methods really dealing today with user's privacy (from its identity protection point of view)? It seems that many EAP methods work like RFIDs. In http://www.ietf.org/internet-drafts/draft-badra-eap-double-tls-04.txt we propose to re-used the TLS resume mode, and we are focused on anonymity rather than introducing a new cryptographic issues. It doesn't look easy to conciliate mutual authentication and identity protection. On the peer side this should imply the secure storage of some information (like next identity, next EAP-ID, next protection key,...) computed during the last EAP session. As an illustration this secure storage could be assumed by smartcards, like described in http://www.ietf.org/internet-drafts/draft-urien-eap-smartcard-09.txt In my opinion there is strong need to ensure anonymity in EAP context. Do we intend to work on that subject ? Pascal _______________________________________________ SECMECH mailing list SECMECH@lists.ietf.org https://www1.ietf.org/mailman/listinfo/secmech From secmech-bounces@lists.ietf.org Thu Nov 10 11:41:53 2005 Received: from localhost.cnri.reston.va.us ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EaFUn-0007WV-KW; Thu, 10 Nov 2005 11:41:53 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EaFUl-0007Ts-Ly for secmech@megatron.ietf.org; Thu, 10 Nov 2005 11:41:52 -0500 Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15370 for ; Thu, 10 Nov 2005 11:41:22 -0500 (EST) Received: from ringding.cs.umd.edu ([128.8.129.2]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1EaFl0-0007bt-BB for secmech@ietf.org; Thu, 10 Nov 2005 11:58:39 -0500 Received: from wonka.cs.umd.edu (wonka.cs.umd.edu [128.8.128.198]) by ringding.cs.umd.edu (8.12.10/8.12.5) with ESMTP id jAAGfc1q018974; Thu, 10 Nov 2005 11:41:39 -0500 (EST) Date: Thu, 10 Nov 2005 11:41:38 -0500 (EST) From: "T. Charles Clancy" To: Pascal Urien Subject: Re: [SECMECH] Are EAP-Methods RFIDs ? In-Reply-To: <5.2.1.1.0.20051110122529.03731388@pop.tele2.fr> Message-ID: References: <5.2.1.1.0.20051110122529.03731388@pop.tele2.fr> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Score: 0.0 (/) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 Cc: secmech@ietf.org X-BeenThere: secmech@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Security mechanisms BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secmech-bounces@lists.ietf.org Errors-To: secmech-bounces@lists.ietf.org On Thu, 10 Nov 2005, Pascal Urien wrote: > The TLS resume mode (RFC 2246, section 7.3) is a nice candidate for the > PSK authentication class. The pre shared key is equal to the master > secret, and is associated to a session-id that works like a login > (EAP-ID,...). > > ... > > So what is wrong with EAP-TLS, with resume mode as PSK EAP method ? Perhaps TLS-PSK would be a more conventional way of doing about the same thing? http://www.ietf.org/internet-drafts/draft-ietf-tls-psk-09.txt > In EAP-TLS, EAP-SIM or EAP-AKA it's very easy to get, with no > protection, the user ID, for example its permanent EAP-ID, certificates > or full identity. It's mean that even when these protocols claim > anonymity properties, it's possible to collect user's identities, which > in many case is an issue for privacy. concerns. > > ... > > Are EAP methods really dealing today with user's privacy (from its > identity protection point of view)? It seems that many EAP methods work > like RFIDs. EAP-TLS does not provide identity protection. SIM and AKA use pseudonym-based approaches which have known faults. The tunneling methods PEAP, TTLS, and FAST all provide secure identity protection via public-key approaches, as does PAX. > It doesn't look easy to conciliate mutual authentication and identity > protection. On the peer side this should imply the secure storage of > some information (like next identity, next EAP-ID, next protection > key,...) computed during the last EAP session. > > ... > > In my opinion there is strong need to ensure anonymity in EAP context. > Do we intend to work on that subject ? I don't see what the issue is... we have several methods already that accomplish mutual authentication and identity protection. If you want to do secure identity protection *without* public key computations, it gets a little tricker. You'll have to use a pseudonym-type scheme, which has desynchronization problems. I don't see how adding smartcards really changes anything. In the IETF we're focused on protocols, not secure data storage. Distinguising smartcard use would be like having a different EAP method depending on whether you were authenticating from a laptop vs a desktop. [ t. charles clancy ]--[ tcc@umd.edu ]--[ www.cs.umd.edu/~clancy ] [ computer science ]-----[ university of maryland | college park ] _______________________________________________ SECMECH mailing list SECMECH@lists.ietf.org https://www1.ietf.org/mailman/listinfo/secmech From secmech-bounces@lists.ietf.org Fri Nov 11 14:21:38 2005 Received: from localhost.cnri.reston.va.us ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EaeSw-00005x-Bw; Fri, 11 Nov 2005 14:21:38 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EaeSu-00005U-Nb for secmech@megatron.ietf.org; Fri, 11 Nov 2005 14:21:37 -0500 Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29308 for ; Fri, 11 Nov 2005 14:21:06 -0500 (EST) Received: from sj-iport-1-in.cisco.com ([171.71.176.70] helo=sj-iport-1.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1EaejN-0001zY-EH for secmech@ietf.org; Fri, 11 Nov 2005 14:38:38 -0500 Received: from sj-core-5.cisco.com ([171.71.177.238]) by sj-iport-1.cisco.com with ESMTP; 11 Nov 2005 11:21:26 -0800 X-IronPort-AV: i="3.99,119,1131350400"; d="scan'208"; a="674076440:sNHT28404424" Received: from E2K-SEA-XCH2.sea-alpha.cisco.com (e2k-sea-xch2.cisco.com [10.93.132.68]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id jABJLNZC020518; Fri, 11 Nov 2005 11:21:24 -0800 (PST) X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Date: Fri, 11 Nov 2005 11:27:04 -0800 Message-ID: <7210B31550AC934A8637D6619739CE690638754B@e2k-sea-xch2.sea-alpha.cisco.com> Thread-Topic: EMU BOF Summary Thread-Index: AcXm9RrDz7/qizTQRQmdw+HVwWP30g== From: "Salowey, Joe" To: , , X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: quoted-printable Cc: Subject: [SECMECH] EMU BOF Summary X-BeenThere: secmech@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Security mechanisms BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secmech-bounces@lists.ietf.org Errors-To: secmech-bounces@lists.ietf.org EAP Method Update (EMU) BOF Thursday, November 10, 2005 9:00 - 11:00 AM This was a continuation of the SECMECH BOF from last IETF, but it focused on the EAP method standardization work item. The goal of the BOF was to determine if there was interest to work on the standardization of a small number of EAP methods. There were presentations on requirements for EAP methods and different types of methods. We had a discussion on the different types of credentials and authentication infrastructures that methods can support. In the end we reached consensus to create a working group to look at three things:=20 (1) an update of EAP-TLS for certificate-based infrastructure=20 (2) a method based on strong shared secrets (3) a method based on using existing password infrastructure such as AAA servers password databases It would be better if some of these requirements could be combined into one mechanism, however it was brought up that this may not be possible to do and still maintain compact mechanism implementations that are usable in constrained environments. After these work items are done it will be possible to add additional items to the working group charter to work on additional methods. The meeting concluded with presentations on several EAP method drafts. =20 _______________________________________________ SECMECH mailing list SECMECH@lists.ietf.org https://www1.ietf.org/mailman/listinfo/secmech