eap@conference.ietf.jabber.com - 2002/11/18
[09:12] %% logger has arrived.
[09:17] %% logger has arrived.
[09:24] %% logger has arrived.
[09:31] %% logger has arrived.
[11:51] %% logger has arrived.
[13:35] %% mrose has arrived.
[13:44] %% ietfwatch has arrived.
[13:49] %% jaym has arrived.
[13:49] <jaym> Most likely will send out survey again to see where the feature set usage is ag
[13:50] <jaym> 2284bis Issues:
[13:52] <jaym> 8 issues open 6 months or more, relative little discussion on posted 2284bis issues
[13:52] <jaym> if issues aren't addressed, EAP WG will miss milestones by considerable margin
[13:52] %% aamelnikov has arrived.
[13:52] <jaym> 14 open issues
[13:53] <jaym> ESTEEM: Eap STate machinE dEsign teaM
[13:53] %% inkyulee has arrived.
[13:53] <jaym> draft-ietf-eap-esteem-00.txt
[13:53] <jaym> Goal: FIx state machine so that it is compatable with IEEE 802.1aa and RFC 2869
[13:55] <jaym> ESTEEM Decisions: Follow IEEE 802.1aa format in state machine definition
[13:57] <jaym> Access to IEEE 802.1 group:
username: p8021
password: go_wildcats
[14:01] %% mrose has left.
[14:02] <jaym> WG recommendeds #42 (EAP Enhancements for heartbeats and supporting PAP)
[14:02] <inkyulee> both suggestions are rejected?
[14:07] <jaym> from the person at the mike (sorry, don't know names) both suggestions were in one comment from the IEEE, and yes they were both rejected based on no opposition from WG meeting attendees
[14:12] %% andersa has arrived.
[14:12] <jaym> Alternate Indications (Open Issue #2): EAP Design Team has recommendation within draft specifying how to handle. No attendee comments and is acceptable
[14:13] <jaym> Open Issues sections stopped at this point for lack of time
[14:13] %% ietfwatch has left.
[14:16] <jaym> EAP State Machine presentation:
[14:16] <jaym> Changes based on design-team discussion:
[14:17] <jaym> - IEEE 802.1x notation
- Nak handling
[14:17] <jaym> - Identity Handling
[14:17] <jaym> identity not being a typical message...
[14:17] <jaym> State machine diagram... pretty hard to re-represent that here in Jabber!
[14:20] %% paul.knight has arrived.
[14:22] %% aamelnikov has left.
[14:33] %% hartmans has arrived.
[14:34] %% Aaron has arrived.
[14:34] %% Aaron has left.
[14:36] %% jaym has left.
[14:42] %% paul.knight has left.
[14:45] %% jaym has arrived.
[14:46] %% mrose has arrived.
[14:52] %% hartmans has left.
[14:52] %% hartmans has arrived.
[15:02] %% warlord has arrived.
[15:02] <hartmans> So, what is a compound method in the sense of thi discussion here?
[15:04] <warlord> I believe it's the ability to run one EAP method inside another.
[15:04] <warlord> For example, you use SSL,and run MD5 inside it.
[15:06] <hartmans> So, apparently we're discussing attacks that happen when you have different methods with different security properties combined using the same credentials
[15:06] <warlord> he's describing the issue now..
[15:09] <hartmans> For the log if you tunnel authentication, have a outer strong method that can be attacked by a man-in-the-middle, then have an inner method for authenticating the user, then you may have a strong session with the man in the middle not the user
[15:10] <warlord> This is particularly true if the two methods are not tied together.
[15:12] <hartmans> questioner claims that a policy that you must run inner protocol through tunnel solves the problem
[15:12] <hartmans> I believe that cryptographic binding is required because of the MITM issue described
[15:16] <hartmans> design constraints: Cannot change legacy EAP methods.
[15:16] <hartmans> Perhaps make changes in EAP?
[15:17] <hartmans> O, discussion in another forum points out binding is not required if you actually authenticate the server in the tunnel setup
[15:18] %% jaym has left.
[15:19] <warlord> And if you force the tunnel from the client.
[15:30] %% inkyulee has left.
[15:33] <hartmans> Wait how have you handed weak credentials to the mitm even if you protect aigainst session attacks?
[15:36] %% andersa has left.
[15:37] %% warlord has left.
[15:37] %% warlord has arrived.
[15:37] %% warlord has left.
[15:37] %% hartmans has left.
[15:38] %% mrose has left.
[17:29] %% warlord has arrived.
[17:29] %% warlord has left.
[21:09] %% logger has arrived.
[21:44] %% logger has arrived.
eap@conference.ietf.jabber.com - 2002/11/19
[15:00] %% hartmans has arrived.
[15:03] %% mrose has arrived.
[15:03] %% warlord has arrived.
[15:06] %% jhutz has arrived.
[15:08] %% hartmans has left.
[15:08] %% hartmans has arrived.
[15:09] <warlord> welcome to EAP
[15:11] %% andersa has arrived.
[15:17] <hartmans> You have keys sent from peers to NAS and AAA server to NAS
[15:17] <hartmans> NAS typically doesn't implement many EAP methods; generally a AAA server does
[15:19] <hartmans> KD should be cipher independent; you need two phases one that is a master session key, one for cipher
[15:23] <hartmans> Explains key heirarchies
[15:23] <hartmans> EAP's exported key material is defined by AAA AVPs
[15:28] <hartmans> What kind of forward nonce exchange is he talking about?
[15:32] <warlord> Dont know
[15:38] <hartmans> Um, the GSS draft seems to be still alive. That's unfortunate
[15:39] <warlord> Yes, it is alive.
[15:39] <hartmans> How would we go about killing it?
[15:40] <warlord> I dont know.
[15:41] <hartmans> OK.
[15:46] <jhutz> It should probably be killed, if they're doing what Sam described in the SASL meeting
[15:46] <jhutz> How about a reference to the draft in question.
[15:47] <warlord> eap-gss?
[15:48] <jhutz> maybe a full filename?
[15:48] <warlord> [draft-aboba-pppext-eapgss-12.txt]
[15:49] %% RjS has arrived.
[15:49] <warlord> (does that help?)
[15:52] %% mrose has left.
[15:52] <jhutz> yes, that helped. make sure smb knows about this, and point out the problems with the KD in section 4.
[15:54] <hartmans> I think I've already sent mail to IESG about this at least once before but will do so again
[15:55] %% RjS has left.
[16:04] <warlord> Going.. going.. gone.
[16:04] %% warlord has left.
[16:04] %% jhutz has left.
[16:04] %% andersa has left.
[16:05] %% hartmans has left.