RE: [Emu] Issue: Definition of Session-Id, Peer-Id, Server-Id forEAP GPSK

["Joseph Salowey \(jsalowey\)" <jsalowey at cisco.com>]

> -----Original Message-----
> From: Bernard Aboba [mailto:bernard_aboba at hotmail.com] 
> Sent: Wednesday, November 22, 2006 8:52 AM
> To: clancy at cs.umd.edu
> Cc: emu at ietf.org
> Subject: Re: [Emu] Issue: Definition of Session-Id, 
> Peer-Id,Server-Id forEAP GPSK
> 
> >Sounds reasonable, but I'm not entirely sure I'd call the ID_Server 
> >unauthenticated.  It's authenticated in GPSK-3 when the 
> server includes 
> >it in the key derivation to compute SK.  If the value was 
> changed by an 
> >attacker, the authentication would fail.
> 
> The client only confirms that the server has access to the 
> PSK, but it doesn't confirm the specific server identity.  
> This is different from TLS-based EAP methods where the client 
> can verify a certificate issued to a specific server.
> 
[Joe] Yes, by it's nature symmetric authentication is different than
asymmetric authentication, but that doesn't mean that an identity is not
authenticated in the symmetric case.  

> 
> 
> _______________________________________________
> Emu mailing list
> Emu at ietf.org
> https://www1.ietf.org/mailman/listinfo/emu
> 

_______________________________________________
Emu mailing list
Emu at ietf.org
https://www1.ietf.org/mailman/listinfo/emu