WDIFF

draft-ietf-eap-rfc2284bis-02.txt --> draft-ietf-eap-rfc2284bis-03.txt

EAP Working Group L. Blunk
Internet-Draft Merit Network, Inc
Obsoletes: 2284 (if approved) J. Vollbrecht
Expires: July 2, November 14, 2003 Vollbrecht Consulting LLC
B. Aboba
Microsoft
J. Carlson
Sun
H. Levkowetz, Ed.
ipUnplugged
January
May 16, 2003

Extensible Authentication Protocol (EAP)
<draft-ietf-eap-rfc2284bis-02.txt>
<draft-ietf-eap-rfc2284bis-03.txt>

Status of this Memo

This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026.

Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that other
groups may also distribute working documents as Internet-Drafts.

Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."

The list of current Internet-Drafts can be accessed at http://
www.ietf.org/ietf/1id-abstracts.txt.

The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.

This Internet-Draft will expire on July 2, November 14, 2003.

Abstract

This document defines the Extensible Authentication Protocol (EAP),
an authentication framework which supports multiple authentication
mechanisms.
methods. EAP typically runs directly over the data link layer without
requiring IP, but is reliant on lower layer ordering guarantees layers such as in
PPP and or IEEE 802. 802, without requiring IP. EAP does provide provides its own support
for duplicate elimination and retransmission, but is reliant on lower

Blunk, et al. Expires July 2, November 14, 2003 [Page 1]

Internet-Draft EAP January May 2003

elimination and retransmission.

layer ordering guarantees. Fragmentation is not supported within EAP
itself; however, individual EAP methods may support this.
While EAP was originally developed for use with PPP, it is also now
in use with IEEE 802.

This document obsoletes RFC 2284. A summary of the changes between
this document and RFC 2284 is available in Appendix B.

Table of Contents

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4
1.1 Specification of Requirements . . . . . . . . . . . . . . . 4
1.2 Terminology . . . . . . . . . . . . . . . . . . . . . 4
1.3 Security claims terminology for EAP methods . . . 4 . . 5
2. Extensible Authentication Protocol (EAP) . . . . . . . . . . 7 9
2.1 Support for sequences . . . . . . . . . . . . . . . . . . . 9 10
2.2 EAP multiplexing model . . . . . . . . . . . . . . . . . . . 10 11
3. Lower layer behavior . . . . . . . . . . . . . . . . . . . . 12 14
3.1 Lower layer requirements . . . . . . . . . . . . . . . . . . 12 14
3.2 EAP usage within PPP . . . . . . . . . . . . . . . . . 16
3.2.1 PPP Configuration Option Format . . . . . . . . 14 16
3.3 EAP usage within IEEE 802 . . . . . . . . . . . . . . . . . 15 17
3.4 Link Lower layer indications . . . . . . . . . . . . . . . . . . . 15 17
4. EAP Packet format . . . . . . . . . . . . . . . . . . . . . 16 17
4.1 Request and Response . . . . . . . . . . . . . . . . . . . . 17 18
4.2 Success and Failure . . . . . . . . . . . . . . . . . . . . 20 21
5. Initial EAP Request/Response Types . . . . . . . . . . . . . 21 23
5.1 Identity . . . . . . . . . . . . . . . . . . . . . . . 23
5.2 Notification . . . 22
5.2 Notification . . . . . . . . . . . . . . . . . . 24
5.3 Nak . . . . . . 23
5.3 . . . . . . . . . . . . . . . . . . . 25
5.3.1 Legacy Nak . . . . . . . . . . . . . . . . . . . 25
5.3.2 Expanded Nak . . . . . . . . . . . . . 23
5.4 MD5-Challenge . . . . . 26
5.4 MD5-Challenge . . . . . . . . . . . . . . . . . . . . 27 28
5.5 One-Time Password (OTP) . . . . . . . . . . . . . . . . . . 28 30
5.6 Generic Token Card (GTC) . . . . . . . . . . . . . . . . . . 29 31
5.7 Expanded types . . . Types . . . . . . . . . . . . . . . . . . . . 30 32
5.8 Experimental . . . . . . . . . . . . . . . . . . . . . . . . 31 33
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . 32 34
6.1 Definition of Terms Packet Codes . . . . . . . . . . . . . . . . . . . . 32 . 35
6.2 Recommended Registration Policies Method Types . . . . . . . . . . . . . 32 . . . . . . . . 35
7. Security Considerations . . . . . . . . . . . . . . . . . . 33 35
7.1 Threat model . . . . . . . . . . . . . . . . . . . . . . . . 34 36
7.2 Security claims . . . . . . . . . . . . . . . . . . . . . . 34 37
7.3 Identity protection . . . . . . . . . . . . . . . . . . . . 36 38
7.4 Man-in-the-middle attacks . . . . . . . . . . . . . . . . . 36 38
7.5 Packet modification attacks . . . . . . . . . . . . . . . . 37 39
7.6 Dictionary attacks . . . . . . . . . . . . . . . . . . . . . 38 40
7.7 Connection to an untrusted network . . . . . . . . . . . . . 38 40
7.8 Negotiation attacks . . . . . . . . . . . . . . . . . . . . 38 41
7.9 Implementation idiosyncrasies . . . . . . . . . . . . . . . 39 41

Blunk, et al. Expires November 14, 2003 [Page 2]

Internet-Draft EAP May 2003

7.10 Key derivation . . . . . . . . . . . . . . . . . . . . . . . 39 41
7.11 Weak ciphersuites . . . . . . . . . . . . . . . . . . . . . 41

Blunk, et al. Expires July 2, 2003 [Page 2]

Internet-Draft EAP January 2003 42
7.12 Link layer . . . . . . . . . . . . . . . . . . . . . . . . . 41 43
7.13 Separation of EAP server and authenticator and backend authentication
server . . . . . . . . . 42
7.14 Strict Interpretation . . . . . . . . . . . . . . . . . . . 42 44
8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . 43 45
Normative References . . . . . . . . . . . . . . . . . . . . 43 45
Informative References . . . . . . . . . . . . . . . . . . . 44 46
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 46 48
A. Method Specific Behavior . . . . . . . . . . . . . . . . . . 47 49
A.1 Message Integrity Checks . . . . . . . . . . . . . . . . . . 47 49
B. Changes from RFC 2284 . . . . . . . . . . . . . . . . . . . 48 50
C. Open issues . . . . . . . . . . . . . . . . . . . . . . . . 49 51
Intellectual Property and Copyright Statements . . . . . . . 50 53

Blunk, et al. Expires July 2, November 14, 2003 [Page 3]

Internet-Draft EAP January May 2003

1. Introduction

EAP may be used on dedicated links as well as switched circuits, and
wired as well as wireless links. To date, EAP has been implemented
with hosts and routers that connect via switched circuits or dial-up
lines using PPP [RFC1661]. It has also been implemented with switches
and access points using IEEE 802 [IEEE.802.1990]. [IEEE-802]. EAP encapsulation on
IEEE 802 wired media is described in [IEEE.802-1X.2001]. [IEEE-802.1X], and encapsulation
on IEEE wireless LANs in [IEEE-802.11i].

One of the advantages of the EAP architecture is its flexibility. EAP
is used to select a specific authentication mechanism, typically
after the authenticator requests more information in order to
determine the specific authentication mechanism(s) method to be used. Rather than
requiring the authenticator to be updated to support each new
authentication method, EAP permits the use of a backend
authentication server which may implement some or all authentication
methods, with the authenticator acting as a pass-through for some or
all methods and users. peers.

Within this document, authenticator requirements apply regardless of
whether the authenticator is operating as a pass-through or not.
Where the requirement is meant to apply to either the authenticator
or backend authentication server, depending on where the EAP
authentication is terminated, the term "EAP server" will be used.

1.1 Specification of Requirements

In this document, several words are used to signify the requirements
of the specification. These words are often capitalized. The key
words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD",
"SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document
are to be interpreted as described in [RFC2119].

1.2 Terminology

This document frequently uses the following terms:

Blunk, et al. Expires November 14, 2003 [Page 4]

Internet-Draft EAP May 2003

authenticator
The end of the EAP link initiating the EAP authentication
methods. [Note: This terminology authentication. The
term Authenticator is also used in

Blunk, et al. Expires July 2, 2003 [Page 4]

Internet-Draft EAP January 2003

[IEEE.802-1X.2001], [IEEE-802.1X], and
authenticator has the same meaning in this
document]. document.

peer
The end of the EAP Link that responds to the authenticator.
[Note:In [IEEE.802-1X.2001],
In [IEEE-802.1X], this end is known as the
Supplicant.] Supplicant.

backend authentication server
A backend authentication server is an entity that provides
an authentication service to an authenticator. When used,
this server typically executes EAP Methods methods for the
authenticator. [This This terminology is also used in
[IEEE.802-1X.2001].]
[IEEE-802.1X].

Displayable Message
This is interpreted to be a human readable string of
characters, and MUST NOT affect operation of the protocol.
characters. The message encoding MUST follow the UTF-8
transformation format [RFC2279].

EAP server
The entity that terminates the EAP authentication method
with the peer. In the case where no backend authentication
server is used the EAP server is part of the authenticator.
In the case where the authenticator operates in pass
through
pass-through mode, the EAP server is located on the backend
authentication server.

Silently Discard
This means the implementation discards the packet without
further processing. The implementation SHOULD provide the
capability of logging the event, including the contents of
the silently discarded packet, and SHOULD record the event
in a statistics counter.

1.3 Security claims terminology for EAP Methods (see Section 7.2): methods

These terms are used to described the security properties of EAP
methods:

Mutual authentication
This refers to an EAP method in which, within an
interlocked exchange, the authenticator authenticates the
peer and the peer authenticates the authenticator. Two
independent one-way methods, running in opposite directions
do not provide mutual authentication as defined here.

Blunk, et al. Expires November 14, 2003 [Page 5]

Internet-Draft EAP May 2003

Integrity protection
This refers to providing data origin authentication and
protection against unauthorized modification of information

Blunk, et al. Expires July 2, 2003 [Page 5]

Internet-Draft EAP January 2003
for EAP packets (including EAP Requests and Responses).
When making this claim, a method specification MUST
describe the EAP packets and fields within the EAP packet
that are protected.

Replay protection
This refers to protection against replay of an EAP method
or its messages, including EAP Requests and Responses, and method-specific success and
failure indications.

Confidentiality
This refers to encryption of EAP messages, including EAP
Requests and Responses, and method-specific success and
failure indications. A method making this claim MUST
support identity protection. protection (see Section 7.3).

Key derivation
This refers to the ability of the EAP method to derive a
Master Key which is not exported, as well
exportable keying material such as a ciphersuite-
independent Master Session Keys. Both the Master Session Key
(MSK), and Extended Master Session Keys are Key (EMSK). The MSK is
used only for further key derivation, not directly for
protection of the EAP conversation or subsequent data. Use
of the EMSK is reserved.

Key strength
If the effective key strength is N bits, the best currently
known methods to recover the key (with non-negligible
probability) require an effort comparable to 2^N operations
of a typical block cipher.

Dictionary attack resistance
Where password authentication is used, users are
notoriously prone to select poor passwords. A method may
be said to be dictionary attack resistant if, when there is
a weak password in the secret, the method does not allow
an attack more efficient than brute force.

Fast reconnect
The ability, in the case where a security association has
been previously established, to create a new or refreshed
security association in a smaller number of round-trips.

Man-in-the-Middle resistance
The ability
This property applies only for the use of multiple methods
in a combination, such as in authentication sequences or

Blunk, et al. Expires November 14, 2003 [Page 6]

Internet-Draft EAP May 2003

tunnels. It refers to the ability of the peer to
demonstrate to the authenticator that it has acted as the
peer for each authentication method within the
conversation. Similarly, the authenticator demonstrates to
the peer that it has acted as the authenticator for each
authentication method within the conversation. If

Blunk, et al. Expires July 2, 2003 [Page 6]

Internet-Draft EAP January 2003 this is
not possible, then the authentication sequence or
tunnel there may be vulnerable a vulnerability to a
man-in-the-middle attack.

Acknowledged result indications
The ability of the authenticator to provide the peer with
an indication of whether the peer has successfully
authenticated to it, and for the peer to acknowledge
receipt, as well as providing an indication of whether the
authenticator has successfully authenticated to the peer.
Since EAP Success and Failure packets are neither
acknowledged nor integrity protected, this claim requires
implementation of a method- specific method-specific result exchange that is
authenticated, integrity protected.

2. Extensible Authentication Protocol (EAP)

The EAP authentication exchange proceeds as follows:

[1] The authenticator sends a Request to authenticate the peer. The
Request has and replay protected on a type field to indicate what is being requested.
Examples of Request types include Identity, MD5-challenge, etc.
The MD5-challenge type corresponds closely to the CHAP
per-packet basis.

Message Integrity Check (MIC)
A keyed hash function used for authentication protocol [RFC1994]. Typically, the authenticator
will send an initial Identity Request; however, an initial
Identity Request is not required, and MAY be bypassed. For
example, the identity may not be required where it integrity
protection of data. This is determined
by usually called a Message
Authentication Code (MAC), but IEEE 802 specifications (and
this document) use the port acronym MIC to which avoid confusion with
Medium Access Control.

Cryptographic binding
The demonstration of the EAP peer to the EAP server that a
single entity has connected (leased lines,
dedicated switch or dial-up ports); or where acted as the identity is
obtained in another fashion (via calling station identity EAP peer for all methods
executed within a sequence or MAC
address, in tunnel. Binding MAY also
imply that the Name field of EAP server demonstrates to the MD5-Challenge Response, etc.).

[2] The peer sends a Response packet in reply to that a valid Request. As
with
single entity has acted as the Request packet the Response packet contains EAP server for all methods
executed within a Type
field, which corresponds sequence or tunnel. If executed
correctly, binding serves to mitigate man-in-the-middle
vulnerabilities.

Cryptographic separation
Two keys (x and y) are "cryptographically separate" if an
adversary that knows all messages exchanged in the Type field of protocol
cannot compute x from y or y from x without "breaking" some
cryptographic assumption. In particular, this definition
allows that the Request.

[3] The authenticator sends an additional Request packet, and adversary has the
peer replies with a Response. The sequence knowledge of Requests and
Responses continues all nonces
sent in cleartext as long well as needed. EAP is a 'lock step'
protocol, so that other than all predictable counter values
used in the initial Request, a new Request
cannot be sent prior to receiving protocol. Breaking a valid Response. The
Authenticator MUST NOT send cryptographic assumption
would typically require inverting a Success one- way function or Failure packet as a
result
predicting the outcome of a timeout. After a suitable number of timeouts have
elapsed, the Authenticator SHOULD end the EAP conversation.

[4] The conversation continues until the authenticator cannot
authenticate the peer (unacceptable Responses to one or more
Requests), in which case the authenticator implementation MUST cryptographic pseudo- random

Blunk, et al. Expires July 2, November 14, 2003 [Page 7]

Internet-Draft EAP January May 2003

transmit an EAP Failure (Code 4). Alternatively,

number generator without knowledge of the
authentication conversation can continue until secret state. In
other words, if the authenticator
determines that successful authentication has occurred, in which
case keys are cryptographically separate,
there is no shortcut to compute x from y or y from x, but
the authenticator MUST transmit work an adversary must do to perform this computation
is equivalent to performing exhaustive search for the
secret state value."

EAP Success (Code 3).

Since Master key (MK)
A key derived between the EAP is a peer-to-peer protocol, an independent client and simultaneous
authentication may take place in the reverse direction. Both peers
may act as authenticators and authenticatees at server during the same time.

Advantages
The
EAP protocol can support multiple authentication mechanisms
without having process that is purely local to pre-negotiate a particular one.

Devices (e.g. a NAS, switch the EAP
method. The MK MUST NOT be exported from the EAP method or access point) do not have
be made available to
understand each authentication method and MAY act as a
pass-through agent for third party. Since derivation of
the MK is a backend residue of the successful completion of the EAP
authentication server. Support
for pass-through is optional. An authenticator MAY authenticate
local users while at exchange, proof of MK possession may be used
to shorten future EAP exchanges between the same time acting as EAP client
and server, a pass-through for
non-local users technique known as "fast resume".

Master Session Key (MSK)
Keying material that is derived between the EAP client and authentication methods it does not implement
locally.

For sessions
server. The MSK is used in which the authenticator acts as a pass-through, it
MUST determine the outcome derivation of Transient
Session Keys (TSKs) for the authentication solely based on
the Accept/Reject indication sent by ciphersuite negotiated between
the EAP peer and authenticator. Where a backend
authentication
server; the outcome MUST NOT be determined by the contents of server is present, acting as an EAP packet sent along with server,
it will typically transport the Accept/Reject indication, or MSK to the authenticator.

The MSK differs from the MK in that it not assumed to
remain local to the
absence of such an encapsulated EAP packet.

Separation of method, and is known by all parties
in the EAP exchange: the peer, authenticator from and the backend
authentication server simplifies credentials management and policy decision
making.

Disadvantages
For use in PPP, EAP does require the addition of a new
authentication type to PPP LCP and thus PPP implementations will
need to (if present). The MSK MAY be modified to use it. It also strays derived
from the previous
PPP authentication model of negotiating MK via a specific authentication
mechanism during LCP. Similarly, switch one-way function, or access point
implementations need to support [IEEE.802-1X.2001] it may be an
independent quantity. However possession of the MSK MUST
NOT provide any information useful in order to use
EAP.

Where determining the authenticator MK.

Extended Master Session Key (EMSK)
Additional keying material derived between the EAP client
and server that is separate from exported by the EAP method. However,
unlike the MSK, the EMSK is known only to the EAP peer and
EAP server and MUST NOT be provided to a third party. The
EMSK therefore MUST NOT be transported by the backend
authentication server, this complicates server to the security analysis and,
if needed, key distribution. authenticator. The EMSK is
reserved for future uses that are not defined yet. For
example, it could be used to derive additional keying
material for purposes such as fast handoff,
man-in-the-middle vulnerability protection, etc.

Blunk, et al. Expires July 2, November 14, 2003 [Page 8]

Internet-Draft EAP January May 2003

2.1 Support for sequences

An EAP conversation MAY utilize a sequence of methods. A common
example of this is an Identity request followed by a single

2. Extensible Authentication Protocol (EAP)

The EAP authentication method such exchange proceeds as an MD5-Challenge. However follows:

[1] The authenticator sends a peer MUST
utilize only one authentication method (Type 4 or greater) within an
EAP conversation, after which Request to authenticate the authenticator MUST send peer. The
Request has a Success
or Failure packet. As a result, Identity Requery Type field to indicate what is not supported.

Once a peer has sent a Response being requested.
Examples of the same Type as the initial
Request, an authenticator MUST NOT send a Request of a different Types include Identity, MD5-challenge, etc.
The MD5-challenge Type
prior corresponds closely to completion of the final round of a given method (with CHAP
authentication protocol [RFC1994]. Typically, the
exception of a Notification-Request) and MUST NOT authenticator
will send a Request for an additional method of any Type after completion of the initial
authentication method.

Supporting multiple authentication methods within Identity Request; however, an EAP conversation
would add complexity to the EAP protocol, would enable
man-in-the-middle attacks (see Section 7.4), initial
Identity Request is not required, and would result in
interoperability problems, since existing EAP implementations
typically do MAY be bypassed. For
example, the identity may not support multiple authentication methods.

If an additional authentication method be required where it is requested determined
by the
authenticator, port to which the peer has connected (leased lines,
dedicated switch or if dial-up ports); or where the authenticator identity is
obtained in another fashion (via calling station identity or MAC
address, in the Name field of the MD5-Challenge Response, etc.).

[2] The peer sends a Response packet in reply to a valid Request. As
with the Request of packet the Response packet contains a different Type prior
field, which corresponds to completion of the final round Type field of a given method, the
peer SHOULD silently discard the Request. A peer MUST NOT send a Nak
(legacy or expanded) in reply to a Request, after

[3] The authenticator sends an initial non-Nak
Response has been sent. Since spoofed EAP additional Request packets may be sent
by an attacker, an an authenticator receiving an unexpected Nak
SHOULD silently discard it packet, and log the event.

Where
peer replies with a single Response. The sequence of Requests and
Responses continues as long as needed. EAP authentication method is utilized, but a 'lock step'
protocol, so that other
methods are run within it (e.g. "tunneled" methods) than the prohibition
against multiple authentication methods does not apply. Such
"tunneled" methods appear as initial Request, a single authentication method to EAP.
Backward compatibility can new Request
cannot be provided, since a peer not supporting a
"tunneled" method can reply sent prior to the initial EAP-Request with receiving a Nak. To
address security vulnerabilities, "tunneled" methods valid Response. The
authenticator MUST support
protection against man-in-the-middle attacks.

Within NOT send a Success or associated with each authenticator, it is not anticipated
that Failure packet as a particular named peer will support
result of a choice timeout. After a suitable number of methods. This
would make the peer vulnerable to attacks that negotiate timeouts have
elapsed, the least
secure method from among a set (negotiation attacks, described in
Section 7.8). Instead, for each named peer there authenticator SHOULD be an
indication of exactly one method used to end the EAP conversation.

[4] The conversation continues until the authenticator cannot
authenticate that peer name.
If a the peer needs (unacceptable Responses to make use of different authentication methods under
different circumstances, then distinct identities SHOULD be employed,

Blunk, et al. Expires July 2, 2003 [Page 9]

Internet-Draft EAP January 2003

each of which identifies exactly one authentication method.

2.2 EAP multiplexing model

Conceptually, EAP implementations consist of or more
Requests), in which case the following
components:

[a] Lower layer. The lower layer is responsible for transmitting and
receiving authenticator implementation MUST
transmit an EAP frames between Failure (Code 4). Alternatively, the peer and authenticator. EAP
authentication conversation can continue until the authenticator
determines that successful authentication has
been run over a variety of lower layers including PPP; wired IEEE
802 LANs [IEEE.802-1X.2001]; IEEE 802.11 wireless LANs
[IEEE.802-11.1999]; UDP (L2TP [RFC2661] and ISAKMP [PIC]); and
TCP [PIC]. Lower layer behavior is discussed occurred, in Section 3.

[b] EAP layer. The EAP layer receives and transmits EAP packets via
the lower layer, implements the EAP state machine, and delivers
and receives EAP messages to and from EAP methods.

[c] EAP method. EAP methods implement which
case the authentication algorithms
and receive and authenticator MUST transmit an EAP messages via the EAP layer. Success (Code 3).

Since
fragmentation support is not provided by EAP itself, this is a peer-to-peer protocol, an independent and simultaneous
authentication may take place in the
responsibility reverse direction. Both peers
may act as authenticators and authenticatees at the same time. For a
discussion of EAP methods, which are discussed security issues in peer-to-peer operation, see Section 5.
7.7.

Advantages:

o The EAP multiplexing model is illustrated in figure 1 below. Note
that there is no requirement that an implementation conform protocol can support multiple authentication mechanisms
without having to this
model, as long as the on-the-wire behavior is consistent with it. pre-negotiate a particular one.

Blunk, et al. Expires July 2, November 14, 2003 [Page 10] 9]

Internet-Draft EAP January May 2003

+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+
| | | | | |
| EAP method| EAP method| | EAP method| EAP method|
| Type = X | Type = Y | | Type = X | Type = Y |
| V | | | ^ | |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
| ! | | ! |
| EAP ! Layer | | EAP ! Layer |
| ! | | ! |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
| ! | | ! |
| Lower ! Layer | | Lower ! Layer |
| ! | | ! |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
! !
! Peer ! Authenticator
+------------>-------------+

Figure 1: EAP Multiplexing Model

Within EAP, the Type field functions much like

o Network Access Server (NAS) devices (e.g., a port number in UDP switch or TCP. With access
point) do not have to understand each authentication method and
MAY act as a pass-through agent for a backend authentication
server. Support for pass-through is optional. An authenticator
MAY authenticate local peers while at the exception same time acting as a
pass-through for non-local peers and authentication methods it
does not implement locally.

o Separation of Types handled by the EAP layer, it is
assumed that authenticator from the backend authentication
server simplifies credentials management and policy decision
making.

Disadvantages:

o For use in PPP, EAP layer multiplexes incoming EAP packets according does require the addition of a new
authentication Type to their Type, PPP LCP and delivers them only thus PPP implementations will
need to be modified to use it. It also strays from the EAP method corresponding previous
PPP authentication model of negotiating a specific authentication
mechanism during LCP. Similarly, switch or access point
implementations need to that Type code, with one exception.

Since EAP methods may wish support [IEEE-802.1X] in order to access use EAP.

o Where the Identity, authenticator is separate from the Identity
Response can be assumed to be stored within backend
authentication server, this complicates the security analysis and,
if needed, key distribution.

2.1 Support for sequences

An EAP layer so as to be
available to methods conversation MAY utilize a sequence of Types other than 1 (Identity). The Identity
Type is discussed in Section 5.1. methods. A Notification Response common
example of this is only used an Identity request followed by a single EAP
authentication method such as confirmation that an MD5-Challenge. However the peer
received the Notification Request, not that it has processed it, and
authenticator MUST utilize only one authentication method (Type 4 or
displayed the message to the user. It cannot be assumed that
greater) within an EAP conversation, after which the
contents authenticator
MUST send a Success or Failure packet.

Once a peer has sent a Response of the Notification same Type as the initial
Request, an authenticator MUST NOT send a Request or Response is available to
another method. The Notification of a different Type is discussed in Section 5.2.

The Nak method is utilized for
prior to completion of the purposes final round of a given method negotiation.
Peers (with the
exception of a Notification-Request) and MUST respond to an EAP NOT send a Request for
an unacceptable additional method of any Type with a
Nak Response (legacy or expanded). It cannot be assumed that the
contents after completion of the Nak Response initial
authentication method; a peer receiving such Requests MUST treat them
as invalid, and silently discard them. As a result, Identity Requery
is available to another method. The not supported.

A peer MUST NOT send a Nak
Type is discussed (legacy or expanded) in Section 5.3.

EAP packets with codes of Success or Failure do not include a Type,
and therefore are not delivered reply to a
Request, after an initial non-Nak Response has been sent. Since
spoofed EAP method. Success and Failure
are discussed in Section 4.2.

Given these considerations, the Success, Failure, Request packets may be sent by an attacker, an
authenticator receiving an unexpected Nak Response and SHOULD silently discard it

Blunk, et al. Expires July 2, November 14, 2003 [Page 11] 10]

Internet-Draft EAP January May 2003

Notification Request/Response messages MUST NOT be used

and log the event.

Multiple authentication methods within an EAP conversation are not
supported due to carry data
destined for delivery their vulnerability to other EAP methods. man-in-the-middle attacks
(see Section 7.4) and incompatibility with existing implementations.

Where a pass-through authenticator single EAP authentication method is present, utilized, but other
methods are run within it forwards packets
back and forth between (a "tunneled" method) the peer and prohibition
against multiple authentication methods does not apply. Such
"tunneled" methods appear as a backend single authentication server,
based on the EAP layer header fields (Code, Identifier, Length).
Since pass-through authenticators rely on method to EAP.
Backward compatibility can be provided, since a backend authenticator
server peer not supporting a
"tunneled" method can reply to implement methods, the initial EAP-Request with a Nak
(legacy or expanded). To address security vulnerabilities,
"tunneled" methods MUST support protection against man-in-the-middle
attacks.

2.2 EAP method layer header fields
(Type, Type-Data) are not examined as part multiplexing model

Conceptually, EAP implementations consist of the forwarding
decision. following
components:

[a] Lower layer. The forwarding model lower layer is illustrated in Figure 2. Compliant
pass-through authenticator implementations MUST by default be capable
of forwarding packets from any responsible for transmitting and
receiving EAP method.

Peer Pass-through Authenticator Authentication
Server

+-+-+-+-+-+-+ +-+-+-+-+-+-+
| | | |
|EAP method frames between the peer and authenticator. EAP has
been run over a variety of lower layers including PPP; wired IEEE
802 LANs [IEEE-802.1X]; IEEE 802.11 wireless LANs [IEEE-802.11];
UDP (L2TP [RFC2661] and ISAKMP [PIC]); and TCP [PIC]. Lower layer
behavior is discussed in Section 3.

[b] EAP layer. The EAP layer receives and transmits EAP packets via
the lower layer, implements duplicate detection and
retransmission, and delivers and receives EAP messages to and
from EAP methods.

[c] EAP method. EAP methods implement the authentication algorithms
and receive and transmit EAP messages via the EAP layer. Since
fragmentation support is not provided by EAP itself, this is the
responsibility of EAP methods, which are discussed in Section 5.

The EAP multiplexing model is illustrated in Figure 1 below. Note
that there is no requirement that an implementation conform to this
model, as long as the on-the-wire behavior is consistent with it.

Blunk, et al. Expires November 14, 2003 [Page 11]

Internet-Draft EAP May 2003

+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+
| |EAP method | | Layer | | Layer |
| V EAP method| EAP method| | EAP method| EAP method|
| ^ Type = X |
+-+-+-!-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-!-+-+-+ Type = Y | ! | Type = X | Type = Y |
| V | ! |
|EAP !Layer| | EAP Layer ^ | EAP Layer | |EAP !Layer|
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
| ! | | +-----+-----+ | | ! |
| EAP ! Layer | | EAP ! | ! Layer |
| ! |
+-+-+-!-+-+-+ +-+-+-!-+-+-+-+-+-!-+-+-+ +-+-+-!-+-+-+ | ! |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
| ! | ! | | ! |
|Lower!Layer| |Lower!Layer| AAA ! /IP |
| AAA Lower ! /IP Layer | | Lower ! Layer |
| ! | ! | | ! |
+-+-+-!-+-+-+ +-+-+-!-+-+-+-+-+-!-+-+-+ +-+-+-!-+-+-+
! !
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
! !
! Peer ! ! !
+-------->-----+ +------->------+

Figure 2: Pass-through Authenticator

3. Lower layer behavior

3.1 Lower layer requirements
+------------>-------------+

Figure 1: EAP makes Multiplexing Model

Within EAP, the following assumptions about lower layers:

[1] Lower layer CRC Type field functions much like a port number in UDP
or checksum TCP. It is not necessary. In EAP, the
authenticator retransmits Requests that have not yet received
Responses, so that EAP does not assume assumed that lower layers are

Blunk, et al. Expires July 2, 2003 [Page 12]

Internet-Draft the EAP January 2003

reliable. Since layer multiplexes incoming EAP defines its own retransmission behavior,
when run over a reliable lower layer, it is possible (though
undesirable) for retransmission
packets according to occur both in the lower layer their Type, and delivers them only to the EAP layer.

If lower layers exhibit a high loss rate, then retransmissions
are likely, and since EAP Success and Failure are not
retransmitted, timeouts are also likely
method corresponding to result. EAP methods
such as that Type code.

Since EAP TLS [RFC2716] include a message integrity check (MIC)
and regard MIC errors as fatal. Therefore if a checksum or CRC is
not provided by the lower layer, then some authentication methods may not behave
well.

[2] Lower layer data security. After EAP authentication is complete,
the peer will typically transmit data wish to access the network, through Identity, the
authenticator. In order
Identity Request and Response can be assumed to provide assurance be accessible to
authentication methods (Types 4 or greater) in addition to the
Identity method. The Identity Type is discussed in Section 5.1.

A Notification Response is only used as confirmation that the peer
transmitting data is
received the one Notification Request, not that successfully completed EAP
authentication, it is necessary for the lower layer to provide
per- packet integrity, authentication and replay protection that
is bound to the original EAP authentication, has processed it, or for
displayed the lower
layer message to the user. It cannot be physically secure. Otherwise it assumed that the
contents of the Notification Request or Response is possible for
subsequent data traffic available to be hijacked,
another method. The Notification Type is discussed in Section 5.2.

Nak (Type 3) or replayed.

As a result Expanded Nak (Type 254) are utilized for the purposes
of these considerations, method negotiation. Peers respond to an initial EAP SHOULD be used only when
lower layers provide physical security Request for data (e.g. wired PPP
or IEEE 802 links),
an unacceptable Type with a Nak Response (Type 3) or for insecure links, where per-packet
authentication, integrity and replay protection is provided.
Where keying material for the lower layer ciphersuite is itself
provided by EAP, typically the lower layer ciphersuite Expanded Nak
Response (Type 254). It cannot be
enabled until late in the EAP conversation, after key derivation
has completed. Thus it may only be possible to use assumed that the lower
layer ciphersuite to protect a portion contents of the
Nak Response(s) are available to another method. The Nak Type(s) are
discussed in Section 5.3.

EAP conversation,
such as the EAP packets with codes of Success or Failure packet.

[3] Known MTU. The EAP layer does do not support fragmentation include a Type,
and
reassembly. However, therefore are not delivered to an EAP methods SHOULD be capable of handling
fragmentation method. Success and reassembly. As a result, EAP is capable of
functioning across a range of MTU sizes, as long as the MTU is
known.

[4] Possible duplication. Where
Failure are discussed in Section 4.2.

Given these considerations, the lower layer is reliable, it will
provide the EAP layer with a non-duplicated stream of packets.
However, while it is desirable that lower layers provide for non-
duplication, this is not a requirement. The Identifier field
provides both the peer Success, Failure, Nak Response(s) and authenticator with the ability to
detect duplicates.

Blunk, et al. Expires July 2, November 14, 2003 [Page 13] 12]

Internet-Draft EAP January May 2003

[5] Ordering guarantees. EAP does not require the Identifier to

Notification Request/Response messages MUST NOT be
monotonically increasing, and so is reliant on lower layer
ordering guarantees used to carry data
destined for correct operation. Also, EAP was
originally defined delivery to run on PPP, and [RFC1661] Section 1 has other EAP methods.

Where an
ordering requirement:

"The Point-to-Point Protocol is designed for simple links which
transport authenticator operates as a pass-through, it forwards
packets between two peers. These links provide full-
duplex simultaneous bi-directional operation, back and are assumed to
deliver packets in order."

Lower lower transports for EAP MUST preserve ordering forth between the peer and a
source backend authentication
server, based on the EAP layer header fields (Code, Identifier,
Length). This includes performing validity checks on the Code,
Identifer and destination, at Length fields, as described in Section 4.1.

Since pass-through authenticators rely on a given priority level (the level backend authenticator
server to implement methods, the EAP method layer header fields
(Type, Type-Data) are not examined as part of
ordering guarantee provided the forwarding
decision. The forwarding model is illustrated in Figure 2. Compliant
pass-through authenticator implementations MUST by [IEEE.802.1990]).

3.2 default be capable
of forwarding packets from any EAP usage within PPP

In order to establish communications over a point-to-point link, each
end method. The use of the PPP link RADIUS
protocol for encapsulation of EAP in pass-through operation is
described in [RFC2869bis].

Peer Pass-through Authenticator Authentication
Server

+-+-+-+-+-+-+ +-+-+-+-+-+-+
| | | |
|EAP method | |EAP method |
| Layer | | Layer |
| V | | ^ |
+-+-+-!-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-!-+-+-+
| ! | | | | | ! |
|EAP !Layer| | EAP Layer | EAP Layer | |EAP !Layer|
| ! | | +-----+-----+ | | ! |
| ! | | ! | ! | | ! |
+-+-+-!-+-+-+ +-+-+-!-+-+-+-+-+-!-+-+-+ +-+-+-!-+-+-+
| ! | | ! | ! | | ! |
|Lower!Layer| |Lower!Layer| AAA ! /IP | | AAA ! /IP |
| ! | | ! | ! | | ! |
+-+-+-!-+-+-+ +-+-+-!-+-+-+-+-+-!-+-+-+ +-+-+-!-+-+-+
! ! ! !
! ! ! !
+-------->-----+ +------->------+

Figure 2: Pass-through Authenticator

For sessions in which the authenticator acts as a pass-through, it
MUST determine the outcome of the authentication solely based on the
Accept/Reject indication sent by the backend authentication server;
the outcome MUST NOT be determined by the contents of an EAP packet
sent along with the Accept/Reject indication, or the absence of such

Blunk, et al. Expires November 14, 2003 [Page 13]

Internet-Draft EAP May 2003

an encapsulated EAP packet.

3. Lower layer behavior

3.1 Lower layer requirements

EAP makes the following assumptions about lower layers:

[1] Unreliable transport. In EAP, the authenticator retransmits
Requests that have not yet received Responses, so that EAP does
not assume that lower layers are reliable. Since EAP defines it
own retransmission behavior, when run over a reliable lower
layer, it is possible (though undesirable) for retransmission to
occur both in the lower layer and the EAP layer.

Note that EAP Success and Failure packets are not retransmitted.
Without a reliable lower layer, and a non-negligible error rate,
these packets can be lost, resulting in timeouts. It is therefore
desirable for implementations to improve their resilience to loss
of EAP Success or Failure packets, as described in Section 4.2.

[2] Lower layer error detection. While EAP does not assume that the
lower layer is reliable, it does rely on lower layer error
detection (e.g., CRC, Checksum, MIC, etc.). EAP methods may not
include a MIC, or if they do, it may not be computed over all the
fields in the EAP packet, such as the Code, Identifier, Length or
Type fields. As a result, without lower layer error detection,
undetected errors could creep into the EAP layer or EAP method
layer header fields, resulting in authentication failures.

For example, EAP TLS [RFC2716], which computes its MIC over the
Type-Data field only, regards MIC validation failures as a fatal
error. Without lower layer error detection, this method and
others like it will not perform reliably.

[3] Lower layer security. EAP assumes that lower layers either
provide physical security (e.g., wired PPP or IEEE 802 links) or
support per-packet authentication, integrity and replay
protection. EAP SHOULD NOT be used on physically insecure links
(e.g., wireless or the Internet) where subsequent data is not
protected by per-packet authentication, integrity and replay
protection.

After EAP authentication is complete, the peer will typically
transmit data to the network via the authenticator. In order to
provide assurance that the peer transmitting data is the same
entity that successfully completed EAP authentication, the lower
layer needs to bind per-packet integrity, authentication and

Blunk, et al. Expires November 14, 2003 [Page 14]

Internet-Draft EAP May 2003

replay protection to the original EAP authentication, using keys
derived during EAP authentication. Alternatively, the lower
layer needs to be physically secure. Otherwise it is possible
for subsequent data traffic to be hijacked, or replayed.

As a result of these considerations, EAP SHOULD be used only when
lower layers provide physical security for data (e.g., wired PPP
or IEEE 802 links), or for insecure links, where per-packet
authentication, integrity and replay protection is provided.

Where keying material for the lower layer ciphersuite is itself
provided by EAP, ciphersuite negotiation and key activation is
controlled by the lower layer. In PPP, ciphersuites are
negotiated within ECP so that it is not possible to use keys
derived from EAP authentication until the completion of ECP.
Therefore an initial EAP exchange cannot protected by a PPP
ciphersuite, although EAP re-authentication can be protected.

In IEEE 802 media, key activation also typically occurs after
completion of EAP authentication. Therefore an initial EAP
exchange typically cannot be protected by lower layer
ciphersuite, although an EAP re-authentication or
pre-authentication exchange can be protected.

[4] MTU known a-priori. The EAP layer does not support fragmentation
and reassembly. However, EAP methods SHOULD be capable of
handling fragmentation and reassembly. As a result, EAP is
capable of functioning across a range of MTU sizes, as long as
the MTU is known a-priori. EAP does not support path MTU
discovery.

[5] Possible duplication. Where the lower layer is reliable, it will
provide the EAP layer with a non-duplicated stream of packets.
However, while it is desirable that lower layers provide for
non-duplication, this is not a requirement. The Identifier field
provides both the peer and authenticator with the ability to
detect duplicates.

[6] Ordering guarantees. EAP does not require the Identifier to be
monotonically increasing, and so is reliant on lower layer
ordering guarantees for correct operation. EAP was originally
defined to run on PPP, and [RFC1661] Section 1 has an ordering
requirement:

"The Point-to-Point Protocol is designed for simple links which
transport packets between two peers. These links provide
full-duplex simultaneous bi-directional operation, and are
assumed to deliver packets in order."

Blunk, et al. Expires November 14, 2003 [Page 15]

Lower layer transports for EAP MUST preserve ordering between a
source and destination, at a given priority level (the ordering
guarantee provided by [IEEE-802]).

3.2 EAP usage within PPP

In order to establish communications over a point-to-point link, each
end of the PPP link must first send LCP packets to configure the data
link during Link Establishment phase. After the link has been
established, PPP provides for an optional Authentication phase before
proceeding to the Network-Layer Protocol phase.

By default, authentication is not mandatory. If authentication of
the link is desired, an implementation MUST specify the Authentication-
Authentication Protocol Configuration Option during Link
Establishment phase.

If the identity of the peer has been established in the
Authentication phase, the server can use that identity in the
selection of options for the following network layer negotiations.

When implemented within PPP, EAP does not select a specific
authentication mechanism at PPP Link Control Phase, but rather
postpones this until the Authentication Phase. This allows the
authenticator to request more information before determining the
specific authentication mechanism. This also permits the use of a
"back-end"
"backend" server which actually implements the various mechanisms
while the PPP authenticator merely passes through the authentication
exchange. The PPP Link Establishment and Authentication phases, and
the Authentication-Protocol Authentication Protocol Configuration Option, are defined in The
Point-to-Point Protocol (PPP) [RFC1661].

3.2.1 PPP Configuration Option Format

A summary of the PPP Authentication-Protocol Authentication Protocol Configuration Option
format to negotiate the EAP Authentication Protocol is shown below. The fields are transmitted
from left to right.

Blunk, et al. Expires July 2, 2003 [Page 14]

Internet-Draft EAP January 2003

Exactly one EAP packet is encapsulated in the Information field of a
PPP Data Link Layer frame where the protocol field indicates type hex
C227 (PPP EAP).

0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Authentication-Protocol Authentication Protocol |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Blunk, et al. Expires November 14, 2003 [Page 16]

Internet-Draft EAP May 2003

Type

Length

Authentication-Protocol

Authentication Protocol

C227 (Hex) for PPP Extensible Authentication Protocol (EAP)

3.3 EAP usage within IEEE 802

The encapsulation of EAP over IEEE 802 is defined in
[IEEE.802-1X.2001]. [IEEE-802.1X].
The IEEE 802 encapsulation of EAP does not involve PPP, and IEEE
802.1X does not include support for link or network layer
negotiations. As a result, within IEEE 802.1X it is not possible to
negotiate non-EAP authentication mechanisms, such as PAP or CHAP
[RFC1994].

3.4 Link Lower layer indications

The reliability and security of link lower layer indications is dependent
on the medium. lower layer. Since EAP is media independent, the presence or
absence of link lower layer security is not taken into account in the
processing of EAP messages.

Link

Lower layer failure indications provided to EAP by the link lower layer
MUST be processed and will cause an EAP exchange in progress to be
aborted. However, link lower layer success indications MUST NOT affect
EAP message processing so that processing; an EAP implementation MUST NOT cannot conclude that
authentication has succeeded based on those indications. This ensures
that an attacker spoofing link lower layer indications can at best succeed
in a denial of service attack.

Blunk, et al. Expires July 2, 2003 [Page 15]

Internet-Draft EAP January 2003

A discussion of some reliability and security issues with link lower layer
indications in PPP, IEEE 802 wired networks and IEEE 802.11 wireless
LANs can be found in the Security Considerations, Section 7.12.

In IEEE 802.11 a "link down" indication is an unreliable indication
of link failure, since wireless signal strength can come and go and
may be influenced by radio frequency interference generated by an
attacker. To avoid unnecessary resets, it is advisable to damp these
indications, rather than passing them directly to the EAP. Since EAP
supports retransmission, it is robust against transient connectivity
losses.

4. EAP Packet format

A summary of the EAP packet format is shown below. The fields are
transmitted from left to right.

Blunk, et al. Expires November 14, 2003 [Page 17]

Internet-Draft EAP May 2003

Code

The Code field is one octet and identifies the type Type of EAP packet.
EAP Codes are assigned as follows:

1 Request
2 Response
3 Success
4 Failure

Since EAP only defines Codes 1-4, EAP packets with other codes
MUST be silently discarded by both authenticators and peers.

Identifier

The Identifier field is one octet and aids in matching Responses
with Requests.

Length

The Length field is two octets and indicates the length of the EAP
packet including the Code, Identifier, Length and Data fields.

Blunk, et al. Expires July 2, 2003 [Page 16]

Internet-Draft EAP January 2003
Octets outside the range of the Length field should be treated as
Data Link Layer padding and should be ignored on reception.

Data

The Data field is zero or more octets. The format of the Data
field is determined by the Code field.

4.1 Request and Response

Description

The Request packet (Code field set to 1) is sent by the
authenticator to the peer. Each Request has a Type field which
serves to indicate what is being requested. Additional Request
packets MUST be sent until a valid Response packet is received, or
an optional retry counter expires.

Blunk, et al. Expires November 14, 2003 [Page 18]

Internet-Draft EAP May 2003

Retransmitted Requests MUST be sent with the same Identifier value
in order to distinguish them from new Requests. The contents of
the data field is are dependent on the Request type. Type. The peer MUST
send a Response packet in reply to a valid Request packet.
Responses MUST only be sent in reply to a valid Request and never
retransmitted on a timer.

The Identifier field of the Response MUST match that of the
currently outstanding Request. An authenticator receiving a
Response whose Identifier value does not match that of the
currently outstanding Request MUST silently discard the Response.
The Type field of a Response MUST either match that of the
Request, or correspond to a legacy or expanded Expanded Nak (see Section
5.3). An EAP server receiving a Response not meeting this
requirement MUST silently discard it.

Implementation Note: The authenticator is responsible for
retransmitting Request messages. If the Request message is
obtained from elsewhere (such as from a backend authentication
server), then the authenticator will need to save a copy of the
Request in order to accomplish this. The peer is responsible
for detecting and handling duplicate Request messages before
processing them in any way, including passing them on to an
outside party. The authenticator is also responsible for
discarding Response messages with a non-matching Identifier
value before acting on them in any way, including passing them
on to the backend authentication server for verification.
Since the authenticator can retransmit before receiving a
Response from the peer, the authenticator can receive multiple
Responses, each with a matching Identifier. Until a new Request

Blunk, et al. Expires July 2, 2003 [Page 17]

Internet-Draft EAP January 2003
is received by the authenticator, the Identifier value is not
updated, so that the authenticator forwards Responses to the
backend authentication server, one at a time.

Because the authentication process will often involve user
input, some care must be taken when deciding upon
retransmission strategies and authentication timeouts. By
default, where EAP is run over an unreliable lower layer, the
EAP retransmission timer SHOULD be computed as described in
[RFC2988]. This includes use of Karn's algorithm to filter RTT
estimates resulting from retransmissions. A maximum of 3-5
retransmissions is suggested.

When run over a reliable lower layer (e.g. (e.g., EAP over ISAKMP/TCP, ISAKMP/
TCP, as within [PIC]), the authenticator retransmission timer
SHOULD be set to an infinite value, so that retransmissions do
not occur at the EAP layer. Note that in this case the peer
may still maintain a timeout value so as to avoid waiting

Blunk, et al. Expires November 14, 2003 [Page 19]

Internet-Draft EAP May 2003

indefinitely for a Request.

Where the authentication process requires user input, the
measured round trip times are largely determined by user
responsiveness rather than network characteristics, so that RTO
estimation is not helpful. Instead, the retransmission timer
SHOULD be set so as to provide sufficient time for the user to
respond, with longer timeouts required in certain cases, such
as where Token Cards (see Section 5.6) are involved.

In order to provide the EAP authenticator with guidance as to
the appropriate timeout value, a hint can be communicated to
the authenticator by the backend authentication server (such as
via the RADIUS Session-Timeout attribute).

A summary of the Request and Response packet format is shown below.
The fields are transmitted from left to right.

Blunk, et al. Expires July 2, 2003 [Page 18]

Internet-Draft EAP January 2003

Code

1 for Request
2 for Response

Identifier

The Identifier field is one octet. The Identifier field MUST be
the same if a Request packet is retransmitted due to a timeout
while waiting for a Response. Any new (non-retransmission)
Requests MUST modify the Identifier field. In order to avoid
confusion between new Requests and retransmissions, the Identifier
value chosen for each new Request need only be different from the
previous Request, but need not be unique within the conversation.
One way to achieve this is to start the Identifier at an initial
value and increment it for each new Request. Initializing the
first Identifier with a random number rather than starting from
zero is recommended, since it makes sequence attacks somewhat
harder.

Blunk, et al. Expires November 14, 2003 [Page 20]

Internet-Draft EAP May 2003

Since the Identifier space is unique to each session,
authenticators are not restricted to only 256 simultaneous
authentication conversations. Similarly, with re-authentication,
an EAP conversation might continue over a long period of time, and
is not limited to only 256 roundtrips.

If a peer receives a valid duplicate Request for which it has
already sent a Response, it MUST resend its original Response. If
a peer receives a duplicate Request before it has sent a Response,
but after it has determined the initial Request to be valid (i.e. (i.e.,
it is waiting for user input), it MUST silently discard the
duplicate Request. An EAP message may be found invalid for a
variety of reasons: failed lower layer CRC or checksum, malformed
EAP packet, EAP method MIC failure, etc.

Length

The Length field is two octets and indicates the length of the EAP
packet including the Code, Identifier, Length, Type, and Type-Data
fields. Octets outside the range of the Length field should be
treated as Data Link Layer padding and should be ignored on
reception.

Type

The Type field is one octet. This field indicates the Type of
Request or Response. A single Type MUST be specified for each EAP
Request or Response. Normally, the Type field of the Response

Blunk, et al. Expires July 2, 2003 [Page 19]

Internet-Draft EAP January 2003
will be the same as the Type of the Request. However, there is are
also a Nak Response Type Types for indicating that a Request type Type is
unacceptable to the peer. peer (see Section 5.3). An initial
specification of Types follows in a later section Section 5 of this document.

Type-Data

The Type-Data field varies with the Type of Request and the
associated Response.

4.2 Success and Failure

The Success packet is sent by the authenticator to the peer after
completion of an EAP authentication method (Type 4 or greater), to
indicate that the peer has authenticated successfully to
acknowledge successful authentication. the
authenticator. The authenticator MUST transmit an EAP packet with
the Code field set to 3 (Success). If the authenticator cannot
authenticate the peer (unacceptable Responses to one or more
Requests) then after unsuccessful completion of the EAP method in

Blunk, et al. Expires November 14, 2003 [Page 21]

Internet-Draft EAP May 2003

progress, the implementation MUST transmit an EAP packet with the
Code field set to 4 (Failure). An authenticator MAY wish to issue
multiple Requests before sending a Failure response in order to allow
for human typing mistakes. Success and Failure packets MUST NOT
contain additional data.

EAP Success or Failure packets MUST NOT be sent by an EAP server
prior to completion of the final round of a given method. A peer EAP
implementation receiving a Success or Failure packet prior to
completion of the method in progress MUST silently discard it. By
default, an EAP peer MUST silently discard a "canned" EAP Success
message (an EAP Success message sent immediately upon connection).
This ensures that a rogue authenticator will not be able to bypass
mutual authentication by sending an EAP Success prior to conclusion
of the EAP method conversation.

Implementation Note: Because the Success and Failure packets are
not acknowledged, the authenticator cannot know whether they have
been received. As a result, these packets are not retransmitted
by the authenticator. If acknowledged success and failure result indications are
desired, these MAY be implemented within individual EAP methods.
Since only a single EAP authentication method is supported within
an EAP conversation, a peer that successfully authenticates the
authenticator MAY, in the event that an EAP Success is not
received, conclude that the EAP Success packet was lost and enable
the link.

A summary of the Success and Failure packet format is shown below.
The fields are transmitted from left to right.

Code

3 for Success
4 for Failure

Blunk, et al. Expires July 2, 2003 [Page 20]

Internet-Draft EAP January 2003

Identifier

The Identifier field is one octet and aids in matching replies to
Responses. The Identifier field MUST match the Identifier field
of the Response packet that it is sent in response to.

Length

4.2.1 Processing of success and failure

EAP Success or Failure packets MUST NOT be sent by an authenticator
prior to completion of the final round of a given method. A peer EAP
implementation receiving a Success or Failure packet prior to
completion of the method in progress MUST silently discard it. By
default, an EAP peer MUST silently discard a "canned" EAP Success
message (an EAP Success message sent immediately upon connection).
This ensures that a rogue authenticator will not be able to bypass
mutual authentication by sending an EAP Success prior to conclusion
of the

Blunk, et al. Expires November 14, 2003 [Page 22]

Internet-Draft EAP method conversation. May 2003

Length

5. Initial EAP Request/Response Types

This section defines the initial set of EAP Types used in Request/
Response exchanges. More Types may be defined in follow-on
documents. The Type field is one octet and identifies the structure
of an EAP Request or Response packet. The first 3 Types are
considered special case Types.

The remaining Types define authentication exchanges. The Nak Type is (Type 3) or
Expanded Nak (Type 254) are valid only for Response packets, it they
MUST NOT be sent in a Request.
The Nak Type MUST only be sent in response to a Request which uses an
authentication Type code (i.e., Type of 4 or greater).

All EAP implementations MUST support Types 1-4, which are defined in
this document, and SHOULD support Type 254. Follow-on RFCs Implementations MAY define
additional EAP Types.

Blunk, et al. Expires July 2, 2003 [Page 21]

Internet-Draft EAP January 2003
support other Types defined here or in future RFCs.

1 Identity
2 Notification
3 Nak (Response only)
4 MD5-Challenge
5 One Time Password (OTP)
6 Generic Token Card (GTC)
254 Expanded types Types
255 Experimental use

EAP methods MAY support authentication based on shared secrets. If
the shared secret is a passphrase entered by the user,
implementations MAY support entering passphrases with non-ASCII
characters. In this case, the input should be processed using an
appropriate stringprep [RFC3454] profile, and encoded in octets using
UTF-8 encoding [RFC2279]. A possible registered stringprep profile is
specified in [SASLPREP].

5.1 Identity

Description

The Identity Type is used to query the identity of the peer.
Generally, the authenticator will issue this as the initial
Request. An optional displayable message MAY be included to
prompt the peer in the case where there is an expectation of
interaction with a user. A Response of Type 1 (Identity) SHOULD

Blunk, et al. Expires November 14, 2003 [Page 23]

Internet-Draft EAP May 2003

be sent in Response to a Request with a Type of 1 (Identity).

Since Identity Requests and Responses are not protected, from a
security
privacy perspective, it may be preferable for protected method-
specific
method-specific Identity exchanges to be used instead. Where the
peer is configured to only accept authentication methods
supporting protected identity exchanges, the peer MAY provide an
abbreviated Identity Response (such as omitting the peer-name
portion of the NAI [RFC2486]). For further discussion of identity
protection, see Section 7.3.

Implementation Note: The peer MAY obtain the Identity via user
input. It is suggested that the authenticator retry the
Identity Request in the case of an invalid Identity or
authentication failure to allow for potential typos on the part
of the user. It is suggested that the Identity Request be
retried a minimum of 3 times before terminating the
authentication phase with a Failure reply. The Notification
Request MAY be used to indicate an invalid authentication
attempt prior to transmitting a new Identity Request
(optionally, the failure MAY be indicated within the message of
the new Identity Request itself).

Type

Type-Data

This field MAY contain a displayable message in the Request,
containing UTF-8 encoded ISO 10646 characters [RFC2279]. The
Response uses this field to return the Identity. If the Identity
is unknown, this field should be zero bytes in length. The field
MUST NOT be null terminated. The length of this field is derived

Blunk, et al. Expires July 2, 2003 [Page 22]

Internet-Draft EAP January 2003
from the Length field of the Request/Response packet and hence a
null is not required.

5.2 Notification

Description

The Notification Type is optionally used to convey a displayable
message from the authenticator to the peer. An authenticator MAY
send a Notification Request to the peer at any time when there is
no outstanding Request. Request, prior to completion of an EAP
authentication method. The peer MUST respond to a Notification
Request with a Notification Response; Response unless the EAP authentication

Blunk, et al. Expires November 14, 2003 [Page 24]

Internet-Draft EAP May 2003

method specification prohibits the use of Notification message.
In any case, a Nak Response MUST NOT be
sent. sent in response to a
Notification Request.

An EAP method MAY indicate within its specification that
Notification messages must not be sent during that method. In this
case, the peer MUST silently discard Notification Requests from
the point where an initial Request for that Type is answered with
a Response of the same Type.

The peer SHOULD display this message to the user or log it if it
cannot be displayed. The Notification Type is intended to provide
an acknowledged notification of some imperative nature, but it is
not an error indication, and therefore does not change the state
of the peer. Examples include a password with an expiration time
that is about to expire, an OTP sequence integer which is nearing
0, an authentication failure warning, etc. In most circumstances,
Notification should not be required.

Type

Type-Data

The Type-Data field in the Request contains a displayable message
greater than zero octets in length, containing UTF-8 encoded ISO
10646 characters [RFC2279]. The length of the message is
determined by Length field of the Request packet. The message
MUST NOT be null terminated. A Response MUST be sent in reply to
the Request with a Type field of 2 (Notification). The Type-Data
field of the Response is zero octets in length. The Response
should be sent immediately (independent of how the message is
displayed or logged).

5.3 Nak

5.3.1 Legacy Nak

Blunk, et al. Expires July 2, 2003 [Page 23]

Internet-Draft EAP January 2003

Description

The legacy Nak Type is valid only in Response messages. It is
sent in reply to a Request where the desired authentication Type
is unacceptable. Authentication Types are numbered 4 and above.
The Response contains one or more authentication Types desired by
the Peer. Type zero (0) is used to indicate that the sender has
no viable alternatives.

Blunk, et al. Expires November 14, 2003 [Page 25]

Internet-Draft EAP May 2003

Since the legacy Nak Type is valid only in Responses and has very
limited functionality, it MUST NOT be used as a general purpose
error indication, such as for communication of error messages, or
negotiation of parameters specific to a particular EAP method.

Code

2 for Response.

Identifier

The Identifier field is one octet and aids in matching Responses
with Requests. The Identifier field of a legacy Nak Response MUST
match the Identifier field of the Request packet that it is sent
in response to.

Length

>=6

Type

Type-Data

Where any a peer receives a Request for an unacceptable authentication
Type in the
range (1-253,255), (4-253,255), or a peer lacking support for Expanded Types
receives a Request for Type 254, a legacy Nak Response (Type 3) MUST be
sent. The Type-Data field of the legacy Nak Response (Type 3) MUST
contain one or more octets indicating the desired authentication
Type(s), one octet per Type, or the value zero (0) to indicate no
proposed alternative. A peer supporting Expanded Types that
receives a Request for an unacceptable authentication Type (1-253, (4-253,
255) MAY include the value 254 in the legacy Nak Response (Type 3) in
order to indicate the desire for an Expanded authentication Type.
If the authenticator can accomodate accommodate this preference, it will
respond with an Expanded Type Request.

Blunk, et al. Expires July 2, 2003 [Page 24]

Internet-Draft EAP January 2003 Request (Type 254).

5.3.2 Expanded Nak

Description

The Expanded Nak Type is valid only in Response messages. It MUST
be sent only in reply to a Request of Type 254 (Expanded Type)
where the authentication Type is unacceptable. The Expanded Nak
Type uses the Expanded Type format itself, and the Response

Blunk, et al. Expires November 14, 2003 [Page 26]

Internet-Draft EAP May 2003

contains one or more authentication Types desired by the peer, all
in Expanded Type format. Type zero (0) is used to indicate that
the sender has no viable alternatives. The general format of the
Expanded Type is described in Section 5.7.

Since the Expanded Nak Type is valid only in Responses and has
very limited functionality, it MUST NOT be used as a general
purpose error indication, such as for communication of error
messages, or negotiation of parameters specific to a particular
EAP method.

Code

2 for Response.

Identifier

The Identifier field is one octet and aids in matching Responses
with Requests. The Identifier field of a Expanded Nak Response
MUST match the Identifier field of the Request packet that it is
sent in response to.

Length

>=40

Type

254

Vendor-Id

0 (IETF)

Vendor-Type

3 (Nak)

Blunk, et al. Expires July 2, 2003 [Page 25]

Internet-Draft EAP January 2003

Vendor-Data

The Expanded Nak Type is only sent when the Request contains an
Expanded Type (254) as defined in Section 5.7. The Vendor-Data
field of the Nak Response MUST contain one or more authentication
Types (4 or greater), all in expanded format, 8 octets per Type,
or the value zero (0), also in Expanded Type format, to indicate
the sender has no proposed alternative. viable alternatives. The desired authentication Types may
include a mixture general format of Vendor-Specific and IETF Types. For example,
an the
Expanded Type is described in Section 5.7.

Since the Expanded Nak Response indicating Type is valid only in Responses and has
very limited functionality, it MUST NOT be used as a preference general
purpose error indication, such as for OTP (Type 5),
and an MIT (Vendor-Id=20) Expanded Type communication of 6 would appear as
follows:

0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| error
messages, or negotiation of parameters specific to a particular
EAP method.

Code

2 | for Response.

Identifier | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 (Nak) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 (OTP) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 20 (MIT) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

The Identifier field is one octet and aids in matching Responses
with Requests. The Identifier field of an Expanded Nak Response indicating a no desired alternative would
appear as follows:

0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 2 |
MUST match the Identifier | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | field of the Request packet that it is
sent in response to.

Length

>=40

Type

254

Vendor-Id

0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|

Vendor-Type

3 (Nak) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0 (No alternative) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Blunk, et al. Expires July 2, 2003 [Page 26]

Internet-Draft EAP January 2003

5.4 MD5-Challenge

Description

Vendor-Data

The MD5-Challenge Expanded Nak Type is analogous to the PPP CHAP protocol
[RFC1994] (with MD5 as only sent when the specified algorithm). The Request contains a "challenge" message to an
Expanded Type (254) as defined in Section 5.7. The Vendor-Data
field of the peer. A Nak Response MUST be
sent contain one or more authentication
Types (4 or greater), all in reply to the Request. The Response MAY be either of Type
4 (MD5-Challenge) expanded format, 8 octets per Type,
or the value zero (0), also in Expanded Type 3 (Nak). format, to indicate
no proposed alternative. The Nak reply indicates the
peer's desired authentication Type(s). EAP peer and EAP server
implementations MUST support the MD5-Challenge mechanism. An
authenticator that supports only pass-through MUST allow
communication with Types may
include a backend authentication server that is capable
of supporting MD5-Challenge, although the EAP authenticator
implementation need not support MD5-Challenge itself. However, if
the EAP authenticator can be configured to authenticate peers
locally (e.g. not operate in pass-through), then the requirement
for support of the MD5-Challenge mechanism applies.

Note that the use mixture of the Identifier field in the MD5-Challenge
Type is different from that described in [RFC1994]. EAP allows Vendor-Specific and IETF Types. For example,
an Expanded Nak Response indicating a preference for retransmission of MD5-Challenge Request packets while
[RFC1994] states that both the Identifier OTP (Type 5),

Blunk, et al. Expires November 14, 2003 [Page 27]

Internet-Draft EAP May 2003

and Challenge fields
MUST change each time a Challenge (the CHAP equivalent of the
MD5-Challenge Request packet) is sent. an MIT (Vendor-Id=20) Expanded Type

Type-Data

The contents of the Type-Data field is summarized below. For
reference on the use of these fields see the PPP Challenge
Handshake Authentication Protocol [RFC1994]. 6 would appear as
follows:

0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Value-Size 2 | Identifier | Length | Value ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Name ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Blunk, et al. Expires July 2, 2003 [Page 27]

Internet-Draft EAP January 2003

Security Claims (see Section 7.2):

Intended use: Wired networks, including PPP, PPPOE, and
IEEE 802 wired media. Use over the
Internet or with wireless media only when
protected.
Mechanism: Password or pre-shared key.
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key Derivation: No
Key strength: N/A
Dictionary attack prot: No
Key hierarchy: N/A
Fast reconnect: No
MiTM resistance: No
Acknowledged S/F: No

5.5 One-Time Password Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 (Nak) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 (OTP)

Description

The One-Time Password system is defined in "A One-Time Password
System" [RFC2289] and "OTP Extended Responses" [RFC2243]. The
Request contains a displayable message containing an OTP
challenge. A Response MUST be sent in reply to the Request. The |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 20 (MIT) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

An Expanded Nak Response MUST be of Type indicating a no desired alternative would
appear as follows:

0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 (OTP) or Type 6 7 8 9 0 1 2 3 (Nak). The Nak
Response indicates the peer's desired authentication Type(s).

Type 4 5

Type-Data

The Type-Data field contains the OTP "challenge" as a displayable
message in the Request. In the Response, this field is used for
the 6 words from the OTP dictionary [RFC2289]. The messages MUST
NOT be null terminated. The length of the field is derived from
the 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 2 | Identifier | Length field of the Request/Reply packet.

Blunk, et al. Expires July 2, 2003 [Page 28]

Internet-Draft EAP January 2003

Security Claims (see Section 7.2):

Intended use: Wired networks, including PPP, PPPOE, and
IEEE 802 wired media. Use over the
Internet or with wireless media only when
protected.
Mechanism: One-Time Password
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key Derivation: No
Key strength: N/A
Dictionary attack prot: No
Key hierarchy: N/A
Fast reconnect: No
MiTM resistance: No
Acknowledged S/F: No

5.6 Generic Token Card (GTC) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 (Nak) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0 (No alternative) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

5.4 MD5-Challenge

Description

The Generic Token Card MD5-Challenge Type is defined for use with various Token
Card implementations which require user input. analogous to the PPP CHAP protocol
[RFC1994] (with MD5 as the specified algorithm). The Request
contains a displayable "challenge" message and the Response contains the Token
Card information necessary for authentication. Typically, this
would be information read by a user from the Token card device and
entered as ASCII text. to the peer. A Response MUST be
sent in reply to the Request. The Response MUST MAY be either of Type 6 (GTC)
4 (MD5-Challenge), Nak (Type 3) or Type 3 (Nak). Expanded Nak (Type 254). The

Blunk, et al. Expires November 14, 2003 [Page 28]

Internet-Draft EAP May 2003

Nak Response reply indicates the peer's desired authentication Type(s).

Type

Type-Data

The Type-Data field in
EAP peer and EAP server implementations MUST support the Request contains
MD5-Challenge mechanism. An authenticator that supports only
pass-through MUST allow communication with a displayable message
greater than zero octets backend
authentication server that is capable of supporting MD5-Challenge,
although the EAP authenticator implementation need not support
MD5-Challenge itself. However, if the EAP authenticator can be
configured to authenticate peers locally (e.g., not operate in length. The length
pass-through), then the requirement for support of the message is
determined by
MD5-Challenge mechanism applies.

Note that the Length field use of the Request packet. The message
MUST NOT be null terminated. A Response MUST be sent Identifier field in reply to the MD5-Challenge
Type is different from that described in [RFC1994]. EAP allows
for retransmission of MD5-Challenge Request with packets while
[RFC1994] states that both the Identifier and Challenge fields
MUST change each time a Type field Challenge (the CHAP equivalent of 6 (Generic Token Card). The
Response contains data from the Token Card required
MD5-Challenge Request packet) is sent.

Note: [RFC1994] treats the shared secret as an octet string, and
does not specify how it is entered into the system (or if it is
handled by the user at all). EAP MD5-Challenge implementations MAY
support entering passphrases with non-ASCII characters. See
Section 5 for
authentication. instructions how the input should be processed and
encoded into octets.

Type

Type-Data

The length contents of the data Type-Data field is determined by summarized below. For
reference on the
Length field use of these fields see the Response packet. PPP Challenge
Handshake Authentication Protocol [RFC1994].

0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Value-Size | Value ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Name ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Blunk, et al. Expires July 2, November 14, 2003 [Page 29]

Internet-Draft EAP January May 2003

Security Claims (see Section 7.2):

Intended use: Wired networks, including PPP, PPPOE, and
IEEE 802 wired media. Use over the
Internet or with wireless media only when
protected.
Mechanism: Hardware token. Password or pre-shared key.
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key Derivation: No
Key strength: N/A
Dictionary attack prot: No
Key hierarchy: N/A
Fast reconnect: No
MiTM resistance: No N/A
Acknowledged S/F: No

5.7 Expanded types

5.5 One-Time Password (OTP)

Description

Due to EAP's popularity, the original Method Type space, which
only provides for 255 values,

The One-Time Password system is being allocated at a pace which
if continued would result defined in exhaustion within a few years. Since
many of the existing uses of EAP are vendor-specific, the Expanded
Method Type is available to allow vendors to support their own
Expanded Types not suitable for general usage. "A One-Time Password
System" [RFC2289] and "OTP Extended Responses" [RFC2243]. The Expanded type is also used to expand the global Method Type
space beyond
Request contains an OTP challenge in the original 255 values. format described in
[RFC2289]. A Vendor-Id of 0 maps the
original 255 possible types onto a namespace of 2^32-1 possible
types, allowing for virtually unlimited expansion. (Type 0 is only
used Response MUST be sent in a Nak Response, reply to indicate no acceptable alternative)

An implementation that supports the Expanded attribute Request. The
Response MUST treat
EAP types that are less than 256 equivalently whether they appear
as a single octet be of Type 5 (OTP), Nak (Type 3) or as Expanded Nak
(Type 254). The Nak Response indicates the 32-bit Vendor-Type within peer's desired
authentication Type(s).

Type

Type-Data

The Type-Data field contains the OTP "challenge" as a Expanded
type where Vendor-Id displayable
message in the Request. In the Response, this field is 0. Peers not equipped to interpret used for
the
Expanded Type 6 words from the OTP dictionary [RFC2289]. The messages MUST send a Nak as described in Section 5.3.1, and
negotiate a more suitable authentication method.

A summary
NOT be null terminated. The length of the Expanded Type format field is shown below. The fields
are transmitted derived from left to right.
the Length field of the Request/Reply packet.

Note: [RFC2289] does not specify how the secret pass-phrase is
entered by the user, or how the pass-phrase is converted into
octets. EAP OTP implementations MAY support entering passphrases
with non-ASCII characters. See Section 5 for instructions how the

Blunk, et al. Expires July 2, November 14, 2003 [Page 30]

Internet-Draft EAP January May 2003

0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Vendor-Id |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Vendor-Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Vendor data...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

input should be processed and encoded into octets.

Security Claims (see Section 7.2):

5.6 Generic Token Card (GTC)

Description

The Generic Token Card Type

254 is defined for Expanded type

Vendor-Id use with various Token
Card implementations which require user input. The Vendor-Id is 3 octets Request
contains a displayable message and represents the SMI Network
Management Private Enterprise Code of Response contains the Vendor in network byte
order, as allocated by IANA. A Vendor-Id of zero is reserved Token
Card information necessary for
use authentication. Typically, this
would be information read by a user from the IETF Token card device and
entered as ASCII text. A Response MUST be sent in providing an expanded global EAP reply to the
Request. The Response MUST be of Type space.

Vendor-Type 6 (GTC), Nak (Type 3) or
Expanded Nak (Type 254). The Vendor-Type Nak Response indicates the peer's
desired authentication Type(s).

Type

Type-Data

The Type-Data field is four in the Request contains a displayable message
greater than zero octets and represents in length. The length of the vendor-
specific Method Type.

If Vendor-Id message is zero,
determined by the Vendor-Type Length field is an extension and
superset of the existing namespace for EAP types. Request packet. The first 256
types are reserved for compatibility with single-octet EAP types
that have already been assigned or may message
MUST NOT be assigned null terminated. A Response MUST be sent in reply to
the future.
Thus, EAP types from 0 through 255 are semantically identical
whether they appear as single octet EAP types or as Vendor-Types
when Vendor-Id is zero.

Vendor-Data

The Vendor-Data field is defined by the vendor. Where Request with a Vendor-Id
of zero is present, the Vendor-Data Type field will be used for
transporting the contents of EAP methods of Types defined by the
IETF.

5.8 Experimental

Description 6 (Generic Token Card). The experimental type has no fixed format or content. It is
intended
Response contains data from the Token Card required for use when experimenting with new EAP types. This type

Blunk, et al. Expires July 2, November 14, 2003 [Page 31]

Internet-Draft EAP January May 2003

authentication. The length of the data is intended for experimental and testing purposes. No guarantee is
made for interoperability between peers using this type, as
outlined in [IANA-EXP].

Type

255

Type-Data

Undefined

6. IANA Considerations

This section provides guidance to determined by the Internet Assigned Numbers
Authority (IANA) regarding registration
Length field of values related to the Response packet.

EAP
protocol, in accordance GTC implementations MAY support entering a response with BCP 26, [RFC2434].

There are two name spaces in EAP that require registration: Packet
Codes
non-ASCII characters. See Section 5 for instructions how the
input should be processed and Method Types.

EAP is not intended as a general-purpose protocol, encoded into octets.

Security Claims (see Section 7.2):

Intended use: Wired networks, including PPP, PPPOE, and allocations
SHOULD NOT be made for purposes unrelated to authentication.

6.1 Definition of Terms

The following terms are used here
IEEE 802 wired media. Use over the
Internet or with wireless media only when
protected.
Mechanism: Hardware token.
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key Derivation: No
Key strength: N/A
Dictionary attack prot: No
Key hierarchy: N/A
Fast reconnect: No
MiTM resistance: N/A
Acknowledged S/F: No

5.7 Expanded Types

Description

Since many of the meanings defined in BCP
26: "name space", "assigned value", "registration".

The following policies existing uses of EAP are used here with vendor-specific, the meanings defined in BCP
26: "Private Use", "First Come First Served", "Expert Review",
"Specification Required", "IETF Consensus", "Standards Action".

6.2 Recommended Registration Policies

For registration requests where a Designated Expert should be
consulted,
Expanded method Type is available to allow vendors to support
their own Expanded Types not suitable for general usage.

The Expanded Type is also used to expand the responsible IESG area director should appoint global Method Type
space beyond the
Designated Expert. For Designated Expert with Specification Required, original 255 values. A Vendor-Id of 0 maps the request
original 255 possible Types onto a namespace of 2^32-1 possible
Types, allowing for virtually unlimited expansion. (Type 0 is posted only
used in a Nak Response, to indicate no acceptable alternative)

An implementation that supports the Expanded attribute MUST treat
EAP WG mailing list (or, if it has been
disbanded, Types that are less than 256 equivalently whether they appear
as a successor designated by single octet or as the Area Director) for comment
and review, and MUST include 32-bit Vendor-Type within a pointer Expanded
Type where Vendor-Id is 0. Peers not equipped to interpret the
Expanded Type MUST send a public specification.
Before Nak as described in Section 5.3.1, and
negotiate a period more suitable authentication method.

Blunk, et al. Expires November 14, 2003 [Page 32]

Internet-Draft EAP May 2003

A summary of 30 days has passed, the Designated Expert will
either approve or deny the registration request Expanded Type format is shown below. The fields
are transmitted from left to right.

Type

254 for Expanded Type

Vendor-Id

The Vendor-Id is 3 octets and publish a notice
of represents the decision to SMI Network
Management Private Enterprise Code of the EAP WG mailing list or its successor. A denial
notice must be justified by an explanation and, Vendor in the cases where it
is possible, concrete suggestions on how the request can be modified
so network byte
order, as to become acceptable.

Blunk, et al. Expires July 2, 2003 [Page 32]

Internet-Draft EAP January 2003

For registration requests requiring Expert Review, the EAP mailing
list should be consulted. If the EAP mailing list allocated by IANA. A Vendor-Id of zero is no longer
operational, an alternative mailing list may be designated reserved for
use by the
responsible IESG Area Director.

Packet Codes have a range from 1 to 255, of which 1-4 have been
allocated. Because a new Packet Code has considerable impact on
interoperability, a new Packet Code requires Standards Action, and
should be allocated starting at 5.

The original IETF in providing an expanded global EAP Method Type space has a range from 1 to 255, space.

Vendor-Type

The Vendor-Type field is four octets and represents the
vendor-specific method Type.

If the Vendor-Id is zero, the scarcest resource in EAP, Vendor-Type field is an extension
and thus must be allocated superset of the existing namespace for EAP Types. The first
256 Types are reserved for compatibility with care.
Method single-octet EAP
Types 1-36 that have already been allocated, with 20 available for re-use.
Method Types 37-191 assigned or may be allocated on the advice of a Designated
Expert, with Specification Required.

Allocation of blocks of Method Types (more than one for a given
purpose) should require IETF Consensus. assigned in the
future. Thus, EAP Type Values 192-253 Types from 0 through 255 are
reserved and allocation requires Standards Action.

Method Type 254 semantically
identical whether they appear as single octet EAP Types or as
Vendor-Types when Vendor-Id is allocated for zero.

Vendor-Data

The Vendor-Data field is defined by the Expanded Type. vendor. Where the a Vendor-Id field
of zero is non-zero, present, the Expanded Type is Vendor-Data field will be used for functions
specific only to one vendor's implementation
transporting the contents of EAP, where EAP methods of Types defined by the
IETF.

5.8 Experimental

Blunk, et al. Expires November 14, 2003 [Page 33]

Internet-Draft EAP May 2003

Description

The Experimental Type has no
interoperability fixed format or content. It is deemed useful. When used
intended for use when experimenting with a Vendor-Id of
zero, Method new EAP Types. This Type 254 can also be used to provide
is intended for an expanded
IETF Method Type space. Method Type values 256-4294967295 may be
allocated after Type values 1-191 have been allocated.

Method Type 255 experimental and testing purposes. No guarantee
is allocated made for Experimental use, such interoperability between peers using this Type, as testing of
new EAP methods before a permanent
outlined in [IANA-EXP].

Type code is allocated.

7. Security

255

Type-Data

Undefined

6. IANA Considerations

This section provides guidance to the Internet Assigned Numbers
Authority (IANA) regarding registration of values related to the EAP was designed for use
protocol, in accordance with dialup PPP [RFC1661] BCP 26, [RFC2434].

There are two name spaces in EAP that require registration: Packet
Codes and was later
adapted method Types.

EAP is not intended as a general-purpose protocol, and allocations
SHOULD NOT be made for use purposes unrelated to authentication.

The following terms are used here with the meanings defined in wired IEEE 802 networks [IEEE.802.1990] BCP
26: "name space", "assigned value", "registration".

The following policies are used here with the meanings defined in
[IEEE.802-1X.2001]. On these networks, an attacker would need to
gain physical access to BCP
26: "Private Use", "First Come First Served", "Expert Review",
"Specification Required", "IETF Consensus", "Standards Action".

For registration requests where a Designated Expert should be
consulted, the telephone or switch infrastructure responsible IESG area director should appoint the
Designated Expert. The intention is that any allocation will be
accompanied by a published RFC. But in order to mount an attack. While such attacks have been documented,
such as in [DECEPTION], they are assumed allow for the
allocation of values prior to be rare.

However, subsequently EAP has been proposed the RFC being approved for use on wireless
networks, and over publication,
the Internet, where physical security cannot Designated Expert can approve allocations once it seems clear
that an RFC will be
assumed. On such networks, the security vulnerabilities are greater,
as are published. The Designated expert will post a
request to the requirements for EAP security.

This section defines WG mailing list (or a successor designated by the threat model
Area Director) for comment and security terms review, including an Internet-Draft.
Before a period of 30 days has passed, the Designated Expert will
either approve or deny the registration request and
describes publish a notice
of the decision to the security claims section required in EAP method
specifications. We then discuss threat mitigation. WG mailing list or its successor, as well

Blunk, et al. Expires July 2, November 14, 2003 [Page 33] 34]

Internet-Draft EAP January May 2003

7.1 Threat model

On physically insecure networks,

as informing IANA. A denial notice must be justified by an
explanation and, in the cases where it is possible for an attacker to
gain access to possible, concrete
suggestions on how the physical medium. This enables request can be modified so as to become
acceptable.

6.1 Packet Codes

Packet Codes have a range of attacks,
including the following:

[1] An adversary may try to discover user identities by snooping
authentication traffic.

[2] An adversary may try from 1 to modify or spoof EAP packets.

[3] An adversary may launch denial 255, of service attacks by spoofing
layer 2 indications or EAP layer success/failure indications,
replaying which 1-4 have been
allocated. Because a new Packet Code has considerable impact on
interoperability, a new Packet Code requires Standards Action, and
should be allocated starting at 5.

6.2 Method Types

The original EAP packets, or generating packets with overlapping
Identifiers.

[4] An adversary might attempt method Type space has a range from 1 to recover 255, and is
the pass-phrase by mounting
an offline dictionary attack.

[5] An adversary scarcest resource in EAP, and thus must be allocated with care.
Method Types 1-41 have been allocated, with 20 available for re-use.
Method Types 42-191 may attempt to convince be allocated on the peer to connect to an
untrusted network, by mounting advice of a man-in-the-middle attack.

[6] An adversary may attempt to disrupt Designated
Expert, with Specification Required.

Allocation of blocks of method Types (more than one for a given
purpose) should require IETF Consensus. EAP Type Values 192-253 are
reserved and allocation requires Standards Action.

Method Type 254 is allocated for the Expanded Type. Where the EAP negotiation in order
to weaken
Vendor-Id field is non-zero, the authentication.

[7] An attacker may attempt Expanded Type is used for functions
specific only to recover the key by taking advantage one vendor's implementation of
weak key derivation techniques EAP, where no
interoperability is deemed useful. When used within EAP methods.

[8] An attacker may attempt to take advantage with a Vendor-Id of weak ciphersuites
subsequently
zero, method Type 254 can also be used to provide for an expanded
IETF method Type space. Method Type values 256-4294967295 may be
allocated after the EAP conversation Type values 1-191 have been allocated.

Method Type 255 is complete.

Where allocated for Experimental use, such as testing of
new EAP methods before a permanent Type code is used over wireless allocated.

7. Security Considerations

EAP was designed for use with dialup PPP [RFC1661] and was later
adapted for use in wired IEEE 802 networks [IEEE-802] in
[IEEE-802.1X]. On these networks, an attacker needs would need to gain
physical access to be
within the coverage area of the wireless medium telephone or switch infrastructure in order to carry out
these attacks. However, where EAP is used over the Internet, no
mount an attack. While such
restrictions apply.

7.2 Security claims

In order attacks have been documented, such as in
[DECEPTION], they are assumed to clearly articulate the security provided by an EAP
method, be rare.

However, subsequently EAP method specifications MUST include a Security Claims
section including the following declarations:

[a] Intended use. This includes a statement of whether the method is
intended has been proposed for use on wireless
networks, and over a physically secure or insecure network, as
well the Internet, where physical security cannot be
assumed. On such networks, the security vulnerabilities are greater,
as a statement of are the applicable media. requirements for EAP security.

Blunk, et al. Expires July 2, November 14, 2003 [Page 34] 35]

Internet-Draft EAP January May 2003

[b] Mechanism. This is a statement of the authentication technology:
certificates, pre-shared keys, passwords, token cards, etc.

[c] Security claims.

This is a statement of section defines the claimed threat model and security
properties of the method, using terms defined in Section 1.2:
mutual authentication, integrity protection, replay protection,
confidentiality, key derivation, key strength, dictionary attack
resistance, fast reconnect, man-in-the-middle resistance,
acknowledged result indications. The Security Claims and
describes the security claims section of
an required in EAP method specification SHOULD provide justification
specifications. We then discuss threat mitigation.

7.1 Threat model

On physically insecure networks, it is possible for the
claims that are made. This can be accomplished by including a
proof in an Appendix, or including a reference attacker to
gain access to a proof.

[d] Key strength. If the method derives keys, then the effective key
strength MUST be estimated. physical medium. This estimate is meant for potential
users enables a range of attacks,
including the method following:

[1] An attacker may try to determine if the keys produced are strong
enough for the intended application.

The effective key strength SHOULD be stated as number discover user identities by snooping
authentication traffic.

[2] An attacker may try to modify or spoof EAP packets.

[3] An attacker may launch denial of bits,
defined as follows: If the effective key strength is N bits, the
best currently known methods service attacks by spoofing
lower layer indications or Success/Failure packets; by replaying
EAP packets; or by generating packets with overlapping
Identifiers.

[4] An attacker may attempt to recover the key (with
non-negligible probability) require pass-phrase by mounting an effort comparable
offline dictionary attack.

[5] An attacker may attempt to 2^N
operations of a typical block cipher. The statement SHOULD be
accompanied convince the peer to connect to an
untrusted network, by mounting a short rationale, explaining how this number was
arrived at. This explanation SHOULD include man-in-the-middle attack.

[6] An attacker may attempt to disrupt the parameters
required EAP negotiation in order
cause a weak authentication method to achieve N bits be selected.

[7] An attacker may attempt to recover keys by taking advantage of entropy based on current knowledge
weak key derivation techniques used within EAP methods.

[8] An attacker may attempt to take advantage of weak ciphersuites
subsequently used after the algorithms.

(Note: Although it EAP conversation is difficult to define what "comparable
effort" and "typical block cipher" exactly mean, reasonable
approximations are sufficient here. Refer complete.

[9] An attacker may attempt to e.g. [SILVERMAN] for
more discussion.)

The key strength depends perform downgrading attacks on the methods used lower
layer ciphersuite negotiation in order to derive the keys.
For instance, if keys are derived from a shared secret (such as ensure that a
password or master key), and possibly some public information
such as nonces, the effective key strength weaker
ciphersuite is limited by the
entropy of the long-term secret (assuming that the derivation
procedure used subsequently to EAP authentication.

Where EAP is computationally simple). To take another example,
when using public key algorithms, the strength of used over wired networks, an attacker typically requires
access to the symmetric
key depends on physical infrastructure in order to carry out these
attacks. However, where EAP is used over wireless networks, EAP
packets may be forwarded by authenticators (e.g., pre-authentication)
so that the strength of attacker need not be within the public keys used.

[e] Description coverage area of key hierarchy. EAP methods deriving keys MUST
either provide a reference an
authenticator in order to a key hierarchy specification, carry out an attack on it or
describe how keys used for authentication/integrity, encryption
and IVs are to be derived from the provided keying material, and
how cryptographic separation its peers.
Where EAP is maintained between keys used for
different purposes. over the Internet, attacks may be carried out at an
even greater distance.

Blunk, et al. Expires July 2, November 14, 2003 [Page 35] 36]

Internet-Draft EAP January May 2003

[f] Indication of vulnerabilities.

7.2 Security claims

In addition order to clearly articulate the security claims
that are made, the specification provided by an EAP
method, EAP method specifications MUST indicate which of include a Security Claims
section including the
security claims detailed in Section 1.2 are NOT being made.

7.3 Identity protection

An Identity exchange is optional within following declarations:

[a] Intended use. This includes a statement of whether the EAP conversation.
Therefore, it method is possible to omit the Identity exchange entirely, or
to postpone it until later in the conversation once
intended for use over a protected
channel has been established.

However, where roaming is supported physically secure or insecure network, as described in [RFC2607], it may
be necessary to locate the appropriate backend authentication server
before the authentication conversation can proceed. The realm
portion
well as a statement of the Network Access Identifier (NAI) [RFC2486] is typically
included within the Identity-Response in order to enable the
authentication exchange to be routed to applicable lower layers.

[b] Mechanism. This is a statement of the appropriate backend authentication server. Therefore while technology:
certificates, pre-shared keys, passwords, token cards, etc.

[c] Security claims. This is a statement of the peer-name portion claimed security
properties of the
NAI may be omitted method, using terms defined in Section 1.2:
mutual authentication, integrity protection, replay protection,
confidentiality, key derivation, dictionary attack resistance,
fast reconnect, man-in-the-middle resistance, acknowledged result
indications. The Security Claims section of an EAP method
specification SHOULD provide justification for the Identity- Response, where proxies or relays claims that
are present, the realm portion may made. This can be required.

7.4 Man-in-the-middle attacks

Where accomplished by including a sequence of methods is utilized for authentication proof in an
Appendix, or EAP is
tunneled within another protocol that omits peer authentication,
there exists including a potential vulnerability reference to man-in-the-middle attack.

Where a sequence of EAP methods is utilized for authentication, proof.

[d] Key strength. If the
peer might not have proof that a single entity has acted as method derives keys, then the
authenticator effective key
strength MUST be estimated. This estimate is meant for all EAP methods within the sequence. For example,
an authenticator might terminate one EAP method, then forward potential
users of the
next method in the sequence to another party without the peer's
knowledge or consent. Similarly, the authenticator might not have
proof that a single entity has acted as determine if the peer keys produced are strong
enough for all EAP methods
within the sequence.

This enables an attack by a rogue EAP authenticator tunneling EAP to
a legitimate server. Where intended application.

The effective key strength SHOULD be stated as number of bits,
defined as follows: If the tunneling protocol effective key strength is used for N bits, the
best currently known methods to recover the key
establishment but does not (with
non-negligible probability) require peer authentication, an attacker
convincing a legitimate peer to connect effort comparable to it will 2^N
operations of a typical block cipher. The statement SHOULD be able to tunnel
EAP packets to
accompanied by a legitimate server, successfully authenticating and
obtaining the key. short rationale, explaining how this number was
arrived at. This allows explanation SHOULD include the attacker to successfully establish
itself as a man-in-the-middle, gaining access parameters
required to achieve the network, as well
as stated key strength based on current
knowledge of the ability algorithms.

(Note: Although it is difficult to decrypt data traffic between define what "comparable
effort" and "typical block cipher" exactly mean, reasonable
approximations are sufficient here. Refer to e.g. [SILVERMAN]
for more discussion.)

The key strength depends on the legitimate peer methods used to derive the keys.
For instance, if keys are derived from a shared secret (such as a
password or a long-term secret), and server.

This attack may be mitigated possibly some public
information such as nonces, the effective key strength is limited
by the following measures: strength of the long-term secret (assuming that the

Blunk, et al. Expires July 2, November 14, 2003 [Page 36] 37]

Internet-Draft EAP January 2003

[a] Requiring mutual authentication within EAP tunneling mechanisms.

[b] Requiring cryptographic binding between EAP methods executed
within a sequence or between the EAP tunneling protocol and the
tunneled EAP methods. Where cryptographic binding is supported, a
mechanism is also needed to protect against downgrade attacks
that would bypass it.

[c] Limiting the EAP methods authorized for use without protection,
based May 2003

derivation procedure is computationally simple). To take another
example, when using public key algorithms, the strength of the
symmetric key depends on peer and authenticator policy.

[d] Avoiding the use strength of sequences or tunnels when a single, strong
method is available.

7.5 Packet modification attacks

While individual the public keys used.

[e] Description of key hierarchy. EAP methods may support per-packet data origin
authentication, integrity and replay protection, EAP itself does not deriving keys MUST
either provide built-in support for this.

Since the Identifier is only a single octet, it is easy to guess,
allowing an attacker reference to successfully inject a key hierarchy specification, or replay EAP packets.
An attacker may also modify EAP headers within EAP packets where the
header is unprotected. This could cause packets
describe how Master Session Keys (MSKs) and Extended Master
Session Keys (EMSKs) are to be inappropriately
discarded or misinterpreted. derived.

[f] Indication of vulnerabilities. In addition to the case security
claims that are made, the specification MUST indicate which of PPP and IEEE 802 wired links,
the security claims detailed in Section 1.2 are NOT being made.

7.3 Identity protection

An Identity exchange is optional within the EAP conversation.
Therefore, it is assumed that such
attacks are restricted to attackers who can gain access possible to omit the
physical link. Identity exchange entirely, or
to use a method-specific identity exchange once a protected channel
has been established.

However, where EAP roaming is run over physically insecure
lower layers such supported as IEEE 802.11 or described in [RFC2607], it may
be necessary to locate the appropriate backend authentication server
before the authentication conversation can proceed. The realm
portion of the Internet (such as within
protocols supporting PPP, EAP or Ethernet Tunneling), this assumption Network Access Identifier (NAI) [RFC2486] is no longer valid and typically
included within the vulnerability Identity-Response in order to attack is greater.

To protect EAP messages sent over physically insecure lower layers,
methods providing mutual enable the
authentication and key derivation, as well
as per-packet origin authentication, integrity and replay protection
SHOULD be used. Method-specific MICs may exchange to be used routed to provide
protection. Since EAP messages the appropriate backend
authentication server. Therefore while the peer-name portion of Types Identity, Notification, and
Nak do not include their own MIC, it the
NAI may be desirable for omitted in the Identity- Response, where proxies or relays
are present, the realm portion may be required.

7.4 Man-in-the-middle attacks

Where EAP
method MIC to cover information contained is tunneled within these messages, as
well as the header of each another protocol that omits peer
authentication, there exists a potential vulnerability to
man-in-the-middle attack.

As noted in Section 2.1, EAP message. To provide protection, does not permit sequences of
authentication methods. Were a sequence of EAP
also may authentication
methods to be encapsulated within permitted, the peer might not have proof that a protected channel created by
protocols such as ISAKMP [RFC2408] single
entity has acted as is done the authenticator for all EAP methods within the
sequence. For example, an authenticator might terminate one EAP
method, then forward the next method in [PIC] the sequence to another party
without the peer's knowledge or within TLS
[RFC2246]. However, consent. Similarly, the
authenticator might not have proof that a single entity has acted as noted in Section 7.4,
the peer for all EAP tunneling may
result in methods within the sequence.

This enables an attack by a man-in-the-middle vulnerability. rogue EAP authenticator tunneling EAP to

Blunk, et al. Expires July 2, November 14, 2003 [Page 37] 38]

Internet-Draft EAP January May 2003

7.6 Dictionary attacks

Password authentication algorithms such as EAP-MD5, MS-CHAPv1
[RFC2433] and Kerberos V [RFC1510] are known

a legitimate server. Where the tunneling protocol is used for key
establishment but does not require peer authentication, an attacker
convincing a legitimate peer to connect to it will be vulnerable able to
dictionary attacks. MS-CHAPv1 vulnerabilities are documented in
[PPTPv1]; Kerberos vulnerabilities are described in [KRBATTACK],
[KRBLIM], tunnel
EAP packets to a legitimate server, successfully authenticating and [KERB4WEAK].

In order
obtaining the key. This allows the attacker to protect against dictionary attacks, an authentication
algorithm resistant successfully
establish itself as a man-in-the-middle, gaining access to dictionary the
network, as well as the ability to decrypt data traffic between the
legitimate peer and server.

This attack (as defined in Section 7.2) may be used. This is particularly important when EAP runs over media
which are not physically secure.

If an mitigated by the following measures:

[a] Requiring mutual authentication algorithm is used that is known to be vulnerable
to dictionary attack, then within EAP tunneling mechanisms.

[b] Requiring cryptographic binding between the EAP tunneling
protocol and the conversation may be tunneled within EAP methods. Where cryptographic
binding is supported, a
protected channel, in order mechanism is also needed to provide additional protection.
However, as noted in Section 7.4, protect
against downgrade attacks that would bypass it.

[c] Limiting the EAP tunneling may result in a
man-in-the-middle vulnerability, methods authorized for use without protection,
based on peer and therefore dictionary attack
resistant methods are preferred.

7.7 Connection to an untrusted network

With authenticator policy.

[d] Avoiding the use of tunnels when a single, strong method is
available.

7.5 Packet modification attacks

While EAP methods supporting one-way may support per-packet data origin authentication, such as EAP-MD5,
the authenticator's identity
integrity and replay protection, support is not verified. Where provided within the lower layer
is not physically secure (such as where
EAP runs over wireless media
or IP), this enables the peer to connect to a rogue authenticator. As
a result, where layer.

Since the lower layer Identifier is not physically secure, only a method
supporting mutual authentication is recommended.

In EAP there single octet, it is no requirement that authentication be full duplex easy to guess,
allowing an attacker to successfully inject or
that replay EAP packets. An
attacker may also modify EAP headers within EAP packets where the same protocol be used in both directions. It
header is perfectly
acceptable for different protocols unprotected. This could cause packets to be used in each direction.
This will, of course, depend on
inappropriately discarded or misinterpreted.

In the specific protocols negotiated.
However, in general, completing a single unitary mutual
authentication is preferable to two one-way authentications, one in
each direction. This case of PPP and IEEE 802 wired links, it is because separate authentications assumed that such
attacks are
not bound cryptographically so as restricted to demonstrate they are part of the
same session are subject attackers who can gain access to man-in-the-middle attacks, as discussed
in Section 7.4.

7.8 Negotiation attacks

In a negotiation attack, the attacker attempts to convince
physical link. However, where EAP is run over physically insecure
lower layers such as wireless (802.11 or cellular) or the peer Internet
(such as within protocols supporting PPP, EAP or Ethernet Tunneling),
this assumption is no longer valid and authenticator the vulnerability to negotiate a less secure EAP method. attack is
greater.

To protect EAP does not
provide messages sent over physically insecure lower layers,
methods providing mutual authentication and key derivation, as well
as per-packet origin authentication, integrity and replay protection for the Nak packet, although it is possible for a
method to include coverage of Nak Responses within a method-specific
MIC.

Blunk, et al. Expires July 2, November 14, 2003 [Page 38] 39]

Internet-Draft EAP January May 2003

To avoid negotiation attacks in situations where EAP runs over
physically insecure media, for each named peer there

SHOULD be an
indication used. Method-specific MICs may be used to provide
protection. Since EAP messages of exactly one Types Identity, Notification, and
Nak do not include their own MIC, it may be desirable for the EAP
method used MIC to authenticate that peer name, cover information contained within these messages, as described
well as the header of each EAP message. For details, see Appendix A.

To provide protection, EAP also may be encapsulated within a
protected channel created by protocols such as ISAKMP [RFC2408] as is
done in [PIC] or within TLS [RFC2246]. However, as noted in Section 2.1.

7.9 Implementation idiosyncrasies

The interaction of
7.4, EAP with lower layer transports tunneling may result in a man-in-the-middle vulnerability.

7.6 Dictionary attacks

Password authentication algorithms such as PPP EAP-MD5, MS-CHAPv1
[RFC2433] and
IEEE 802 are highly implementation dependent.

For example, upon failure of authentication, some PPP implementations
do not terminate the link, instead limiting traffic in Network-Layer
Protocols Kerberos V [RFC1510] are known to a filtered subset, be vulnerable to
dictionary attacks. MS-CHAPv1 vulnerabilities are documented in
[PPTPv1]; Kerberos vulnerabilities are described in [KRBATTACK],
[KRBLIM], and [KERB4WEAK].

Where EAP runs over lower layers which are not physically secure, in turn allows the peer the
opportunity
order to update secrets or send mail protect against dictionary attacks, an authentication
algorithm resistant to the network
administrator indicating a problem. Similarly, while dictionary attack (as defined in IEEE 802.1X Section 7.2)
SHOULD be used.

If an authentication failure will result in denied access algorithm is used that is known to be vulnerable
to dictionary attack, then the
controlled port, limited traffic conversation may be permitted on the uncontrolled
port.

In EAP there is no provision for retries of failed authentication.
However, in PPP the LCP state machine can renegotiate the
authentication protocol at any time, thus allowing tunneled within a new attempt.
Similarly,
protected channel, in IEEE 802.1X the Supplicant or Authenticator can
re-authenticate at any time. It is recommended that any counters used
for authentication failure not be reset until after successful
authentication, or subsequent termination of the failed link.

7.10 Key derivation

It is possible for the peer and EAP server order to mutually authenticate,
and derive provide additional protection.
However, as noted in Section 7.4, EAP tunneling may result in a Master Key (MK). The MK is unique to the peer
man-in-the-middle vulnerability, and therefore dictionary attack
resistant methods are preferred.

7.7 Connection to an untrusted network

With EAP
server and MUST NOT be exported by methods supporting one-way authentication, such as EAP-MD5,
the EAP method, or used directly
to protect peer does not authenticate the authenticator. Where the lower
layer is not physically secure (such as where EAP conversation runs over wireless
media or subsequent data. the Internet), the peer is vulnerable to a rogue
authenticator. As a result,
possession of where the MK represents proof of lower layer is not physically
secure, a successful authentication,
and this method supporting mutual authentication is potentially useful in enabling features such as fast
reconnect, or fast handoff. RECOMMENDED.

In order to provide keying material for use in a subsequently
negotiated ciphersuite, the EAP method exports a Master Session Key
(MSK). Like there is no requirement that authentication be full duplex or
that the EAP Master Key, EAP Master Session Keys are also not same protocol be used directly to protect data; however, they are of sufficient size in both directions. It is perfectly
acceptable for different protocols to enable subsequent derivation be used in each direction. This
will, of Transient Session Keys (TSKs) for
use with course, depend on the selected ciphersuite.

EAP methods provide Master Session Keys and specific protocols negotiated.
However, in general, completing a single unitary mutual
authentication is preferable to two one-way authentications, one in
each direction. This is because separate authentications that are
not Transient Session
Keys bound cryptographically so as to allow EAP methods to be ciphersuite and media
independent. Depending on the lower layer, EAP methods may run before
or after ciphersuite negotiation, so that demonstrate they are part of the selected ciphersuite

Blunk, et al. Expires July 2, November 14, 2003 [Page 39] 40]

Internet-Draft EAP January May 2003

may not be known

same session are subject to man-in-the-middle attacks, as discussed
in Section 7.4.

7.8 Negotiation attacks

In a negotiation attack, the attacker attempts to convince the peer
and authenticator to negotiate a less secure EAP method. By providing keying material
usable with any ciphersuite, EAP methods can used does
not provide protection for Nak Response packets, although it is
possible for a method to include coverage of Nak Responses within a
method-specific MIC.

Within or associated with each authenticator, it is not anticipated
that a wide range particular named peer will support a choice of ciphersuites and media. Since methods. This
would make the peer and EAP client reside on vulnerable to attacks that negotiate the same machine, TSKs can least
secure method from among a set. Instead, for each named peer there
SHOULD be provided an indication of exactly one method used to the lower layer security
module without needing authenticate
that peer name. If a peer needs to leave the machine.

In the case where the backend make use of different
authentication server and authenticator
reside on methods under different machines, there are several implications for
security:

[a] Mutual circumstances, then distinct
identities SHOULD be employed, each of which identifies exactly one
authentication may occur between method.

7.9 Implementation idiosyncrasies

The interaction of EAP with lower layers such as PPP and IEEE 802 are
highly implementation dependent.

For example, upon failure of authentication, some PPP implementations
do not terminate the link, instead limiting traffic in Network-Layer
Protocols to a filtered subset, which in turn allows the peer and the backend
opportunity to update secrets or send mail to the network
administrator indicating a problem. Similarly, while in
[IEEE-802.1X] an authentication server, if failure will result in denied access
to the negotiated controlled port, limited traffic may be permitted on the
uncontrolled port.

In EAP method supports
this. there is no provision for retries of failed authentication.
However, where in PPP the LCP state machine can renegotiate the authenticator and backend
authentication
server are separate, protocol at any time, thus allowing a new attempt.
Similarly, in IEEE 802.1X the peer and authenticator do Supplicant or Authenticator can
re-authenticate at any time. It is recommended that any counters
used for authentication failure not mutually
authenticate within EAP. However, be reset until after successful
authentication, or subsequent to completion termination of the EAP conversation, the lower layer may support mutual
authentication between the peer and authenticator. For example,
IEEE 802.11i includes a Transient Session failed link.

7.10 Key derivation protocol
known as the 4-way handshake, which guarantees liveness of the
TSKs, provides

It is possible for mutual authentication between the peer and
authenticator, replay protection, and protected ciphersuite
negotiation.

[b] The MSK negotiated between the peer and backend authentication EAP server will need to be transmitted mutually authenticate,
and derive keys. In order to the authenticator. The
specification provide keying material for use in a
subsequently negotiated ciphersuite, an EAP method supporting key

Blunk, et al. Expires November 14, 2003 [Page 41]

Internet-Draft EAP May 2003

derivation MUST export a Master Session Key (MSK) of this transit mechanism is outside the scope at least 64
octets, and an Extended Master Session Key (EMSK) of
this document.

This specification does at least 64
octets.

The MSK and EMSK are not provide detailed guidance on how EAP
methods used directly to protect data; however, they
are of sufficient size to derive the MK and MSK. Key derivation is an art that
is best practiced by professionals; rather than inventing new key enable subsequent derivation algorithms, reuse of existing algorithms such as those
specified in IKE [RFC2409], or TLS [RFC2246] Transient
Session Keys (TSKs) for use with the selected ciphersuite. Each
ciphersuite is recommended.

However, some general guidelines can be provided:

[1] responsible for specifying how to derive the TSKs from
the MSK. The MK EAP method is also responsible for use only by the derivation of
Transient EAP authenticator and peer Keys (TEKs) used for protection of the EAP conversation
itself.

EAP methods provide Master Session Keys and MUST
NOT not Transient Session
Keys so as to allow EAP methods to be exported by ciphersuite and media
independent. Depending on the lower layer, EAP method methods may run
before or provided to a third party.

[2] Since after ciphersuite negotiation, so that the MSK is exported by selected
ciphersuite may not be known to the EAP method, while the MK is not,
possession method. By providing keying
material usable with any ciphersuite, EAP methods can used with a
wide range of ciphersuites and media.

Non-overlapping substrings of the MSK MUST NOT provide information useful in
determining the MK.

[3] The MSK and TSKs MUST be fresh. Otherwise it is infeasible to
detect messages replayed cryptographically
separate from prior sessions.

Blunk, et al. Expires July 2, 2003 [Page 40]

Internet-Draft EAP January 2003

[4] each other. This is required because some existing
ciphersuites form TSKs by simply splitting the MSK to pieces of
appropriate length. Likewise, non-overlapping substrings of EMSK
MUST be cryptographically independent separate from each other so
that if an attacker obtains one other, and from
substrings of them, he will not have gained
information useful in determining the other ones.

[5] There MSK.

The EMSK is reserved for future use and MUST remain on the EAP peer
and EAP server where it is derived; it MUST NOT be a way to determine whether TSKs belong to this transported to, or
shared with, additional parties, or used to some derive any other session.

[6] The MSK derived by keys.
(This restriction will be relaxed in a future document that specifies
how the EMSK can be used.)

This specification does not provide detailed guidance on how EAP
methods MUST be bound are to derive the peers as well
as MSK, EMSK and TEKs, or how the TSKs are to
be derived from the authentication method, so MSK. Key derivation is an art that is best
practiced by professionals; rather than inventing new key derivation
algorithms, reuse of existing algorithms such as to avoid a
man-in-the-middle attack (see Section 7.4). those specified in
IKE [RFC2409], or TLS [RFC2246] is recommended.

Further details on EAP Key Derivation are provided within [KEYFRAME].

7.11 Weak ciphersuites

If after the initial EAP authentication, data packets are sent
without per-packet authentication, integrity and replay protection,
an attacker with access to the media can inject packets, "flip bits"
within existing packets, replay packets, or even hijack the session

Blunk, et al. Expires November 14, 2003 [Page 42]

Internet-Draft EAP May 2003

completely. Without per-packet confidentiality, it is possible to
snoop data packets.

As a result, as noted in Section 3.1, where EAP is used over a
physically insecure lower layer, per-packet authentication, integrity
and replay protection SHOULD be used, and per-packet confidentiality
is also recommended.

Additionally, if the lower layer performs ciphersuite negotiation, it
should be understood that EAP does not provide by itself integrity
protection of that negotiation. Therefore, in order to avoid
downgrading attacks which would lead to weaker ciphersuites being
used, clients implementing lower layer ciphersuite negotiation SHOULD
protect against negotiation downgrading.

This can be done by enabling users to configure which are the
acceptable ciphersuites as a matter of security policy; or, the
ciphersuite negotiation MAY be authenticated using keying material
derived from the EAP authentication and a MIC algorithm agreed upon
in advance by lower-layer peers.

7.12 Link layer

There exists a number of reliability and security issues with link
layer indications in PPP, IEEE 802 wired networks and IEEE 802.11
wireless LANs:

[a] PPP. In PPP, link layer indications such as LCP-Terminate (a
link failure indication) and NCP (a link success indication) are
not authenticated or integrity protected. They can therefore be
spoofed by an attacker with access to the physical medium.

[b] IEEE 802 wired networks. On wired networks, IEEE 802.1X messages
are sent to a non-forwardable multicast MAC address. As a
result, while the IEEE 802.1X EAPOL-Start and EAPOL-Logoff frames
are not authenticated or integrity protected, only an attacker
with access to the physical link can spoof these messages.

[c] IEEE 802.11 wireless LANs. In IEEE 802.11, link layer
indications include Disassociate and Deauthenticate frames (link
failure indications), and Association and Reassociation Response
frames (link success indications). These messages are not
authenticated or integrity protected, and although they are not
forwardable,

Blunk, et al. Expires July 2, 2003 [Page 41]

Internet-Draft EAP January 2003 they are spoofable by an attacker within range.

In IEEE 802.11, IEEE 802.1X data frames are may be sent as Class 3
unicast data frames, and are therefore forwardable. This implies
that while EAPOL-Start and EAPOL-Logoff messages may be

Blunk, et al. Expires November 14, 2003 [Page 43]

Internet-Draft EAP May 2003

authenticated and integrity protected, they can be spoofed by an
authenticated attacker far from the target when
"pre-authentication" is
enabled. enabled.

In IEEE 802.11 a "link down" indication is an unreliable
indication of link failure, since wireless signal strength can
come and go and may be influenced by radio frequency interference
generated by an attacker. To avoid unnecessary resets, it is
advisable to damp these indications, rather than passing them
directly to the EAP. Since EAP supports retransmission, it is
robust against transient connectivity losses.

7.13 Separation of EAP server and authenticator and backend authentication server

It is possible for the EAP peer and authenticator to mutually
authenticate, and derive a Master Session Key (MSK) for a ciphersuite
used to protect subsequent data traffic. This does not present an
issue on the peer, since the peer and EAP client reside on the same
machine; all that is required is for the EAP client module to derive
and pass a Transient Session Key (TSK) to the ciphersuite module.

However, in the case where the EAP server and authenticator and authentication
server reside on different machines, there are several implications
for security.

[a] Authentication will occur between the peer and the EAP authentication
server, not between the peer and the authenticator. This means
that it is not possible for the peer to validate the identity of
the NAS or
tunnel server authenticator that it is speaking to, using EAP alone.

[b] As discussed in [RFC2869bis], the authenticator is dependent on
the AAA protocol in order to know the outcome of an
authentication conversation, and does not look at the
encapsulated EAP packet (if one is present) to determine the
outcome. In practice this means that the AAA protocol spoken
between the authenticator and authentication server MUST support
per-packet authentication, integrity and replay protection.

[c] A EAP Master Session Key (MSK) negotiated between the peer and
EAP server will need to be transmitted to the authenticator.
Therefore a mechanism needs to be provided to transmit the MSK
from the EAP server to the authenticator or tunnel server that
needs it. The specification of the key transport and wrapping
mechanism is outside the scope of this document.

7.14 Strict Interpretation

An EAP method wishing to enforce tighter security than is provided by
the packet processing rules of Section 2.1 and Section 4.2.1 MAY
indicate within their specification that they follow a "strict

Blunk, et al. Expires July 2, 2003 [Page 42]

Internet-Draft EAP January 2003

interpretation" of EAP.

When requested by a method, "strict interpretation" causes the Where EAP
implementation to impose inbound filter rules from the point where an
initial Request is answered with a Response of the same Type, until
the method completes. "Strict interpretation" also implies that on
completion the peer method will indicate whether it succeeded (was
able to authenticate the authenticator) or failed (did not succeed in
authenticating the authenticator).

An EAP method making use of "strict interpretation" must include a
definition of completion for both the peer and authenticator, and
also must indicate the conditions under which successful completion
will be indicated.

The filter rules are as follows:

[a] On the peer, all EAP packets are silently discarded, except for
those with Code=1 (Request) and Type=Method-Type. This implies
that methods supporting "strict interpretation" do not utilize
Notification, but instead support their own method-specific error
messages.

[b] On used over lower layers which are not physically
secure, subsequent to completion of the peer, once EAP conversation, a
subsequent protocol SHOULD be run between the method completes unsuccessfully, peer and
authentication in order to mutually authenticate the peer and
authenticator; guarantee liveness of the TSKs; provide protected
ciphersuite and capabilities negotiation; and provide for
synchronized key usage.

Blunk, et al. Expires November 14, 2003 [Page 44]

Internet-Draft EAP
conversation is terminated, May 2003

[d] An EAP Master Session Key (MSK) negotiated between the link is not enabled peer and Success
packets are silently discarded. If
authentication server MAY be transmitted to the conversation completes
successfully, then Failure packets are silently discarded.

[c] On authenticator.
Therefore a mechanism needs to be provided to transmit the EAP server, once MSK
from the initial EAP Request is responded authentication server to
with an EAP Response the authenticator that needs
it. The specification of the same Type, all EAP packets are
silently discarded, except those with Code=2 (Response) key transport and
Type=EAP-Method-Type.

Implementation note: While none of wrapping
mechanism is outside the methods defined in scope of this
document support strict interpretation, EAP-TLS [RFC2716]
implementations SHOULD support strict interpretation. document.

8. Acknowledgments

This protocol derives much of its inspiration from Dave Carrel's AHA
draft as well as the PPP CHAP protocol [RFC1994]. Valuable feedback
was provided by Yoshihiro Ohba of Toshiba America Research, Jari
Arkko of Ericsson, Sachin Seth of Microsoft, Glen Zorn of Cisco
Systems, Jesse Walker of intel, Intel, Bill Arbaugh, Nick Petroni, Petroni and Bryan
Payne of the University of Maryland, Steve Bellovin of AT&T Research,
Paul Funk of Funk
Software and Software, Pasi Eronen of Nokia. Nokia, Joseph Salowey of
Cisco and Paul Congdon of HP and members of the EAP working group.

Normative References

Blunk, et al. Expires July 2, 2003 [Page 43]

Internet-Draft EAP January 2003

[RFC1661] Simpson, W., "The Point-to-Point Protocol (PPP)", STD 51,
RFC 1661, July 1994.

[RFC1994] Simpson, W., "PPP Challenge Handshake Authentication
Protocol (CHAP)", RFC 1994, August 1996.

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2243] Metz, C., "OTP Extended Responses", RFC 2243, November
1997.

[RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO
10646", RFC 2279, January 1998.

[RFC2289] Haller, N., Metz, C., Nesser, P. and M. Straw, "A One-Time
Password System", RFC 2289, February 1998.

[RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange
(IKE)", RFC 2409, November 1998.

[RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 2434,
October 1998.

[RFC2988] Paxson, V. and M. Allman, "Computing TCP's Retransmission
Timer", RFC 2988, November 2000.

[IEEE.802.1990]

Blunk, et al. Expires November 14, 2003 [Page 45]

Internet-Draft EAP May 2003

[IEEE-802]
Institute of Electrical and Electronics Engineers, "Local
and Metropolitan Area Networks: Overview and
Architecture", IEEE Standard 802, 1990.

[IEEE.802-1X.2001]

[IEEE-802.1X]
Institute of Electrical and Electronics Engineers, "Local
and Metropolitan Area Networks: Port-Based Network Access
Control", IEEE Standard 802.1X, September 2001.

Informative References

[DECEPTION]
Slatalla, M. and J. Quittner, "Masters of Deception",
HarperCollins , New York, 1995.

[RFC1510] Kohl, J. and B. Neuman, "The Kerberos Network
Authentication Service (V5)", RFC 1510, September 1993.

[RFC2246] Dierks, T., Allen, C., Treese, W., Karlton, P., Freier, A.

Blunk, et al. Expires July 2, 2003 [Page 44]

Internet-Draft EAP January 2003
and P. Kocher, "The TLS Protocol Version 1.0", RFC 2246,
January 1999.

[RFC2284] Blunk, L. and J. Vollbrecht, "PPP Extensible
Authentication Protocol (EAP)", RFC 2284, March 1998.

[RFC2486] Aboba, B. and M. Beadles, "The Network Access Identifier",
RFC 2486, January 1999.

[RFC2401] Kent, S. and R. Atkinson, "Security Architecture for the
Internet Protocol", RFC 2401, November 1998.

[RFC2408] Maughan, D., Schneider, M. and M. Schertler, "Internet
Security Association and Key Management Protocol
(ISAKMP)", RFC 2408, November 1998.

[RFC2433] Zorn, G. and S. Cobb, "Microsoft PPP CHAP Extensions", RFC
2433, October 1998.

[RFC2607] Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy
Implementation in Roaming", RFC 2607, June 1999.

[RFC2661] Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, G.
and B. Palter, "Layer Two Tunneling Protocol "L2TP"", RFC
2661, August 1999.

[RFC2716] Aboba, B. and D. Simon, "PPP EAP TLS Authentication
Protocol", RFC 2716, October 1999.

Blunk, et al. Expires November 14, 2003 [Page 46]

Internet-Draft EAP May 2003

[RFC3454] Hoffman, P. and M. Blanchet, "Preparation of
Internationalized Strings ("stringprep")", RFC 3454,
December 2002.

[KRBATTACK]
Wu, T., "A Real-World Analysis of Kerberos Password
Security", Stanford University Computer Science
Department, http://theory.stanford.edu/~tjw/krbpass.html.

[KRBLIM] Bellovin, S. and M. Merrit, "Limitations of the Kerberos
authentication system", Proceedings of the 1991 Winter
USENIX Conference, pp. 253-267, 1991.

[KERB4WEAK]
Dole, B., Lodin, S. and E. Spafford, "Misplaced trust:
Kerberos 4 session keys", Proceedings of the Internet
Society Network and Distributed System Security Symposium,
pp. 60-70, March 1997.

[PIC] Aboba, B., Krawczyk, H. and Y. Sheffer, "PIC, A Pre-IKE
Credential Provisioning Protocol", draft-ietf-ipsra-pic-06
(work in progress), October 2002.

Blunk, et al. Expires July 2, 2003 [Page 45]

Internet-Draft EAP January 2003

[PPTPv1] Schneier, B. and Mudge, "Cryptanalysis of Microsoft's
Point-to- Point Tunneling Protocol", Proceedings of the
5th ACM Conference on Communications and Computer
Security, ACM Press, November 1998.

[IEEE.802-3.1996]

[IEEE-802.3]
Institute of Electrical and Electronics Engineers,
"Information technology - Telecommunications and
Information Exchange between Systems - Local and
Metropolitan Area Networks - Specific requirements - Part
3: Carrier sense multiple access with collision detection
(CSMA/CD) Access Method and Physical Layer
Specifications", IEEE Standard 802.3, 1996.

[IEEE.802-11.1999] September 1998.

[IEEE-802.11]
Institute of Electrical and Electronics Engineers,
"Information Technology - Telecommunications and
Information Exchange between Systems - Local and
Metropolitan Area Network - Specific Requirements - Part
11: Wireless LAN Medium Access Control (MAC) and Physical
Layer (PHY) Specifications", IEEE Standard 802.11, 1999.

[SILVERMAN]
Silverman, Robert D., "A Cost-Based Security Analysis of
Symmetric and Asymmetric Key Lengths", RSA Laboratories

Blunk, et al. Expires November 14, 2003 [Page 47]

Internet-Draft EAP May 2003

Bulletin 13, April 2000 (Revised November 2001), http://
www.rsasecurity.com/rsalabs/bulletins/bulletin13.html.

[RFC2869bis]
Aboba, B. and P. Calhoun, "RADIUS Support For Extensible
Authentication Protocol (EAP)",
draft-aboba-radius-rfc2869bis-09
draft-aboba-radius-rfc2869bis-21 (work in progress),
February May
2003.

[IANA-EXP]
Narten, T., "Assigning Experimental and Testing Numbers
Considered Useful",
draft-narten-iana-experimental-allocations-03 (work in
progress), December 2002.

Blunk, et al. Expires July 2, 2003 [Page 46]

Internet-Draft EAP January 2003

[KEYFRAME]
Aboba, B. and D. Simon, "EAP Keying Framework",
draft-aboba-pppext-key-problem-06 (work in progress),
March 2003.

[SASLPREP]
Zeilenga, K., "SASLprep: Stringprep profile for user names
and passwords", draft-ietf-sasl-saslprep-01 (work in
progress), May 2003.

[IEEE-802.11i]
Institute of Electrical and Electronics Engineers,
"Unapproved Draft Supplement to Standard for
Telecommunications and Information Exchange Between
Systems - LAN/MAN Specific Requirements - Part 11:
Wireless LAN Medium Access Control (MAC) and Physical
Layer (PHY) Specifications: Specification for Enhanced
Security", IEEE Draft 802.11i (work in progress), 2003.

Authors' Addresses

Larry J. Blunk
Merit Network, Inc
4251 Plymouth Rd., Suite 2000
Ann Arbor, MI 48105-2785
USA

Phone: +1 734-647-9563
Fax: +1 734-647-3185
EMail: ljb@merit.edu

Blunk, et al. Expires November 14, 2003 [Page 48]

Internet-Draft EAP May 2003

John R. Vollbrecht
Vollbrecht Consulting LLC
9682 Alice Hill Drive
Dexter, MI 48130
USA

Phone:
EMail: jrv@umich.edu

Bernard Aboba
Microsoft Corporation
One Microsoft Way
Redmond, WA 98052
USA

Phone: +1 425 706 6605
Fax: +1 425 936 6605
EMail: bernarda@microsoft.com

James Carlson
Sun Microsystems, Inc
1 Network Drive
Burlington, MA 01803-2757
USA

Phone: +1 781 442 2084
Fax: +1 781 442 1677
EMail: james.d.carlson@sun.com

Blunk, et al. Expires July 2, 2003 [Page 47]

Internet-Draft EAP January 2003

Henrik Levkowetz
ipUnplugged AB
Arenavagen 33
Stockholm S-121 28
SWEDEN

Phone: +46 8 725 9513
EMail: henrik@levkowetz.com

Appendix A. Method Specific Behavior

A.1 Message Integrity Checks

Today, EAP methods commonly define message integrity checks (MICs)
that cover more than one EAP packet. For example, EAP-TLS [RFC2716]
defines a MIC over a TLS record that could be split into multiple

Blunk, et al. Expires November 14, 2003 [Page 49]

Internet-Draft EAP May 2003

fragments; within the FINISHED message, the MIC is computed over
previous messages. Where the MIC covers more than one EAP packet, a
MIC validation failure is typically considered a fatal error.. error.

If a per-packet MIC is employed within an EAP method, then peers,
authentication servers, and authenticators not operating in
pass-through mode MUST validate the MIC. MIC validation failures
SHOULD be logged. Whether a MIC validation failure is considered a
fatal error or not is determined by the EAP method specification.

Within EAP-TLS [RFC2716] a MIC validation failures failure is treated as a
fatal error, since that is what is specified in TLS [RFC2246].
However, it is also possible to develop EAP methods that support
per-packet MICs, and respond to verification failures by silently
discarding the offending packet.

In this document, descriptions of EAP message handling assume that
per-packet MIC validation, where it occurs, is effectively performed
as though it occurs before sending any responses or changing the
state of the host which received the packet.

Appendix B. Changes from RFC 2284

This section lists the major changes between [RFC2284] and this
document. Minor changes, including style, grammar, spelling and
editorial changes are not mentioned here.

o The Terminology section (Section 1.2) has been expanded, defining
more concepts and giving more exact definitions.

o In Section 2, it is explicitly specified that more than one
exchange of Request and Response packets may occur as part of the

Blunk, et al. Expires July 2, 2003 [Page 48]

Internet-Draft EAP January 2003
EAP authentication exchange. How this may and may not be used is
specified in detail in Section 2.1.

o Also in Section 2, some requirements on the authenticator when
acting in pass-through mode has been made explicit.

o An EAP multiplexing model (Section 2.2) has been added, to
illustrate a typical implementation of EAP. There is no
requirement that an implementation conforms to this model, as long
as the on-the-wire behavior is consistent with it.

o As EAP is now in use with a variety of lower layers, not just PPP
for which it was first designed, Section 3 on lower layer behavior
has been added.

o In the description of the EAP Request and Response interaction

Blunk, et al. Expires November 14, 2003 [Page 50]

Internet-Draft EAP May 2003

(Section 4.1), it has been more exactly specified when packets
should be silently discarded, and also the behavior on receiving
duplicate requests. The implementation notes in this section has
been substantially expanded.

o In Section 4.2, it has been clarified that Success and Failure
packets must not contain additional data, and the implementation
note has been expanded. A subsection giving requirements on
processing of success and failure packets has been added.

o Section 5 on EAP Request/Response Types lists two new type Type values:
the Expanded type Type (Section 5.7), which is used to expand the type Type
value number space, and the Experimental type. Type. In the Expanded
type
Type number space, the new Expanded Nak (Section 5.3.2) type Type has
been added. Clarifications have been made in the description of
most of the existing types. Types. Security claims summaries have been
added for authentication methods.

o In Section 5.5, support for OTP Extended Responses [RFC2243] has
been added to EAP OTP.

o An IANA Considerations section (Section 6) has been added, giving
registration policies for the numbering spaces defined for EAP.

o The Security Considerations (Section 7) have been greatly
expanded, aiming at giving a much more comprehensive coverage of
possible threats and other security considerations.

o Appendix A has been added on method-specific behavior, providing
guidance on how EAP method-specific integrity checks should be
processed. Where possible, it is desirable for a method-specific
MIC to be computed over the entire EAP packet, including the EAP
layer header (Code, Identifier, Length) and EAP method layer
header (Type, Type-Data).

Appendix C. Open issues

(This section should be removed by the RFC editor before publication)

Open issues relating to this specification are tracked on the
following web site:

Blunk, et al. Expires July 2, 2003 [Page 49]

Internet-Draft EAP January 2003

http://www.drizzle.com/~aboba/EAP/eapissues.html

The current working documents for this draft are available at this
web site:

Blunk, et al. Expires November 14, 2003 [Page 51]

Internet-Draft EAP May 2003

http://www.levkowetz.com/pub/ietf/drafts/eap/

Blunk, et al. Expires July 2, November 14, 2003 [Page 50] 52]

Internet-Draft EAP January May 2003

Intellectual Property Statement

The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; neither does it represent that it
has made any effort to identify any such rights. Information on the
IETF's procedures with respect to rights in standards-track and
standards-related documentation can be found in BCP-11. Copies of
claims of rights made available for publication and any assurances of
licenses to be made available, or the result of an attempt made to
obtain a general license or permission for the use of such
proprietary rights by implementors or users of this specification can
be obtained from the IETF Secretariat.

The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights which may cover technology that may be required to practice
this standard. Please address the information to the IETF Executive
Director.

Full Copyright Statement

This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.

The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assignees.

This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION

Blunk, et al. Expires July 2, November 14, 2003 [Page 51] 53]

Internet-Draft EAP January May 2003

HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

Funding for the RFC Editor function is currently provided by the
Internet Society.

Blunk, et al. Expires July 2, November 14, 2003 [Page 52] 54]

----