idnits 2.17.1 draft-arkko-emu-rfc3748bis-00.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (February 22, 2021) is 1159 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE-802' -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE-802.1X' -- Obsolete informational reference (is this intentional?): RFC 793 (Obsoleted by RFC 9293) -- Obsolete informational reference (is this intentional?): RFC 1510 (Obsoleted by RFC 4120, RFC 6649) -- Obsolete informational reference (is this intentional?): RFC 1750 (Obsoleted by RFC 4086) -- Obsolete informational reference (is this intentional?): RFC 2246 (Obsoleted by RFC 4346) -- Obsolete informational reference (is this intentional?): RFC 2284 (Obsoleted by RFC 3748) -- Obsolete informational reference (is this intentional?): RFC 2408 (Obsoleted by RFC 4306) -- Obsolete informational reference (is this intentional?): RFC 2409 (Obsoleted by RFC 4306) -- Obsolete informational reference (is this intentional?): RFC 2486 (Obsoleted by RFC 4282) -- Obsolete informational reference (is this intentional?): RFC 3454 (Obsoleted by RFC 7564) -- Obsolete informational reference (is this intentional?): RFC 4960 (Obsoleted by RFC 9260) -- Obsolete informational reference (is this intentional?): RFC 4013 (Obsoleted by RFC 7613) -- Obsolete informational reference (is this intentional?): RFC 7613 (Obsoleted by RFC 8265) == Outdated reference: A later version (-07) exists of draft-ietf-ipsra-pic-05 == Outdated reference: A later version (-21) exists of draft-ietf-emu-eap-tls13-13 == Outdated reference: A later version (-10) exists of draft-ietf-emu-rfc5448bis-09 Summary: 0 errors (**), 0 flaws (~~), 4 warnings (==), 15 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group B. Aboba 3 Internet-Draft Microsoft Corporation 4 Obsoletes: 3748 (if approved) L. Blunk 5 Intended status: Standards Track Merit Network, Inc 6 Expires: August 26, 2021 J. Vollbrecht 7 Vollbrecht Consulting LLC 8 J. Carlson 9 Sun Microsystems, Inc 10 H. Levkowetz 11 ipUnplugged AB 12 J. Arkko (Ed.) 13 J. Mattsson (Ed.) 14 Ericsson 15 February 22, 2021 17 Extensible Authentication Protocol (EAP) 18 draft-arkko-emu-rfc3748bis-00 20 Abstract 22 This document defines the Extensible Authentication Protocol (EAP), 23 an authentication framework which supports multiple authentication 24 methods. EAP typically runs directly over data link layers such as 25 Point-to-Point Protocol (PPP), IEEE 802, or 3GPP 5G without requiring 26 IP. EAP provides its own support for duplicate elimination and 27 retransmission, but is reliant on lower layer ordering guarantees. 28 Fragmentation is not supported within EAP itself; however, individual 29 EAP methods may support this. 31 This document obsoletes RFC 3748, which in turn obsoleted RFC 2284. 32 This document updates some of the security considerations, terms, 33 references, the IANA considerations, and few other minor updates. A 34 summary of the changes between this document and RFC 3748 is in 35 Appendix A, and the changes from RFC 2284 were listed in RFC 3748. 37 Status of This Memo 39 This Internet-Draft is submitted in full conformance with the 40 provisions of BCP 78 and BCP 79. 42 Internet-Drafts are working documents of the Internet Engineering 43 Task Force (IETF). Note that other groups may also distribute 44 working documents as Internet-Drafts. The list of current Internet- 45 Drafts is at http://datatracker.ietf.org/drafts/current/. 47 Internet-Drafts are draft documents valid for a maximum of six months 48 and may be updated, replaced, or obsoleted by other documents at any 49 time. It is inappropriate to use Internet-Drafts as reference 50 material or to cite them other than as "work in progress." 52 This Internet-Draft will expire on August 26, 2021. 54 Copyright Notice 56 Copyright (c) 2021 IETF Trust and the persons identified as the 57 document authors. All rights reserved. 59 This document is subject to BCP 78 and the IETF Trust's Legal 60 Provisions Relating to IETF Documents 61 (http://trustee.ietf.org/license-info) in effect on the date of 62 publication of this document. Please review these documents 63 carefully, as they describe your rights and restrictions with respect 64 to this document. Code Components extracted from this document must 65 include Simplified BSD License text as described in Section 4.e of 66 the Trust Legal Provisions and are provided without warranty as 67 described in the Simplified BSD License. 69 Table of Contents 71 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 72 1.1. Specification of Requirements . . . . . . . . . . . . . . 5 73 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 5 74 1.3. Applicability . . . . . . . . . . . . . . . . . . . . . . 7 75 2. Extensible Authentication Protocol (EAP) . . . . . . . . . . 8 76 2.1. Support for Sequences . . . . . . . . . . . . . . . . . . 10 77 2.2. EAP Multiplexing Model . . . . . . . . . . . . . . . . . 11 78 2.3. Pass-Through Behavior . . . . . . . . . . . . . . . . . . 13 79 2.4. Peer-to-Peer Operation . . . . . . . . . . . . . . . . . 15 80 3. Lower Layer Behavior . . . . . . . . . . . . . . . . . . . . 16 81 3.1. Lower Layer Requirements . . . . . . . . . . . . . . . . 16 82 3.2. EAP Usage Within PPP . . . . . . . . . . . . . . . . . . 19 83 3.2.1. PPP Configuration Option Format . . . . . . . . . . . 19 84 3.3. EAP Usage Within IEEE 802 . . . . . . . . . . . . . . . . 20 85 3.4. Lower Layer Indications . . . . . . . . . . . . . . . . . 20 86 4. EAP Packet Format . . . . . . . . . . . . . . . . . . . . . . 21 87 4.1. Request and Response . . . . . . . . . . . . . . . . . . 22 88 4.2. Success and Failure . . . . . . . . . . . . . . . . . . . 24 89 4.3. Retransmission Behavior . . . . . . . . . . . . . . . . . 27 90 5. Initial EAP Request/Response Types . . . . . . . . . . . . . 28 91 5.1. Identity . . . . . . . . . . . . . . . . . . . . . . . . 29 92 5.2. Notification . . . . . . . . . . . . . . . . . . . . . . 30 93 5.3. Nak . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 94 5.3.1. Legacy Nak . . . . . . . . . . . . . . . . . . . . . 32 95 5.3.2. Expanded Nak . . . . . . . . . . . . . . . . . . . . 33 96 5.4. MD5-Challenge . . . . . . . . . . . . . . . . . . . . . . 36 97 5.5. One-Time Password (OTP) . . . . . . . . . . . . . . . . . 38 98 5.6. Generic Token Card (GTC) . . . . . . . . . . . . . . . . 39 99 5.7. Expanded Types . . . . . . . . . . . . . . . . . . . . . 40 100 5.8. Experimental . . . . . . . . . . . . . . . . . . . . . . 42 101 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 42 102 6.1. Packet Codes . . . . . . . . . . . . . . . . . . . . . . 43 103 6.2. Method Types . . . . . . . . . . . . . . . . . . . . . . 43 104 7. Security Considerations . . . . . . . . . . . . . . . . . . . 43 105 7.1. Threat Model . . . . . . . . . . . . . . . . . . . . . . 44 106 7.2. Security Claims . . . . . . . . . . . . . . . . . . . . . 45 107 7.2.1. Security Claims Terminology for EAP Methods . . . . . 46 108 7.3. Identity Protection . . . . . . . . . . . . . . . . . . . 48 109 7.4. Man-in-the-Middle Attacks . . . . . . . . . . . . . . . . 49 110 7.5. Packet Modification Attacks . . . . . . . . . . . . . . . 50 111 7.6. Dictionary Attacks . . . . . . . . . . . . . . . . . . . 51 112 7.7. Connection to an Untrusted Network . . . . . . . . . . . 51 113 7.8. Negotiation Attacks . . . . . . . . . . . . . . . . . . . 52 114 7.9. Implementation Idiosyncrasies . . . . . . . . . . . . . . 52 115 7.10. Key Derivation . . . . . . . . . . . . . . . . . . . . . 53 116 7.11. Weak Ciphersuites . . . . . . . . . . . . . . . . . . . . 55 117 7.11.1. Legacy Authentication Methods . . . . . . . . . . . 55 118 7.12. Link Layer . . . . . . . . . . . . . . . . . . . . . . . 56 119 7.13. Separation of Authenticator and Backend Authentication 120 Server . . . . . . . . . . . . . . . . . . . . . . . . . 56 121 7.14. Cleartext Passwords . . . . . . . . . . . . . . . . . . . 57 122 7.15. Channel Binding . . . . . . . . . . . . . . . . . . . . . 58 123 7.16. Protected Result Indications . . . . . . . . . . . . . . 58 124 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 61 125 8.1. Normative References . . . . . . . . . . . . . . . . . . 61 126 8.2. Informative References . . . . . . . . . . . . . . . . . 62 127 Appendix A. Changes from RFC 3748 . . . . . . . . . . . . . . . 68 128 Appendix B. Rationale . . . . . . . . . . . . . . . . . . . . . 69 129 Appendix C. Acknowledgements . . . . . . . . . . . . . . . . . . 70 130 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 71 132 1. Introduction 134 This document defines the Extensible Authentication Protocol (EAP), 135 an authentication framework which supports multiple authentication 136 methods. EAP typically runs directly over data link layers such as 137 Point-to-Point Protocol (PPP),IEEE 802, or 3GPP 5G without requiring 138 IP. EAP provides its own support for duplicate elimination and 139 retransmission, but is reliant on lower layer ordering guarantees. 140 Fragmentation is not supported within EAP itself; however, individual 141 EAP methods may support this. 143 EAP may be used on dedicated links, as well as switched circuits, and 144 wired as well as wireless links. To date, EAP has been implemented 145 with hosts and routers that connect via switched circuits or dial-up 146 lines using PPP [RFC1661]. It has also been implemented with 147 switches and access points using IEEE 802 [IEEE-802]. EAP 148 encapsulation on IEEE 802 wired media is described in [IEEE-802.1X], 149 and encapsulation on IEEE wireless LANs in [IEEE-802.11i]. EAP can 150 be used for authentication in all types of accesses in 3GPP 5G 151 [TS.33.501]. 153 One of the advantages of the EAP architecture is its flexibility. 154 EAP is used to select a specific authentication mechanism, typically 155 after the authenticator requests more information in order to 156 determine the specific authentication method to be used. Rather than 157 requiring the authenticator to be updated to support each new 158 authentication method, EAP permits the use of a backend 159 authentication server, which may implement some or all authentication 160 methods, with the authenticator acting as a pass-through for some or 161 all methods and peers. 163 Within this document, authenticator requirements apply regardless of 164 whether the authenticator is operating as a pass-through or not. 165 Where the requirement is meant to apply to either the authenticator 166 or backend authentication server, depending on where the EAP 167 authentication is terminated, the term "EAP server" will be used. 169 Other aspects of the EAP framework are discussed in companion 170 documents, [RFC4137] discusses a possible state machine, [RFC5113] 171 defines the network discovery and selection problem, [RFC5247] 172 specifies the EAP key hierarchy, [RFC6677] and [RFC7029] explores 173 man-in-the-middle attacks as well as defining how to implement 174 channel bindings. 176 While the authors believe that the update from RFC 3748 is useful, it 177 is by no means something that absolute has to be done, but has been 178 provided for the community's consideration as part of an overall 179 interest in maintaining the technology and its documentation. If we 180 care about a technology we should keep it up to date. The authors 181 believe that it is preferable to have ongoing maintenance that 182 addresses issues when they are identified, rather than waiting for a 183 larger but more infrequent update. The specific changes are 184 discussed in Appendix A, and the rationale for the terminology- 185 related parts of the change is discussed in more detail in 186 Appendix B. 188 This update proposal is brought forward for discussion. Discussion 189 may find that the update is considered useful or unnecessary, or 190 perhaps even a distracton or flawed in some of its definitions. All 191 feedback is welcome! 193 1.1. Specification of Requirements 195 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 196 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 197 "OPTIONAL" in this document are to be interpreted as described in BCP 198 14 [RFC2119] [RFC8174] when, and only when, they appear in all 199 capitals, as shown here. 201 1.2. Terminology 203 This document frequently uses the following terms: 205 authenticator 207 The end of the link initiating EAP authentication. The term 208 authenticator is used in [IEEE-802.1X], and has the same meaning 209 in this document. 211 peer 213 The end of the link that responds to the authenticator. In 214 [IEEE-802.1X], this end is known as the Supplicant. 216 Supplicant 218 The end of the link that responds to the authenticator in 219 [IEEE-802.1X]. In this document, this end of the link is called 220 the peer. 222 backend authentication server 224 A backend authentication server is an entity that provides an 225 authentication service to an authenticator. When used, this 226 server typically executes EAP methods for the authenticator. This 227 terminology is also used in [IEEE-802.1X]. 229 AAA 231 Authentication, Authorization, and Accounting. AAA protocols with 232 EAP support include RADIUS [RFC3579] and Diameter [RFC4072]. In 233 this document, the terms "AAA server" and "backend authentication 234 server" are used interchangeably. 236 Displayable Message 238 This is interpreted to be a human readable string of characters. 239 The message encoding MUST follow the UTF-8 transformation format 240 [RFC3629]. 242 EAP server 244 The entity that terminates the EAP authentication method with the 245 peer. In the case where no backend authentication server is used, 246 the EAP server is part of the authenticator. In the case where 247 the authenticator operates in pass-through mode, the EAP server is 248 located on the backend authentication server. 250 Silently Discard 252 This means the implementation discards the packet without further 253 processing. The implementation SHOULD provide the capability of 254 logging the event, including the contents of the silently 255 discarded packet, and SHOULD record the event in a statistics 256 counter. 258 Successful Authentication 260 In the context of this document, "successful authentication" is an 261 exchange of EAP messages, as a result of which the authenticator 262 decides to allow access by the peer, and the peer decides to use 263 this access. The authenticator's decision typically involves both 264 authentication and authorization aspects; the peer may 265 successfully authenticate to the authenticator, but access may be 266 denied by the authenticator due to policy reasons. 268 Message Integrity Check (MIC) 270 A keyed hash function used for authentication and integrity 271 protection of data. This is usually called a Message 272 Authentication Code (MAC), but IEEE 802 specifications (and this 273 document) use the acronym MIC to avoid confusion with Medium 274 Access Control. 276 Cryptographic Separation 278 Two keys (x and y) are "cryptographically separate" if an 279 adversary that knows all messages exchanged in the protocol cannot 280 compute x from y or y from x without "breaking" some cryptographic 281 assumption. In particular, this definition allows that the 282 adversary has the knowledge of all nonces sent in cleartext, as 283 well as all predictable counter values used in the protocol. 284 Breaking a cryptographic assumption would typically require 285 inverting a one-way function or predicting the outcome of a 286 cryptographic pseudo-random number generator without knowledge of 287 the secret state. In other words, if the keys are 288 cryptographically separate, there is no shortcut to compute x from 289 y or y from x, but the work an adversary must do to perform this 290 computation is equivalent to performing an exhaustive search for 291 the secret state value. 293 Main Session Key (MSK) 295 Keying material that is derived between the EAP peer and server 296 and exported by the EAP method. The MSK is at least 64 octets in 297 length. In existing implementations, a AAA server acting as an 298 EAP server transports the MSK to the authenticator. 300 Extended Main Session Key (EMSK) 302 Additional keying material derived between the EAP client and 303 server that is exported by the EAP method. The EMSK is at least 304 64 octets in length. The EMSK is not shared with the 305 authenticator or any other third party. The EMSK is reserved for 306 future uses that are not defined yet. 308 Result indications 310 A method provides result indications if after the method's last 311 message is sent and received: 313 1. The peer is aware of whether it has authenticated the server, 314 as well as whether the server has authenticated it. 316 2. The server is aware of whether it has authenticated the peer, 317 as well as whether the peer has authenticated it. 319 In the case where successful authentication is sufficient to 320 authorize access, then the peer and authenticator will also know if 321 the other party is willing to provide or accept access. This may not 322 always be the case. An authenticated peer may be denied access due 323 to lack of authorization (e.g., session limit) or other reasons. 324 Since the EAP exchange is run between the peer and the server, other 325 nodes (such as AAA proxies) may also affect the authorization 326 decision. This is discussed in more detail in Section 7.16. 328 1.3. Applicability 330 EAP was designed for use in network access authentication, where IP 331 layer connectivity may not be available. Use of EAP for other 332 purposes, such as bulk data transport, is NOT RECOMMENDED. 334 Since EAP does not require IP connectivity, it provides just enough 335 support for the reliable transport of authentication protocols, and 336 no more. 338 EAP is a lock-step protocol which only supports a single packet in 339 flight. As a result, EAP cannot efficiently transport bulk data, 340 unlike transport protocols such as TCP [RFC0793] or SCTP [RFC4960]. 342 While EAP provides support for retransmission, it assumes ordering 343 guarantees provided by the lower layer, so out of order reception is 344 not supported. 346 Since EAP does not support fragmentation and reassembly, EAP 347 authentication methods generating payloads larger than the minimum 348 EAP MTU need to provide fragmentation support. 350 While authentication methods such as EAP-TLS 351 [RFC5216][I-D.ietf-emu-eap-tls13] provide support for fragmentation 352 and reassembly, the EAP methods defined in this document do not. As 353 a result, if the EAP packet size exceeds the EAP MTU of the link, 354 these methods will encounter difficulties. 356 EAP authentication is initiated by the server (authenticator), 357 whereas many authentication protocols are initiated by the client 358 (peer). As a result, it may be necessary for an authentication 359 algorithm to add one or two additional messages (at most one 360 roundtrip) in order to run over EAP. 362 Where certificate-based authentication is supported, the number of 363 additional roundtrips may be much larger due to fragmentation of 364 certificate chains. In general, a fragmented EAP packet will require 365 as many round-trips to send as there are fragments. For example, a 366 certificate chain 14960 octets in size would require ten round-trips 367 to send with a 1496 octet EAP MTU. 369 Where EAP runs over a lower layer in which significant packet loss is 370 experienced, or where the connection between the authenticator and 371 authentication server experiences significant packet loss, EAP 372 methods requiring many round-trips can experience difficulties. In 373 these situations, use of EAP methods with fewer roundtrips is 374 advisable. 376 2. Extensible Authentication Protocol (EAP) 378 The EAP authentication exchange proceeds as follows: 380 1. The authenticator sends a Request to authenticate the peer. The 381 Request has a Type field to indicate what is being requested. 382 Examples of Request Types include Identity, MD5-challenge, etc. 383 The MD5-challenge Type corresponds closely to the CHAP 384 authentication protocol [RFC1994]. Typically, the authenticator 385 will send an initial Identity Request; however, an initial 386 Identity Request is not required, and MAY be bypassed. For 387 example, the identity may not be required where it is determined 388 by the port to which the peer has connected (leased lines, 389 dedicated switch or dial-up ports), or where the identity is 390 obtained in another fashion (via calling station identity or MAC 391 address, in the Name field of the MD5-Challenge Response, etc.). 393 2. The peer sends a Response packet in reply to a valid Request. As 394 with the Request packet, the Response packet contains a Type 395 field, which corresponds to the Type field of the Request. 397 3. The authenticator sends an additional Request packet, and the 398 peer replies with a Response. The sequence of Requests and 399 Responses continues as long as needed. EAP is a 'lock step' 400 protocol, so that other than the initial Request, a new Request 401 cannot be sent prior to receiving a valid Response. The 402 authenticator is responsible for retransmitting requests as 403 described in Section 4.1. After a suitable number of 404 retransmissions, the authenticator SHOULD end the EAP 405 conversation. The authenticator MUST NOT send a Success or 406 Failure packet when retransmitting or when it fails to get a 407 response from the peer. 409 4. The conversation continues until the authenticator cannot 410 authenticate the peer (unacceptable Responses to one or more 411 Requests), in which case the authenticator implementation MUST 412 transmit an EAP Failure (Code 4). Alternatively, the 413 authentication conversation can continue until the authenticator 414 determines that successful authentication has occurred, in which 415 case the authenticator MUST transmit an EAP Success (Code 3). 417 Advantages: 419 o The EAP protocol can support multiple authentication mechanisms 420 without having to pre-negotiate a particular one. 422 o Network Access Server (NAS) devices (e.g., a switch or access 423 point) do not have to understand each authentication method and 424 MAY act as a pass-through agent for a backend authentication 425 server. Support for pass-through is optional. An authenticator 426 MAY authenticate local peers, while at the same time acting as a 427 pass-through for non-local peers and authentication methods it 428 does not implement locally. 430 o Separation of the authenticator from the backend authentication 431 server simplifies credentials management and policy decision 432 making. 434 Disadvantages: 436 o For use in PPP, EAP requires the addition of a new authentication 437 Type to PPP LCP and thus PPP implementations will need to be 438 modified to use it. It also strays from the previous PPP 439 authentication model of negotiating a specific authentication 440 mechanism during LCP. Similarly, switch or access point 441 implementations need to support [IEEE-802.1X] in order to use EAP. 443 o Where the authenticator is separate from the backend 444 authentication server, this complicates the security analysis and, 445 if needed, key distribution. 447 2.1. Support for Sequences 449 An EAP conversation MAY utilize a sequence of methods. A common 450 example of this is an Identity request followed by a single EAP 451 authentication method such as an MD5-Challenge. However, the peer 452 and authenticator MUST utilize only one authentication method (Type 4 453 or greater) within an EAP conversation, after which the authenticator 454 MUST send a Success or Failure packet. 456 Once a peer has sent a Response of the same Type as the initial 457 Request, an authenticator MUST NOT send a Request of a different Type 458 prior to completion of the final round of a given method (with the 459 exception of a Notification-Request) and MUST NOT send a Request for 460 an additional method of any Type after completion of the initial 461 authentication method; a peer receiving such Requests MUST treat them 462 as invalid, and silently discard them. As a result, Identity Requery 463 is not supported. 465 A peer MUST NOT send a Nak (legacy or expanded) in reply to a Request 466 after an initial non-Nak Response has been sent. Since spoofed EAP 467 Request packets may be sent by an attacker, an authenticator 468 receiving an unexpected Nak SHOULD discard it and log the event. 470 Multiple authentication methods within an EAP conversation are not 471 supported due to their vulnerability to man-in-the-middle attacks 472 (see Section 7.4) and incompatibility with existing implementations. 474 Where a single EAP authentication method is utilized, but other 475 methods are run within it (a "tunneled" method), the prohibition 476 against multiple authentication methods does not apply. Such 477 "tunneled" methods appear as a single authentication method to EAP. 478 Backward compatibility can be provided, since a peer not supporting a 479 "tunneled" method can reply to the initial EAP-Request with a Nak 480 (legacy or expanded). To address security vulnerabilities, 481 "tunneled" methods MUST support protection against man-in-the-middle 482 attacks. 484 2.2. EAP Multiplexing Model 486 Conceptually, EAP implementations consist of the following 487 components: 489 1. Lower layer. The lower layer is responsible for transmitting and 490 receiving EAP frames between the peer and authenticator. EAP has 491 been run over a variety of lower layers including PPP, wired IEEE 492 802 LANs [IEEE-802.1X], IEEE 802.11 wireless LANs [IEEE-802.11], 493 UDP (L2TP [RFC2661] and IKEv2 [RFC7296]), TCP 494 [I-D.ietf-ipsra-pic], and 3GPP 5G [TS.33.501]. Lower layer 495 behavior is discussed in Section 3. 497 2. EAP layer. The EAP layer receives and transmits EAP packets via 498 the lower layer, implements duplicate detection and 499 retransmission, and delivers and receives EAP messages to and 500 from the EAP peer and authenticator layers. 502 3. EAP peer and authenticator layers. Based on the Code field, the 503 EAP layer demultiplexes incoming EAP packets to the EAP peer and 504 authenticator layers. Typically, an EAP implementation on a 505 given host will support either peer or authenticator 506 functionality, but it is possible for a host to act as both an 507 EAP peer and authenticator. In such an implementation both EAP 508 peer and authenticator layers will be present. 510 4. EAP method layers. EAP methods implement the authentication 511 algorithms and receive and transmit EAP messages via the EAP peer 512 and authenticator layers. Since fragmentation support is not 513 provided by EAP itself, this is the responsibility of EAP 514 methods, which are discussed in Section 5. 516 The EAP multiplexing model is illustrated in Figure 1 below. Note 517 that there is no requirement that an implementation conform to this 518 model, as long as the on-the-wire behavior is consistent with it. 520 +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ 521 | | | | | | 522 | EAP method| EAP method| | EAP method| EAP method| 523 | Type = X | Type = Y | | Type = X | Type = Y | 524 | V | | | ^ | | 525 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 526 | ! | | ! | 527 | EAP ! Peer layer | | EAP ! Auth. layer | 528 | ! | | ! | 529 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 530 | ! | | ! | 531 | EAP ! layer | | EAP ! layer | 532 | ! | | ! | 533 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 534 | ! | | ! | 535 | Lower ! layer | | Lower ! layer | 536 | ! | | ! | 537 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 538 ! ! 539 ! Peer ! Authenticator 540 +------------>-------------+ 542 Figure 1: EAP Multiplexing Model 544 Within EAP, the Code field functions much like a protocol number in 545 IP. It is assumed that the EAP layer demultiplexes incoming EAP 546 packets according to the Code field. Received EAP packets with 547 Code=1 (Request), 3 (Success), and 4 (Failure) are delivered by the 548 EAP layer to the EAP peer layer, if implemented. EAP packets with 549 Code=2 (Response) are delivered to the EAP authenticator layer, if 550 implemented. 552 Within EAP, the Type field functions much like a port number in UDP 553 or TCP. It is assumed that the EAP peer and authenticator layers 554 demultiplex incoming EAP packets according to their Type, and deliver 555 them only to the EAP method corresponding to that Type. An EAP 556 method implementation on a host may register to receive packets from 557 the peer or authenticator layers, or both, depending on which role(s) 558 it supports. 560 Since EAP authentication methods may wish to access the Identity, 561 implementations SHOULD make the Identity Request and Response 562 accessible to authentication methods (Types 4 or greater), in 563 addition to the Identity method. The Identity Type is discussed in 564 Section 5.1. 566 A Notification Response is only used as confirmation that the peer 567 received the Notification Request, not that it has processed it, or 568 displayed the message to the user. It cannot be assumed that the 569 contents of the Notification Request or Response are available to 570 another method. The Notification Type is discussed in Section 5.2. 572 Nak (Type 3) or Expanded Nak (Type 254) are utilized for the purposes 573 of method negotiation. Peers respond to an initial EAP Request for 574 an unacceptable Type with a Nak Response (Type 3) or Expanded Nak 575 Response (Type 254). It cannot be assumed that the contents of the 576 Nak Response(s) are available to another method. The Nak Type(s) are 577 discussed in Section 5.3. 579 EAP packets with Codes of Success or Failure do not include a Type 580 field, and are not delivered to an EAP method. Success and Failure 581 are discussed in Section 4.2. 583 Given these considerations, the Success, Failure, Nak Response(s), 584 and Notification Request/Response messages MUST NOT be used to carry 585 data destined for delivery to other EAP methods. 587 2.3. Pass-Through Behavior 589 When operating as a "pass-through authenticator", an authenticator 590 performs checks on the Code, Identifier, and Length fields as 591 described in Section 4.1. It forwards EAP packets received from the 592 peer and destined to its authenticator layer to the backend 593 authentication server; packets received from the backend 594 authentication server destined to the peer are forwarded to it. 596 A host receiving an EAP packet may only do one of three things with 597 it: act on it, drop it, or forward it. The forwarding decision is 598 typically based only on examination of the Code, Identifier, and 599 Length fields. A pass-through authenticator implementation MUST be 600 capable of forwarding EAP packets received from the peer with Code=2 601 (Response) to the backend authentication server. It also MUST be 602 capable of receiving EAP packets from the backend authentication 603 server and forwarding EAP packets of Code=1 (Request), Code=3 604 (Success), and Code=4 (Failure) to the peer. 606 Unless the authenticator implements one or more authentication 607 methods locally which support the authenticator role, the EAP method 608 layer header fields (Type, Type-Data) are not examined as part of the 609 forwarding decision. Where the authenticator supports local 610 authentication methods, it MAY examine the Type field to determine 611 whether to act on the packet itself or forward it. Compliant pass- 612 through authenticator implementations MUST by default forward EAP 613 packets of any Type. 615 EAP packets received with Code=1 (Request), Code=3 (Success), and 616 Code=4 (Failure) are demultiplexed by the EAP layer and delivered to 617 the peer layer. Therefore, unless a host implements an EAP peer 618 layer, these packets will be silently discarded. Similarly, EAP 619 packets received with Code=2 (Response) are demultiplexed by the EAP 620 layer and delivered to the authenticator layer. Therefore, unless a 621 host implements an EAP authenticator layer, these packets will be 622 silently discarded. The behavior of a "pass-through peer" is 623 undefined within this specification, and is unsupported by AAA 624 protocols such as RADIUS [RFC3579] and Diameter [RFC4072]. 626 The forwarding model is illustrated in Figure 2. 628 Peer Pass-through Authenticator Authentication 629 Server 631 +-+-+-+-+-+-+ +-+-+-+-+-+-+ 632 | | | | 633 |EAP method | |EAP method | 634 | V | | ^ | 635 +-+-+-!-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-!-+-+-+ 636 | ! | |EAP | EAP | | | ! | 637 | ! | |Peer | Auth.| EAP Auth. | | ! | 638 |EAP ! peer| | | +-----------+ | |EAP !Auth.| 639 | ! | | | ! | ! | | ! | 640 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+ 641 | ! | | ! | ! | | ! | 642 |EAP !layer| | EAP !layer| EAP !layer | |EAP !layer| 643 | ! | | ! | ! | | ! | 644 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+ 645 | ! | | ! | ! | | ! | 646 |Lower!layer| | Lower!layer| AAA ! /IP | | AAA ! /IP | 647 | ! | | ! | ! | | ! | 648 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+ 649 ! ! ! ! 650 ! ! ! ! 651 +-------->--------+ +--------->-------+ 653 Figure 2: Pass-through Authenticator 655 For sessions in which the authenticator acts as a pass-through, it 656 MUST determine the outcome of the authentication solely based on the 657 Accept/Reject indication sent by the backend authentication server; 658 the outcome MUST NOT be determined by the contents of an EAP packet 659 sent along with the Accept/Reject indication, or the absence of such 660 an encapsulated EAP packet. 662 2.4. Peer-to-Peer Operation 664 Since EAP is a peer-to-peer protocol, an independent and simultaneous 665 authentication may take place in the reverse direction (depending on 666 the capabilities of the lower layer). Both ends of the link may act 667 as authenticators and peers at the same time. In this case, it is 668 necessary for both ends to implement EAP authenticator and peer 669 layers. In addition, the EAP method implementations on both peers 670 must support both authenticator and peer functionality. 672 Although EAP supports peer-to-peer operation, some EAP 673 implementations, methods, AAA protocols, and link layers may not 674 support this. Some EAP methods may support asymmetric 675 authentication, with one type of credential being required for the 676 peer and another type for the authenticator. Hosts supporting peer- 677 to-peer operation with such a method would need to be provisioned 678 with both types of credentials. 680 For example, EAP-TLS [RFC5216][I-D.ietf-emu-eap-tls13] is a client- 681 server protocol in which distinct certificate profiles are typically 682 utilized for the client and server. This implies that a host 683 supporting peer-to-peer authentication with EAP-TLS would need to 684 implement both the EAP peer and authenticator layers, support both 685 peer and authenticator roles in the EAP-TLS implementation, and 686 provision certificates appropriate for each role. 688 AAA protocols such as RADIUS/EAP [RFC3579] and Diameter EAP [RFC4072] 689 only support "pass-through authenticator" operation. As noted in 690 [RFC3579] Section 2.6.2, a RADIUS server responds to an Access- 691 Request encapsulating an EAP-Request, Success, or Failure packet with 692 an Access-Reject. There is therefore no support for "pass-through 693 peer" operation. 695 Even where a method is used which supports mutual authentication and 696 result indications, several considerations may dictate that two EAP 697 authentications (one in each direction) are required. These include: 699 1. Support for bi-directional session key derivation in the lower 700 layer. Lower layers such as IEEE 802.11 may only support uni- 701 directional derivation and transport of transient session keys. 702 For example, the group-key handshake defined in [IEEE-802.11i] is 703 uni-directional, since in IEEE 802.11 infrastructure mode, only 704 the Access Point (AP) sends multicast/broadcast traffic. In IEEE 705 802.11 ad hoc mode, where either peer may send multicast/ 706 broadcast traffic, two uni-directional group-key exchanges are 707 required. Due to limitations of the design, this also implies 708 the need for unicast key derivations and EAP method exchanges to 709 occur in each direction. 711 2. Support for tie-breaking in the lower layer. Lower layers such 712 as IEEE 802.11 ad hoc do not support "tie breaking" wherein two 713 hosts initiating authentication with each other will only go 714 forward with a single authentication. This implies that even if 715 802.11 were to support a bi-directional group-key handshake, then 716 two authentications, one in each direction, might still occur. 718 3. Peer policy satisfaction. EAP methods may support result 719 indications, enabling the peer to indicate to the EAP server 720 within the method that it successfully authenticated the EAP 721 server, as well as for the server to indicate that it has 722 authenticated the peer. However, a pass-through authenticator 723 will not be aware that the peer has accepted the credentials 724 offered by the EAP server, unless this information is provided to 725 the authenticator via the AAA protocol. The authenticator SHOULD 726 interpret the receipt of a key attribute within an Accept packet 727 as an indication that the peer has successfully authenticated the 728 server. 730 However, it is possible that the EAP peer's access policy was not 731 satisfied during the initial EAP exchange, even though mutual 732 authentication occurred. For example, the EAP authenticator may not 733 have demonstrated authorization to act in both peer and authenticator 734 roles. As a result, the peer may require an additional 735 authentication in the reverse direction, even if the peer provided an 736 indication that the EAP server had successfully authenticated to it. 738 3. Lower Layer Behavior 740 3.1. Lower Layer Requirements 742 EAP makes the following assumptions about lower layers: 744 1. Unreliable transport. In EAP, the authenticator retransmits 745 Requests that have not yet received Responses so that EAP does 746 not assume that lower layers are reliable. Since EAP defines its 747 own retransmission behavior, it is possible (though undesirable) 748 for retransmission to occur both in the lower layer and the EAP 749 layer when EAP is run over a reliable lower layer. 751 Note that EAP Success and Failure packets are not retransmitted. 752 Without a reliable lower layer, and with a non-negligible error 753 rate, these packets can be lost, resulting in timeouts. It is 754 therefore desirable for implementations to improve their 755 resilience to loss of EAP Success or Failure packets, as 756 described in Section 4.2. 758 2. Lower layer error detection. While EAP does not assume that the 759 lower layer is reliable, it does rely on lower layer error 760 detection (e.g., CRC, Checksum, MIC, etc.). EAP methods may not 761 include a MIC, or if they do, it may not be computed over all the 762 fields in the EAP packet, such as the Code, Identifier, Length, 763 or Type fields. As a result, without lower layer error 764 detection, undetected errors could creep into the EAP layer or 765 EAP method layer header fields, resulting in authentication 766 failures. 768 For example, EAP TLS [RFC5216][I-D.ietf-emu-eap-tls13], which 769 computes its MIC over the Type-Data field only, regards MIC 770 validation failures as a fatal error. Without lower layer error 771 detection, this method, and others like it, will not perform 772 reliably. 774 3. Lower layer security. EAP does not require lower layers to 775 provide security services such as per-packet confidentiality, 776 authentication, integrity, and replay protection. However, where 777 these security services are available, EAP methods supporting Key 778 Derivation (see Section 7.2.1) can be used to provide dynamic 779 keying material. This makes it possible to bind the EAP 780 authentication to subsequent data and protect against data 781 modification, spoofing, or replay. See Section 7.1 for details. 783 4. Minimum MTU. EAP is capable of functioning on lower layers that 784 provide an EAP MTU size of 1020 octets or greater. 786 EAP does not support path MTU discovery, and fragmentation and 787 reassembly is not supported by EAP, nor by the methods defined in 788 this specification: Identity (1), Notification (2), Nak Response 789 (3), MD5-Challenge (4), One Time Password (5), Generic Token Card 790 (6), and expanded Nak Response (254) Types. 792 Typically, the EAP peer obtains information on the EAP MTU from 793 the lower layers and sets the EAP frame size to an appropriate 794 value. Where the authenticator operates in pass-through mode, 795 the authentication server does not have a direct way of 796 determining the EAP MTU, and therefore relies on the 797 authenticator to provide it with this information, such as via 798 the Framed-MTU attribute, as described in [RFC3579], Section 2.4. 800 While methods such as EAP-TLS [RFC5216][I-D.ietf-emu-eap-tls13] 801 support fragmentation and reassembly, EAP methods originally 802 designed for use within PPP where a 1500 octet MTU is guaranteed 803 for control frames (see [RFC1661], Section 6.1) may lack 804 fragmentation and reassembly features. 806 EAP methods can assume a minimum EAP MTU of 1020 octets in the 807 absence of other information. EAP methods SHOULD include support 808 for fragmentation and reassembly if their payloads can be larger 809 than this minimum EAP MTU. 811 EAP is a lock-step protocol, which implies a certain inefficiency 812 when handling fragmentation and reassembly. Therefore, if the 813 lower layer supports fragmentation and reassembly (such as where 814 EAP is transported over IP), it may be preferable for 815 fragmentation and reassembly to occur in the lower layer rather 816 than in EAP. This can be accomplished by providing an 817 artificially large EAP MTU to EAP, causing fragmentation and 818 reassembly to be handled within the lower layer. 820 5. Possible duplication. Where the lower layer is reliable, it will 821 provide the EAP layer with a non-duplicated stream of packets. 822 However, while it is desirable that lower layers provide for non- 823 duplication, this is not a requirement. The Identifier field 824 provides both the peer and authenticator with the ability to 825 detect duplicates. 827 6. Ordering guarantees. EAP does not require the Identifier to be 828 monotonically increasing, and so is reliant on lower layer 829 ordering guarantees for correct operation. EAP was originally 830 defined to run on PPP, and [RFC1661] Section 1 has an ordering 831 requirement: 833 "The Point-to-Point Protocol is designed for simple links which 834 transport packets between two peers. These links provide full- 835 duplex simultaneous bi-directional operation, and are assumed to 836 deliver packets in order." 838 Lower layer transports for EAP MUST preserve ordering between a 839 source and destination at a given priority level (the ordering 840 guarantee provided by [IEEE-802]). 842 Reordering, if it occurs, will typically result in an EAP 843 authentication failure, causing EAP authentication to be re-run. 844 In an environment in which reordering is likely, it is therefore 845 expected that EAP authentication failures will be common. It is 846 RECOMMENDED that EAP only be run over lower layers that provide 847 ordering guarantees; running EAP over raw IP or UDP transport is 849 NOT RECOMMENDED. Encapsulation of EAP within RADIUS [RFC3579] 850 satisfies ordering requirements, since RADIUS is a "lockstep" 851 protocol that delivers packets in order. 853 3.2. EAP Usage Within PPP 855 In order to establish communications over a point-to-point link, each 856 end of the PPP link first sends LCP packets to configure the data 857 link during the Link Establishment phase. After the link has been 858 established, PPP provides for an optional Authentication phase before 859 proceeding to the Network-Layer Protocol phase. 861 By default, authentication is not mandatory. If authentication of 862 the link is desired, an implementation MUST specify the 863 Authentication Protocol Configuration Option during the Link 864 Establishment phase. 866 If the identity of the peer has been established in the 867 Authentication phase, the server can use that identity in the 868 selection of options for the following network layer negotiations. 870 When implemented within PPP, EAP does not select a specific 871 authentication mechanism at the PPP Link Control Phase, but rather 872 postpones this until the Authentication Phase. This allows the 873 authenticator to request more information before determining the 874 specific authentication mechanism. This also permits the use of a 875 "backend" server which actually implements the various mechanisms 876 while the PPP authenticator merely passes through the authentication 877 exchange. The PPP Link Establishment and Authentication phases, and 878 the Authentication Protocol Configuration Option, are defined in The 879 Point-to-Point Protocol (PPP) [RFC1661]. 881 3.2.1. PPP Configuration Option Format 883 A summary of the PPP Authentication Protocol Configuration Option 884 format to negotiate EAP follows. The fields are transmitted from 885 left to right. 887 Exactly one EAP packet is encapsulated in the Information field of a 888 PPP Data Link Layer frame where the protocol field indicates type hex 889 C227 (PPP EAP). 891 0 1 2 3 892 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 893 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 894 | Type | Length | Authentication Protocol | 895 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 897 Type 899 3 901 Length 903 4 905 Authentication Protocol 907 C227 (Hex) for Extensible Authentication Protocol (EAP) 909 3.3. EAP Usage Within IEEE 802 911 The encapsulation of EAP over IEEE 802 is defined in [IEEE-802.1X]. 912 The IEEE 802 encapsulation of EAP does not involve PPP, and IEEE 913 802.1X does not include support for link or network layer 914 negotiations. As a result, within IEEE 802.1X, it is not possible to 915 negotiate non-EAP authentication mechanisms, such as PAP or CHAP 916 [RFC1994]. 918 3.4. Lower Layer Indications 920 The reliability and security of lower layer indications is dependent 921 on the lower layer. Since EAP is media independent, the presence or 922 absence of lower layer security is not taken into account in the 923 processing of EAP messages. 925 To improve reliability, if a peer receives a lower layer success 926 indication as defined in Section 7.12, it MAY conclude that a Success 927 packet has been lost, and behave as if it had actually received a 928 Success packet. This includes choosing to ignore the Success in some 929 circumstances as described in Section 4.2. See also protected result 930 indications in Section 7.16. 932 A discussion of some reliability and security issues with lower layer 933 indications in PPP, IEEE 802 wired networks, and IEEE 802.11 wireless 934 LANs can be found in the Security Considerations, Section 7.12. 936 After EAP authentication is complete, the peer will typically 937 transmit and receive data via the authenticator. It is desirable to 938 provide assurance that the entities transmitting data are the same 939 ones that successfully completed EAP authentication. To accomplish 940 this, it is necessary for the lower layer to provide per-packet 941 integrity, authentication and replay protection, and to bind these 942 per-packet services to the keys derived during EAP authentication. 943 Otherwise, it is possible for subsequent data traffic to be modified, 944 spoofed, or replayed. 946 Where keying material for the lower layer ciphersuite is itself 947 provided by EAP, ciphersuite negotiation and key activation are 948 controlled by the lower layer. In PPP, ciphersuites are negotiated 949 within ECP so that it is not possible to use keys derived from EAP 950 authentication until the completion of ECP. Therefore, an initial 951 EAP exchange cannot be protected by a PPP ciphersuite, although EAP 952 re-authentication can be protected. 954 In IEEE 802 media, initial key activation also typically occurs after 955 completion of EAP authentication. Therefore an initial EAP exchange 956 typically cannot be protected by the lower layer ciphersuite, 957 although an EAP re-authentication or pre-authentication exchange can 958 be protected. 960 4. EAP Packet Format 962 A summary of the EAP packet format is shown below. The fields are 963 transmitted from left to right. 965 0 1 2 3 966 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 967 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 968 | Code | Identifier | Length | 969 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 970 | Data ... 971 +-+-+-+-+ 973 Code 975 The Code field is one octet and identifies the Type of EAP packet. 976 EAP Codes are assigned as follows: 978 1 Request 979 2 Response 980 3 Success 981 4 Failure 983 Since EAP only defines Codes 1-4, EAP packets with other codes 984 MUST be silently discarded by both authenticators and peers. 986 Identifier 988 The Identifier field is one octet and aids in matching Responses 989 with Requests. 991 Length 992 The Length field is two octets and indicates the length, in 993 octets, of the EAP packet including the Code, Identifier, Length, 994 and Data fields. Octets outside the range of the Length field 995 should be treated as Data Link Layer padding and MUST be ignored 996 upon reception. A message with the Length field set to a value 997 larger than the number of received octets MUST be silently 998 discarded. 1000 Data 1002 The Data field is zero or more octets. The format of the Data 1003 field is determined by the Code field. 1005 4.1. Request and Response 1007 Description 1009 The Request packet (Code field set to 1) is sent by the 1010 authenticator to the peer. Each Request has a Type field which 1011 serves to indicate what is being requested. Additional Request 1012 packets MUST be sent until a valid Response packet is received, an 1013 optional retry counter expires, or a lower layer failure 1014 indication is received. 1016 Retransmitted Requests MUST be sent with the same Identifier value 1017 in order to distinguish them from new Requests. The content of 1018 the data field is dependent on the Request Type. The peer MUST 1019 send a Response packet in reply to a valid Request packet. 1020 Responses MUST only be sent in reply to a valid Request and never 1021 be retransmitted on a timer. 1023 If a peer receives a valid duplicate Request for which it has 1024 already sent a Response, it MUST resend its original Response 1025 without reprocessing the Request. Requests MUST be processed in 1026 the order that they are received, and MUST be processed to their 1027 completion before inspecting the next Request. 1029 A summary of the Request and Response packet format follows. The 1030 fields are transmitted from left to right. 1032 0 1 2 3 1033 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1034 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1035 | Code | Identifier | Length | 1036 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1037 | Type | Type-Data ... 1038 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 1040 Code 1042 1 for Request 1043 2 for Response 1045 Identifier 1047 The Identifier field is one octet. The Identifier field MUST be 1048 the same if a Request packet is retransmitted due to a timeout 1049 while waiting for a Response. Any new (non-retransmission) 1050 Requests MUST modify the Identifier field. 1052 The Identifier field of the Response MUST match that of the 1053 currently outstanding Request. An authenticator receiving a 1054 Response whose Identifier value does not match that of the 1055 currently outstanding Request MUST silently discard the Response. 1057 In order to avoid confusion between new Requests and 1058 retransmissions, the Identifier value chosen for each new Request 1059 need only be different from the previous Request, but need not be 1060 unique within the conversation. One way to achieve this is to 1061 start the Identifier at an initial value and increment it for each 1062 new Request. Initializing the first Identifier with a random 1063 number rather than starting from zero is recommended, since it 1064 makes sequence attacks somewhat more difficult. 1066 Since the Identifier space is unique to each session, 1067 authenticators are not restricted to only 256 simultaneous 1068 authentication conversations. Similarly, with re-authentication, 1069 an EAP conversation might continue over a long period of time, and 1070 is not limited to only 256 roundtrips. 1072 Implementation Note: The authenticator is responsible for 1073 retransmitting Request messages. If the Request message is 1074 obtained from elsewhere (such as from a backend authentication 1075 server), then the authenticator will need to save a copy of the 1076 Request in order to accomplish this. The peer is responsible for 1077 detecting and handling duplicate Request messages before 1078 processing them in any way, including passing them on to an 1079 outside party. The authenticator is also responsible for 1080 discarding Response messages with a non-matching Identifier value 1081 before acting on them in any way, including passing them on to the 1082 backend authentication server for verification. Since the 1083 authenticator can retransmit before receiving a Response from the 1084 peer, the authenticator can receive multiple Responses, each with 1085 a matching Identifier. Until a new Request is received by the 1086 authenticator, the Identifier value is not updated, so that the 1087 authenticator forwards Responses to the backend authentication 1088 server, one at a time. 1090 Length 1092 The Length field is two octets and indicates the length of the EAP 1093 packet including the Code, Identifier, Length, Type, and Type-Data 1094 fields. Octets outside the range of the Length field should be 1095 treated as Data Link Layer padding and MUST be ignored upon 1096 reception. A message with the Length field set to a value larger 1097 than the number of received octets MUST be silently discarded. 1099 Type 1101 The Type field is one octet. This field indicates the Type of 1102 Request or Response. A single Type MUST be specified for each EAP 1103 Request or Response. An initial specification of Types follows in 1104 Section 5 of this document. 1106 The Type field of a Response MUST either match that of the 1107 Request, or correspond to a legacy or Expanded Nak (see 1108 Section 5.3) indicating that a Request Type is unacceptable to the 1109 peer. A peer MUST NOT send a Nak (legacy or expanded) in response 1110 to a Request, after an initial non-Nak Response has been sent. An 1111 EAP server receiving a Response not meeting these requirements 1112 MUST silently discard it. 1114 Type-Data 1116 The Type-Data field varies with the Type of Request and the 1117 associated Response. 1119 4.2. Success and Failure 1121 The Success packet is sent by the authenticator to the peer after 1122 completion of an EAP authentication method (Type 4 or greater) to 1123 indicate that the peer has authenticated successfully to the 1124 authenticator. The authenticator MUST transmit an EAP packet with 1125 the Code field set to 3 (Success). If the authenticator cannot 1126 authenticate the peer (unacceptable Responses to one or more 1127 Requests), then after unsuccessful completion of the EAP method in 1128 progress, the implementation MUST transmit an EAP packet with the 1129 Code field set to 4 (Failure). An authenticator MAY wish to issue 1130 multiple Requests before sending a Failure response in order to allow 1131 for human typing mistakes. Success and Failure packets MUST NOT 1132 contain additional data. 1134 Success and Failure packets MUST NOT be sent by an EAP authenticator 1135 if the specification of the given method does not explicitly permit 1136 the method to finish at that point. A peer EAP implementation 1137 receiving a Success or Failure packet where sending one is not 1138 explicitly permitted MUST silently discard it. By default, an EAP 1139 peer MUST silently discard a "canned" Success packet (a Success 1140 packet sent immediately upon connection). This ensures that a rogue 1141 authenticator will not be able to bypass mutual authentication by 1142 sending a Success packet prior to conclusion of the EAP method 1143 conversation. 1145 Implementation Note: Because the Success and Failure packets are not 1146 acknowledged, they are not retransmitted by the authenticator, and 1147 may be potentially lost. A peer MUST allow for this circumstance as 1148 described in this note. See also Section 3.4 for guidance on the 1149 processing of lower layer success and failure indications. 1151 As described in Section 2.1, only a single EAP authentication method 1152 is allowed within an EAP conversation. EAP methods may implement 1153 result indications. After the authenticator sends a failure result 1154 indication to the peer, regardless of the response from the peer, it 1155 MUST subsequently send a Failure packet. After the authenticator 1156 sends a success result indication to the peer and receives a success 1157 result indication from the peer, it MUST subsequently send a Success 1158 packet. 1160 On the peer, once the method completes unsuccessfully (that is, 1161 either the authenticator sends a failure result indication, or the 1162 peer decides that it does not want to continue the conversation, 1163 possibly after sending a failure result indication), the peer MUST 1164 terminate the conversation and indicate failure to the lower layer. 1165 The peer MUST silently discard Success packets and MAY silently 1166 discard Failure packets. As a result, loss of a Failure packet need 1167 not result in a timeout. 1169 On the peer, after success result indications have been exchanged by 1170 both sides, a Failure packet MUST be silently discarded. The peer 1171 MAY, in the event that an EAP Success is not received, conclude that 1172 the EAP Success packet was lost and that authentication concluded 1173 successfully. 1175 If the authenticator has not sent a result indication, and the peer 1176 is willing to continue the conversation, the peer waits for a Success 1177 or Failure packet once the method completes, and MUST NOT silently 1178 discard either of them. In the event that neither a Success nor 1179 Failure packet is received, the peer SHOULD terminate the 1180 conversation to avoid lengthy timeouts in case the lost packet was an 1181 EAP Failure. 1183 If the peer attempts to authenticate to the authenticator and fails 1184 to do so, the authenticator MUST send a Failure packet and MUST NOT 1185 grant access by sending a Success packet. However, an authenticator 1186 MAY omit having the peer authenticate to it in situations where 1187 limited access is offered (e.g., guest access). In this case, the 1188 authenticator MUST send a Success packet. 1190 Where the peer authenticates successfully to the authenticator, but 1191 the authenticator does not send a result indication, the 1192 authenticator MAY deny access by sending a Failure packet where the 1193 peer is not currently authorized for network access. 1195 A summary of the Success and Failure packet format is shown below. 1196 The fields are transmitted from left to right. 1198 0 1 2 3 1199 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1200 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1201 | Code | Identifier | Length | 1202 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1204 Code 1206 3 for Success 1207 4 for Failure 1209 Identifier 1211 The Identifier field is one octet and aids in matching replies to 1212 Responses. The Identifier field MUST match the Identifier field 1213 of the Response packet that it is sent in response to. 1215 Length 1216 4 1218 4.3. Retransmission Behavior 1220 Because the authentication process will often involve user input, 1221 some care must be taken when deciding upon retransmission strategies 1222 and authentication timeouts. By default, where EAP is run over an 1223 unreliable lower layer, the EAP retransmission timer SHOULD be 1224 dynamically estimated. A maximum of 3-5 retransmissions is 1225 suggested. 1227 When run over a reliable lower layer (e.g., EAP over ISAKMP/TCP, as 1228 within [I-D.ietf-ipsra-pic]), the authenticator retransmission timer 1229 SHOULD be set to an infinite value, so that retransmissions do not 1230 occur at the EAP layer. The peer may still maintain a timeout value 1231 so as to avoid waiting indefinitely for a Request. 1233 Where the authentication process requires user input, the measured 1234 round trip times may be determined by user responsiveness rather than 1235 network characteristics, so that dynamic RTO estimation may not be 1236 helpful. Instead, the retransmission timer SHOULD be set so as to 1237 provide sufficient time for the user to respond, with longer timeouts 1238 required in certain cases, such as where Token Cards (see 1239 Section 5.6) are involved. 1241 In order to provide the EAP authenticator with guidance as to the 1242 appropriate timeout value, a hint can be communicated to the 1243 authenticator by the backend authentication server (such as via the 1244 RADIUS Session-Timeout attribute). 1246 In order to dynamically estimate the EAP retransmission timer, the 1247 algorithms for the estimation of SRTT, RTTVAR, and RTO described in 1248 [RFC6298] are RECOMMENDED, including use of Karn's algorithm, with 1249 the following potential modifications: 1251 o In order to avoid synchronization behaviors that can occur with 1252 fixed timers among distributed systems, the retransmission timer 1253 is calculated with a jitter by using the RTO value and randomly 1254 adding a value drawn between -RTOmin/2 and RTOmin/2. Alternative 1255 calculations to create jitter MAY be used. These MUST be pseudo- 1256 random. For a discussion of pseudo-random number generation, see 1257 [RFC1750]. 1259 o When EAP is transported over a single link (as opposed to over the 1260 Internet), smaller values of RTOinitial, RTOmin, and RTOmax MAY be 1261 used. Recommended values are RTOinitial=1 second, RTOmin=200ms, 1262 and RTOmax=20 seconds. 1264 o When EAP is transported over a single link (as opposed to over the 1265 Internet), estimates MAY be done on a per-authenticator basis, 1266 rather than a per-session basis. This enables the retransmission 1267 estimate to make the most use of information on link-layer 1268 behavior. 1270 o An EAP implementation MAY clear SRTT and RTTVAR after backing off 1271 the timer multiple times, as it is likely that the current SRTT 1272 and RTTVAR are bogus in this situation. Once SRTT and RTTVAR are 1273 cleared, they should be initialized with the next RTT sample taken 1274 as described in [RFC6298] equation 2.2. 1276 5. Initial EAP Request/Response Types 1278 This section defines the initial set of EAP Types used in Request/ 1279 Response exchanges. More Types may be defined in future documents. 1280 The Type field is one octet and identifies the structure of an EAP 1281 Request or Response packet. The first 3 Types are considered special 1282 case Types. 1284 The remaining Types define authentication exchanges. Nak (Type 3) or 1285 Expanded Nak (Type 254) are valid only for Response packets, they 1286 MUST NOT be sent in a Request. 1288 All EAP implementations MUST support Types 1-4, which are defined in 1289 this document, and SHOULD support Type 254. Implementations MAY 1290 support other Types defined here or in future RFCs. 1292 1 Identity 1293 2 Notification 1294 3 Nak (Response only) 1295 4 MD5-Challenge 1296 5 One Time Password (OTP) 1297 6 Generic Token Card (GTC) 1298 254 Expanded Types 1299 255 Experimental use 1301 EAP methods MAY support authentication based on shared secrets. If 1302 the shared secret is a passphrase entered by the user, 1303 implementations MAY support entering passphrases with non-ASCII 1304 characters. In this case, the input should be processed using an 1305 appropriate stringprep [RFC3454] profile, and encoded in octets using 1306 UTF-8 encoding [RFC3629]. A preliminary version of a possible 1307 stringprep profile is described in [RFC8265]. 1309 5.1. Identity 1311 Description 1313 The Identity Type is used to query the identity of the peer. 1314 Generally, the authenticator will issue this as the initial 1315 Request. An optional displayable message MAY be included to 1316 prompt the peer in the case where there is an expectation of 1317 interaction with a user. A Response of Type 1 (Identity) SHOULD 1318 be sent in Response to a Request with a Type of 1 (Identity). 1320 Some EAP implementations piggy-back various options into the 1321 Identity Request after a NUL-character. By default, an EAP 1322 implementation SHOULD NOT assume that an Identity Request or 1323 Response can be larger than 1020 octets. 1325 It is RECOMMENDED that the Identity Response be used primarily for 1326 routing purposes and selecting which EAP method to use. EAP 1327 Methods SHOULD include a method-specific mechanism for obtaining 1328 the identity, so that they do not have to rely on the Identity 1329 Response. Identity Requests and Responses are sent in cleartext, 1330 so an attacker may snoop on the identity, or even modify or spoof 1331 identity exchanges. To address these threats, it is preferable 1332 for an EAP method to include an identity exchange that supports 1333 per-packet authentication, integrity and replay protection, and 1334 confidentiality. The Identity Response may not be the appropriate 1335 identity for the method; it may have been truncated or obfuscated 1336 so as to provide privacy, or it may have been decorated for 1337 routing purposes. Where the peer is configured to only accept 1338 authentication methods supporting protected identity exchanges, 1339 the peer MAY provide an abbreviated Identity Response (such as 1340 omitting the peer-name portion of the NAI [RFC2486]). For further 1341 discussion of identity protection, see Section 7.3. 1343 Implementation Note: The peer MAY obtain the Identity via user 1344 input. It is suggested that the authenticator retry the Identity 1345 Request in the case of an invalid Identity or authentication 1346 failure to allow for potential typos on the part of the user. It 1347 is suggested that the Identity Request be retried a minimum of 3 1348 times before terminating the authentication. The Notification 1349 Request MAY be used to indicate an invalid authentication attempt 1350 prior to transmitting a new Identity Request (optionally, the 1351 failure MAY be indicated within the message of the new Identity 1352 Request itself). 1354 Type 1355 1 1357 Type-Data 1359 This field MAY contain a displayable message in the Request, 1360 containing UTF-8 encoded ISO 10646 characters [RFC3629]. Where 1361 the Request contains a null, only the portion of the field prior 1362 to the null is displayed. If the Identity is unknown, the 1363 Identity Response field should be zero bytes in length. The 1364 Identity Response field MUST NOT be null terminated. In all 1365 cases, the length of the Type-Data field is derived from the 1366 Length field of the Request/Response packet. 1368 Security Claims (see Section 7.2): 1370 Auth. mechanism: None 1371 Ciphersuite negotiation: No 1372 Mutual authentication: No 1373 Integrity protection: No 1374 Replay protection: No 1375 Confidentiality: No 1376 Key derivation: No 1377 Key strength: N/A 1378 Dictionary attack prot.: N/A 1379 Fast reconnect: No 1380 Crypt. binding: N/A 1381 Session independence: N/A 1382 Fragmentation: No 1383 Channel binding: No 1384 Perfect Forward Secrecy: N/A 1386 5.2. Notification 1388 Description 1390 The Notification Type is optionally used to convey a displayable 1391 message from the authenticator to the peer. An authenticator MAY 1392 send a Notification Request to the peer at any time when there is 1393 no outstanding Request, prior to completion of an EAP 1394 authentication method. The peer MUST respond to a Notification 1395 Request with a Notification Response unless the EAP authentication 1396 method specification prohibits the use of Notification messages. 1397 In any case, a Nak Response MUST NOT be sent in response to a 1398 Notification Request. Note that the default maximum length of a 1399 Notification Request is 1020 octets. By default, this leaves at 1400 most 1015 octets for the human readable message. 1402 An EAP method MAY indicate within its specification that 1403 Notification messages must not be sent during that method. In 1404 this case, the peer MUST silently discard Notification Requests 1405 from the point where an initial Request for that Type is answered 1406 with a Response of the same Type. 1408 The peer SHOULD display this message to the user or log it if it 1409 cannot be displayed. The Notification Type is intended to provide 1410 an acknowledged notification of some imperative nature, but it is 1411 not an error indication, and therefore does not change the state 1412 of the peer. Examples include a password with an expiration time 1413 that is about to expire, an OTP sequence integer which is nearing 1414 0, an authentication failure warning, etc. In most circumstances, 1415 Notification should not be required. 1417 Type 1419 2 1421 Type-Data 1423 The Type-Data field in the Request contains a displayable message 1424 greater than zero octets in length, containing UTF-8 encoded ISO 1425 10646 characters [RFC3629]. The length of the message is 1426 determined by the Length field of the Request packet. The message 1427 MUST NOT be null terminated. A Response MUST be sent in reply to 1428 the Request with a Type field of 2 (Notification). The Type-Data 1429 field of the Response is zero octets in length. The Response 1430 should be sent immediately (independent of how the message is 1431 displayed or logged). 1433 Security Claims (see Section 7.2): 1435 Auth. mechanism: None 1436 Ciphersuite negotiation: No 1437 Mutual authentication: No 1438 Integrity protection: No 1439 Replay protection: No 1440 Confidentiality: No 1441 Key derivation: No 1442 Key strength: N/A 1443 Dictionary attack prot.: N/A 1444 Fast reconnect: No 1445 Crypt. binding: N/A 1446 Session independence: N/A 1447 Fragmentation: No 1448 Channel binding: No 1449 Perfect Forward Secrecy: N/A 1451 5.3. Nak 1453 5.3.1. Legacy Nak 1455 Description 1457 The legacy Nak Type is valid only in Response messages. It is 1458 sent in reply to a Request where the desired authentication Type 1459 is unacceptable. Authentication Types are numbered 4 and above. 1460 The Response contains one or more authentication Types desired by 1461 the Peer. Type zero (0) is used to indicate that the sender has 1462 no viable alternatives, and therefore the authenticator SHOULD NOT 1463 send another Request after receiving a Nak Response containing a 1464 zero value. 1466 Since the legacy Nak Type is valid only in Responses and has very 1467 limited functionality, it MUST NOT be used as a general purpose 1468 error indication, such as for communication of error messages, or 1469 negotiation of parameters specific to a particular EAP method. 1471 Code 1473 2 for Response. 1475 Identifier 1477 The Identifier field is one octet and aids in matching Responses 1478 with Requests. The Identifier field of a legacy Nak Response MUST 1479 match the Identifier field of the Request packet that it is sent 1480 in response to. 1482 Length 1483 >=6 1485 Type 1487 3 1489 Type-Data 1491 Where a peer receives a Request for an unacceptable authentication 1492 Type (4-253,255), or a peer lacking support for Expanded Types 1493 receives a Request for Type 254, a Nak Response (Type 3) MUST be 1494 sent. The Type-Data field of the Nak Response (Type 3) MUST 1495 contain one or more octets indicating the desired authentication 1496 Type(s), one octet per Type, or the value zero (0) to indicate no 1497 proposed alternative. A peer supporting Expanded Types that 1498 receives a Request for an unacceptable authentication Type (4-253, 1499 255) MAY include the value 254 in the Nak Response (Type 3) to 1500 indicate the desire for an Expanded authentication Type. If the 1501 authenticator can accommodate this preference, it will respond 1502 with an Expanded Type Request (Type 254). 1504 Security Claims (see Section 7.2): 1506 Auth. mechanism: None 1507 Ciphersuite negotiation: No 1508 Mutual authentication: No 1509 Integrity protection: No 1510 Replay protection: No 1511 Confidentiality: No 1512 Key derivation: No 1513 Key strength: N/A 1514 Dictionary attack prot.: N/A 1515 Fast reconnect: No 1516 Crypt. binding: N/A 1517 Session independence: N/A 1518 Fragmentation: No 1519 Channel binding: No 1520 Perfect Forward Secrecy: N/A 1522 5.3.2. Expanded Nak 1524 Description 1526 The Expanded Nak Type is valid only in Response messages. It MUST 1527 be sent only in reply to a Request of Type 254 (Expanded Type) 1528 where the authentication Type is unacceptable. The Expanded Nak 1529 Type uses the Expanded Type format itself, and the Response 1530 contains one or more authentication Types desired by the peer, all 1531 in Expanded Type format. Type zero (0) is used to indicate that 1532 the sender has no viable alternatives. The general format of the 1533 Expanded Type is described in Section 5.7. 1535 Since the Expanded Nak Type is valid only in Responses and has 1536 very limited functionality, it MUST NOT be used as a general 1537 purpose error indication, such as for communication of error 1538 messages, or negotiation of parameters specific to a particular 1539 EAP method. 1541 Code 1543 2 for Response. 1545 Identifier 1547 The Identifier field is one octet and aids in matching Responses 1548 with Requests. The Identifier field of an Expanded Nak Response 1549 MUST match the Identifier field of the Request packet that it is 1550 sent in response to. 1552 Length 1554 >=20 1556 Type 1558 254 1560 Vendor-Id 1562 0 (IETF) 1564 Vendor-Type 1566 3 (Nak) 1568 Vendor-Data 1570 The Expanded Nak Type is only sent when the Request contains an 1571 Expanded Type (254) as defined in Section 5.7. The Vendor-Data 1572 field of the Nak Response MUST contain one or more authentication 1573 Types (4 or greater), all in expanded format, 8 octets per Type, 1574 or the value zero (0), also in Expanded Type format, to indicate 1575 no proposed alternative. The desired authentication Types may 1576 include a mixture of Vendor-Specific and IETF Types. For example, 1577 an Expanded Nak Response indicating a preference for OTP (Type 5), 1578 and an MIT (Vendor-Id=20) Expanded Type of 6 would appear as 1579 follows: 1581 0 1 2 3 1582 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1583 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1584 | 2 | Identifier | Length=28 | 1585 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1586 | Type=254 | 0 (IETF) | 1587 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1588 | 3 (Nak) | 1589 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1590 | Type=254 | 0 (IETF) | 1591 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1592 | 5 (OTP) | 1593 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1594 | Type=254 | 20 (MIT) | 1595 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1596 | 6 | 1597 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1599 An Expanded Nak Response indicating a no desired alternative would 1600 appear as follows: 1602 0 1 2 3 1603 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1604 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1605 | 2 | Identifier | Length=20 | 1606 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1607 | Type=254 | 0 (IETF) | 1608 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1609 | 3 (Nak) | 1610 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1611 | Type=254 | 0 (IETF) | 1612 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1613 | 0 (No alternative) | 1614 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1616 Security Claims (see Section 7.2): 1618 Auth. mechanism: None 1619 Ciphersuite negotiation: No 1620 Mutual authentication: No 1621 Integrity protection: No 1622 Replay protection: No 1623 Confidentiality: No 1624 Key derivation: No 1625 Key strength: N/A 1626 Dictionary attack prot.: N/A 1627 Fast reconnect: No 1628 Crypt. binding: N/A 1629 Session independence: N/A 1630 Fragmentation: No 1631 Channel binding: No 1632 Perfect Forward Secrecy: N/A 1634 5.4. MD5-Challenge 1636 Description 1638 The MD5-Challenge Type is analogous to the PPP CHAP protocol 1639 [RFC1994] (with MD5 as the specified algorithm). The Request 1640 contains a "challenge" message to the peer. A Response MUST be 1641 sent in reply to the Request. The Response MAY be either of Type 1642 4 (MD5-Challenge), Nak (Type 3), or Expanded Nak (Type 254). The 1643 Nak reply indicates the peer's desired authentication Type(s). 1644 EAP peer and EAP server implementations MUST support the MD5- 1645 Challenge mechanism. An authenticator that supports only pass- 1646 through MUST allow communication with a backend authentication 1647 server that is capable of supporting MD5-Challenge, although the 1648 EAP authenticator implementation need not support MD5-Challenge 1649 itself. However, if the EAP authenticator can be configured to 1650 authenticate peers locally (e.g., not operate in pass-through), 1651 then the requirement for support of the MD5-Challenge mechanism 1652 applies. 1654 Note that the use of the Identifier field in the MD5-Challenge 1655 Type is different from that described in [RFC1994]. EAP allows 1656 for retransmission of MD5-Challenge Request packets, while 1657 [RFC1994] states that both the Identifier and Challenge fields 1658 MUST change each time a Challenge (the CHAP equivalent of the 1659 MD5-Challenge Request packet) is sent. 1661 Note 1. MD5 algorithm has severe issues, particularly when used 1662 without HMAC (which is not used by CHAP or EAP-MD5). For more 1663 information, refer to Section 7.11.1. 1665 Note 2: [RFC1994] treats the shared secret as an octet string, and 1666 does not specify how it is entered into the system (or if it is 1667 handled by the user at all). EAP MD5-Challenge implementations 1668 MAY support entering passphrases with non-ASCII characters. See 1669 Section 5 for instructions how the input should be processed and 1670 encoded into octets. 1672 Type 1674 4 1676 Type-Data 1678 The contents of the Type-Data field is summarized below. For 1679 reference on the use of these fields, see the PPP Challenge 1680 Handshake Authentication Protocol [RFC1994]. 1682 0 1 2 3 1683 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1684 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1685 | Value-Size | Value ... 1686 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1687 | Name ... 1688 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1690 Security Claims (see Section 7.2): 1692 Auth. mechanism: Password or pre-shared key. 1693 Ciphersuite negotiation: No 1694 Mutual authentication: No 1695 Integrity protection: No 1696 Replay protection: No 1697 Confidentiality: No 1698 Key derivation: No 1699 Key strength: N/A 1700 Dictionary attack prot.: No 1701 Fast reconnect: No 1702 Crypt. binding: N/A 1703 Session independence: N/A 1704 Fragmentation: No 1705 Channel binding: No 1706 Perfect Forward Secrecy: N/A 1708 5.5. One-Time Password (OTP) 1710 Description 1712 The One-Time Password system is defined in "A One-Time Password 1713 System" [RFC2289] and "OTP Extended Responses" [RFC2243]. The 1714 Request contains an OTP challenge in the format described in 1715 [RFC2289]. A Response MUST be sent in reply to the Request. The 1716 Response MUST be of Type 5 (OTP), Nak (Type 3), or Expanded Nak 1717 (Type 254). The Nak Response indicates the peer's desired 1718 authentication Type(s). The EAP OTP method is intended for use 1719 with the One-Time Password system only, and MUST NOT be used to 1720 provide support for cleartext passwords. 1722 Type 1724 5 1726 Type-Data 1728 The Type-Data field contains the OTP "challenge" as a displayable 1729 message in the Request. In the Response, this field is used for 1730 the 6 words from the OTP dictionary [RFC2289]. The messages MUST 1731 NOT be null terminated. The length of the field is derived from 1732 the Length field of the Request/Reply packet. 1734 Note: [RFC2289] does not specify how the secret pass-phrase is 1735 entered by the user, or how the pass-phrase is converted into 1736 octets. EAP OTP implementations MAY support entering passphrases 1737 with non-ASCII characters. See Section 5 for instructions on how 1738 the input should be processed and encoded into octets. 1740 Security Claims (see Section 7.2): 1742 Auth. mechanism: One-Time Password 1743 Ciphersuite negotiation: No 1744 Mutual authentication: No 1745 Integrity protection: No 1746 Replay protection: Yes 1747 Confidentiality: No 1748 Key derivation: No 1749 Key strength: N/A 1750 Dictionary attack prot.: No 1751 Fast reconnect: No 1752 Crypt. binding: N/A 1753 Session independence: N/A 1754 Fragmentation: No 1755 Channel binding: No 1756 Perfect Forward Secrecy: N/A 1758 5.6. Generic Token Card (GTC) 1760 Description 1762 The Generic Token Card Type is defined for use with various Token 1763 Card implementations which require user input. The Request 1764 contains a displayable message and the Response contains the Token 1765 Card information necessary for authentication. Typically, this 1766 would be information read by a user from the Token card device and 1767 entered as ASCII text. A Response MUST be sent in reply to the 1768 Request. The Response MUST be of Type 6 (GTC), Nak (Type 3), or 1769 Expanded Nak (Type 254). The Nak Response indicates the peer's 1770 desired authentication Type(s). The EAP GTC method is intended 1771 for use with the Token Cards supporting challenge/response 1772 authentication and MUST NOT be used to provide support for 1773 cleartext passwords in the absence of a protected tunnel with 1774 server authentication. 1776 Type 1778 6 1780 Type-Data 1782 The Type-Data field in the Request contains a displayable message 1783 greater than zero octets in length. The length of the message is 1784 determined by the Length field of the Request packet. The message 1785 MUST NOT be null terminated. A Response MUST be sent in reply to 1786 the Request with a Type field of 6 (Generic Token Card). The 1787 Response contains data from the Token Card required for 1788 authentication. The length of the data is determined by the 1789 Length field of the Response packet. 1791 EAP GTC implementations MAY support entering a response with non- 1792 ASCII characters. See Section 5 for instructions how the input 1793 should be processed and encoded into octets. 1795 Security Claims (see Section 7.2): 1797 Auth. mechanism: Hardware token. 1798 Ciphersuite negotiation: No 1799 Mutual authentication: No 1800 Integrity protection: No 1801 Replay protection: No 1802 Confidentiality: No 1803 Key derivation: No 1804 Key strength: N/A 1805 Dictionary attack prot.: No 1806 Fast reconnect: No 1807 Crypt. binding: N/A 1808 Session independence: N/A 1809 Fragmentation: No 1810 Channel binding: No 1811 Perfect Forward Secrecy: N/A 1813 5.7. Expanded Types 1815 Description 1817 Since many of the existing uses of EAP are vendor-specific, the 1818 Expanded method Type is available to allow vendors to support 1819 their own Expanded Types not suitable for general usage. 1821 The Expanded Type is also used to expand the global Method Type 1822 space beyond the original 255 values. A Vendor-Id of 0 maps the 1823 original 255 possible Types onto a space of 2^32-1 possible Types. 1824 (Type 0 is only used in a Nak Response to indicate no acceptable 1825 alternative). 1827 An implementation that supports the Expanded attribute MUST treat 1828 EAP Types that are less than 256 equivalently, whether they appear 1829 as a single octet or as the 32-bit Vendor-Type within an Expanded 1830 Type where Vendor-Id is 0. Peers not equipped to interpret the 1831 Expanded Type MUST send a Nak as described in Section 5.3.1, and 1832 negotiate a more suitable authentication method. 1834 A summary of the Expanded Type format is shown below. The fields 1835 are transmitted from left to right. 1837 0 1 2 3 1838 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1839 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1840 | Type | Vendor-Id | 1841 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1842 | Vendor-Type | 1843 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1844 | Vendor data... 1845 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1847 Type 1849 254 for Expanded Type 1851 Vendor-Id 1853 The Vendor-Id is 3 octets and represents the SMI Network 1854 Management Private Enterprise Code of the Vendor in network byte 1855 order, as allocated by IANA. A Vendor-Id of zero is reserved for 1856 use by the IETF in providing an expanded global EAP Type space. 1858 Vendor-Type 1860 The Vendor-Type field is four octets and represents the vendor- 1861 specific method Type. 1863 If the Vendor-Id is zero, the Vendor-Type field is an extension 1864 and superset of the existing namespace for EAP Types. The first 1865 256 Types are reserved for compatibility with single-octet EAP 1866 Types that have already been assigned or may be assigned in the 1867 future. Thus, EAP Types from 0 through 255 are semantically 1868 identical, whether they appear as single octet EAP Types or as 1869 Vendor-Types when Vendor-Id is zero. There is one exception to 1870 this rule: Expanded Nak and Legacy Nak packets share the same 1871 Type, but must be treated differently because they have a 1872 different format. 1874 Vendor-Data 1876 The Vendor-Data field is defined by the vendor. Where a Vendor-Id 1877 of zero is present, the Vendor-Data field will be used for 1878 transporting the contents of EAP methods of Types defined by the 1879 IETF. 1881 5.8. Experimental 1883 Description 1885 The Experimental Type has no fixed format or content. It is 1886 intended for use when experimenting with new EAP Types. This Type 1887 is intended for experimental and testing purposes. No guarantee 1888 is made for interoperability between peers using this Type, as 1889 outlined in [RFC3692]. 1891 Type 1893 255 1895 Type-Data 1897 Undefined 1899 6. IANA Considerations 1901 This section provides guidance to the Internet Assigned Numbers 1902 Authority (IANA) regarding registration of values related to the EAP 1903 protocol, in accordance with BCP 26, [RFC8126]. 1905 There are two name spaces in EAP that require registration: Packet 1906 Codes and method Types. 1908 EAP is not intended as a general-purpose protocol, and allocations 1909 SHOULD NOT be made for purposes unrelated to authentication. 1911 The following terms are used here with the meanings defined in BCP 1912 26: "name space", "assigned value", "registration". 1914 The following policies are used here with the meanings defined in BCP 1915 26: "Private Use", "First Come First Served", "Expert Review", 1916 "Specification Required", "IETF Review", "Standards Action". 1918 For registration requests where a Designated Expert should be 1919 consulted, the responsible IESG area director should appoint the 1920 Designated Expert. The intention is that any allocation will be 1921 accompanied by a published RFC. But in order to allow for the 1922 allocation of values prior to the RFC being approved for publication, 1923 the Designated Expert can approve allocations once it seems clear 1924 that an RFC will be published. The Designated expert will post a 1925 request to the EAP WG mailing list (or a successor designated by the 1926 Area Director) for comment and review, including an Internet-Draft. 1927 Before a period of 30 days has passed, the Designated Expert will 1928 either approve or deny the registration request and publish a notice 1929 of the decision to the EAP WG mailing list or its successor, as well 1930 as informing IANA. A denial notice must be justified by an 1931 explanation, and in the cases where it is possible, concrete 1932 suggestions on how the request can be modified so as to become 1933 acceptable should be provided. 1935 6.1. Packet Codes 1937 Packet Codes have a range from 1 to 255, of which 1-4 have been 1938 allocated by this document and 5-6 by [RFC6696]. Because a new 1939 Packet Code has considerable impact on interoperability, a new Packet 1940 Code requires Standards Action, and should be allocated starting at 1941 5. 1943 6.2. Method Types 1945 The original EAP method Type space has a range from 1 to 255, and is 1946 the scarcest resource in EAP, and thus must be allocated with care. 1947 Method Type 0 is reserved. Method Types 1-55 have been allocated, 1948 with 20 available for re-use. Method Types 20 and 56-191 may be 1949 allocated through Expert Review, on the advice of a Designated 1950 Expert, with Specification Required. 1952 Allocation of blocks of method Types (more than one for a given 1953 purpose) should require IETF Review. EAP Type Values 192-253 are 1954 reserved and allocation requires Standards Action. 1956 Method Type 254 is allocated for the Expanded Type. Where the 1957 Vendor-Id field is non-zero, the Expanded Type is used for functions 1958 specific only to one vendor's implementation of EAP, where no 1959 interoperability is deemed useful. When used with a Vendor-Id of 1960 zero, method Type 254 can also be used to provide for an expanded 1961 IETF method Type space. Method Type values 256-4294967295 may be 1962 allocated after Type values 1-191 have been allocated, on the advice 1963 of a Designated Expert, with Specification Required. 1965 Method Type 255 is allocated for Experimental use, such as testing of 1966 new EAP methods before a permanent Type is allocated. 1968 7. Security Considerations 1970 This section defines a generic threat model as well as the EAP method 1971 security claims mitigating those threats. 1973 It is expected that the generic threat model and corresponding 1974 security claims will used to define EAP method requirements for use 1975 in specific environments. An example of such a requirements analysis 1976 is provided in [IEEE-802.11i-req]. A security claims section is 1977 required in EAP method specifications, so that EAP methods can be 1978 evaluated against the requirements. 1980 7.1. Threat Model 1982 EAP was developed for use with PPP [RFC1661] and was later adapted 1983 for use in wired IEEE 802 networks [IEEE-802] in [IEEE-802.1X] and 1984 3GPP 5G [TS.33.501]. Subsequently, EAP has been proposed for use on 1985 wireless LAN networks and over the Internet. In all these 1986 situations, it is possible for an attacker to gain access to links 1987 over which EAP packets are transmitted. For example, attacks on 1988 telephone infrastructure are documented in [DECEPTION]. 1990 An attacker with access to the link may carry out a number of 1991 attacks, including: 1993 1. An attacker may try to discover user identities by snooping 1994 authentication traffic. 1996 2. An attacker may try to modify or spoof EAP packets. 1998 3. An attacker may launch denial of service attacks by spoofing 1999 lower layer indications or Success/Failure packets, by replaying 2000 EAP packets, or by generating packets with overlapping 2001 Identifiers. 2003 4. An attacker may attempt to recover the pass-phrase by mounting 2004 an offline dictionary attack. 2006 5. An attacker may attempt to convince the peer to connect to an 2007 untrusted network by mounting a man-in-the-middle attack. 2009 6. An attacker may attempt to disrupt the EAP negotiation in order 2010 cause a weak authentication method to be selected. 2012 7. An attacker may attempt to recover keys by taking advantage of 2013 weak key derivation techniques used within EAP methods. 2015 8. An attacker may attempt to take advantage of weak ciphersuites 2016 subsequently used after the EAP conversation is complete. 2018 9. An attacker may attempt to perform downgrading attacks on lower 2019 layer ciphersuite negotiation in order to ensure that a weaker 2020 ciphersuite is used subsequently to EAP authentication. 2022 10. An attacker acting as an authenticator may provide incorrect 2023 information to the EAP peer and/or server via out-of-band 2024 mechanisms (such as via a AAA or lower layer protocol). This 2025 includes impersonating another authenticator, or providing 2026 inconsistent information to the peer and EAP server. 2028 Depending on the lower layer, these attacks may be carried out 2029 without requiring physical proximity. Where EAP is used over 2030 wireless networks, EAP packets may be forwarded by authenticators 2031 (e.g., pre-authentication) so that the attacker need not be within 2032 the coverage area of an authenticator in order to carry out an attack 2033 on it or its peers. Where EAP is used over the Internet, attacks may 2034 be carried out at an even greater distance. 2036 7.2. Security Claims 2038 In order to clearly articulate the security provided by an EAP 2039 method, EAP method specifications MUST include a Security Claims 2040 section, including the following declarations: 2042 o Mechanism. This is a statement of the authentication technology: 2043 certificates, pre-shared keys, passwords, token cards, etc. 2045 o Security claims. This is a statement of the claimed security 2046 properties of the method, using terms defined in Section 7.2.1: 2047 mutual authentication, integrity protection, replay protection, 2048 confidentiality, key derivation, key strength, dictionary attack 2049 resistance, fast reconnect, cryptographic binding, session 2050 independance, fragmentation, channel binding, perfect forward 2051 secrecy. The Security Claims section of an EAP method 2052 specification SHOULD provide justification for the claims that are 2053 made. This can be accomplished by including a proof in an 2054 Appendix, or including a reference to a proof. 2056 o Key strength. If the method derives keys, then the effective key 2057 strength MUST be estimated. This estimate is meant for potential 2058 users of the method to determine if the keys produced are strong 2059 enough for the intended application. 2061 The effective key strength SHOULD be stated as a number of bits, 2062 defined as follows: If the effective key strength is N bits, the 2063 best currently known methods to recover the key (with non- 2064 negligible probability) require, on average, an effort comparable 2065 to 2^(N-1) operations of a typical block cipher. The statement 2066 SHOULD be accompanied by a short rationale, explaining how this 2067 number was derived. This explanation SHOULD include the 2068 parameters required to achieve the stated key strength based on 2069 current knowledge of the algorithms. 2071 (Note: Although it is difficult to define what "comparable effort" 2072 and "typical block cipher" exactly mean, reasonable approximations 2073 are sufficient here. Refer to e.g. [SILVERMAN] for more 2074 discussion.) 2076 The key strength depends on the methods used to derive the keys. 2077 For instance, if keys are derived from a shared secret (such as a 2078 password or a long-term secret), and possibly some public 2079 information such as nonces, the effective key strength is limited 2080 by the strength of the long-term secret (assuming that the 2081 derivation procedure is computationally simple). To take another 2082 example, when using public key algorithms, the strength of the 2083 symmetric key depends on the strength of the public keys used. 2085 o Description of key hierarchy. EAP methods deriving keys MUST 2086 either provide a reference to a key hierarchy specification, or 2087 describe how Master Session Keys (MSKs) and Extended Master 2088 Session Keys (EMSKs) are to be derived. 2090 o Indication of vulnerabilities. In addition to the security claims 2091 that are made, the specification MUST indicate which of the 2092 security claims detailed in Section 7.2.1 are NOT being made. 2094 7.2.1. Security Claims Terminology for EAP Methods 2096 These terms are used to describe the security properties of EAP 2097 methods: 2099 Protected ciphersuite negotiation 2101 This refers to the ability of an EAP method to negotiate the 2102 ciphersuite used to protect the EAP conversation, as well as to 2103 integrity protect the negotiation. It does not refer to the 2104 ability to negotiate the ciphersuite used to protect data. 2106 Mutual authentication 2108 This refers to an EAP method in which, within an interlocked 2109 exchange, the authenticator authenticates the peer and the peer 2110 authenticates the authenticator. Two independent one-way methods, 2111 running in opposite directions do not provide mutual 2112 authentication as defined here. 2114 Integrity protection 2116 This refers to providing data origin authentication and protection 2117 against unauthorized modification of information for EAP packets 2118 (including EAP Requests and Responses). When making this claim, a 2119 method specification MUST describe the EAP packets and fields 2120 within the EAP packet that are protected. 2122 Replay protection 2124 This refers to protection against replay of an EAP method or its 2125 messages, including success and failure result indications. 2127 Confidentiality 2129 This refers to encryption of EAP messages, including EAP Requests 2130 and Responses, and success and failure result indications. A 2131 method making this claim MUST support identity protection (see 2132 Section 7.3). 2134 Key derivation 2136 This refers to the ability of the EAP method to derive exportable 2137 keying material, such as the Master Session Key (MSK), and 2138 Extended Master Session Key (EMSK). The MSK is used only for 2139 further key derivation, not directly for protection of the EAP 2140 conversation or subsequent data. Use of the EMSK is reserved. 2142 Key strength 2144 If the effective key strength is N bits, the best currently known 2145 methods to recover the key (with non-negligible probability) 2146 require, on average, an effort comparable to 2^(N-1) operations of 2147 a typical block cipher. 2149 Dictionary attack resistance 2151 Where password authentication is used, passwords are commonly 2152 selected from a small set (as compared to a set of N-bit keys), 2153 which raises a concern about dictionary attacks. A method may be 2154 said to provide protection against dictionary attacks if, when it 2155 uses a password as a secret, the method does not allow an offline 2156 attack that has a work factor based on the number of passwords in 2157 an attacker's dictionary. 2159 Fast reconnect 2161 The ability, in the case where a security association has been 2162 previously established, to create a new or refreshed security 2163 association more efficiently or in a smaller number of round- 2164 trips. 2166 Cryptographic binding 2167 The demonstration of the EAP peer to the EAP server that a single 2168 entity has acted as the EAP peer for all methods executed within a 2169 tunnel method. Binding MAY also imply that the EAP server 2170 demonstrates to the peer that a single entity has acted as the EAP 2171 server for all methods executed within a tunnel method. If 2172 executed correctly, binding serves to mitigate man-in-the-middle 2173 vulnerabilities. 2175 Session independence 2177 The demonstration that passive attacks (such as capture of the EAP 2178 conversation) or active attacks (including compromise of the MSK 2179 or EMSK) does not enable compromise of subsequent or prior MSKs or 2180 EMSKs. 2182 Fragmentation 2184 This refers to whether an EAP method supports fragmentation and 2185 reassembly. As noted in Section 3.1, EAP methods should support 2186 fragmentation and reassembly if EAP packets can exceed the minimum 2187 MTU of 1020 octets. 2189 Channel binding 2191 The communication within an EAP method of integrity-protected 2192 channel properties such as endpoint identifiers which can be 2193 compared to values communicated via out of band mechanisms (such 2194 as via a AAA or lower layer protocol). 2196 Perfect Forward Secrecy 2198 The demonstration that the derived keying material, such as the 2199 MSK and EMSK will not be compromised even if long-term secrets 2200 used in EAP conversation are compromised. 2202 Note: This list of security claims is not exhaustive. Additional 2203 properties, such as additional denial-of-service protection, may be 2204 relevant as well. 2206 7.3. Identity Protection 2208 An Identity exchange is optional within the EAP conversation. 2209 Therefore, it is possible to omit the Identity exchange entirely, or 2210 to use a method-specific identity exchange once a protected channel 2211 has been established. 2213 However, where roaming is supported as described in [RFC2607], it may 2214 be necessary to locate the appropriate backend authentication server 2215 before the authentication conversation can proceed. The realm 2216 portion of the Network Access Identifier (NAI) [RFC2486] is typically 2217 included within the EAP-Response/Identity in order to enable the 2218 authentication exchange to be routed to the appropriate backend 2219 authentication server. Therefore, while the peer-name portion of the 2220 NAI SHOULD be omitted in the EAP-Response/Identity where proxies or 2221 relays are present, the realm portion may be required. 2223 It is possible for the identity in the identity response to be 2224 different from the identity authenticated by the EAP method. This 2225 may be intentional in the case of identity privacy. An EAP method 2226 SHOULD use the authenticated identity when making access control 2227 decisions. 2229 7.4. Man-in-the-Middle Attacks 2231 Where EAP is tunneled within another protocol that omits peer 2232 authentication, there exists a potential vulnerability to a man-in- 2233 the-middle attack. For details, see [I-D.puthenkulam-eap-binding] 2234 and [MITM]. 2236 As noted in Section 2.1, EAP does not permit untunneled sequences of 2237 authentication methods. Were a sequence of EAP authentication 2238 methods to be permitted, the peer might not have proof that a single 2239 entity has acted as the authenticator for all EAP methods within the 2240 sequence. For example, an authenticator might terminate one EAP 2241 method, then forward the next method in the sequence to another party 2242 without the peer's knowledge or consent. Similarly, the 2243 authenticator might not have proof that a single entity has acted as 2244 the peer for all EAP methods within the sequence. 2246 Tunneling EAP within another protocol enables an attack by a rogue 2247 EAP authenticator tunneling EAP to a legitimate server. Where the 2248 tunneling protocol is used for key establishment but does not require 2249 peer authentication, an attacker convincing a legitimate peer to 2250 connect to it will be able to tunnel EAP packets to a legitimate 2251 server, successfully authenticating and obtaining the key. This 2252 allows the attacker to successfully establish itself as a man-in- 2253 the-middle, gaining access to the network, as well as the ability to 2254 decrypt data traffic between the legitimate peer and server. 2256 This attack may be mitigated by the following measures: 2258 1. Requiring mutual authentication within EAP tunneling mechanisms. 2260 2. Requiring cryptographic binding between the EAP tunneling 2261 protocol and the tunneled EAP methods. Where cryptographic 2262 binding is supported, a mechanism is also needed to protect 2263 against downgrade attacks that would bypass it. For further 2264 details on cryptographic binding, see 2265 [I-D.puthenkulam-eap-binding]. 2267 3. Limiting the EAP methods authorized for use without protection, 2268 based on peer and authenticator policy. 2270 4. Avoiding the use of tunnels when a single, strong method is 2271 available. 2273 7.5. Packet Modification Attacks 2275 While EAP methods may support per-packet data origin authentication, 2276 integrity, and replay protection, support is not provided within the 2277 EAP layer. 2279 Since the Identifier is only a single octet, it is easy to guess, 2280 allowing an attacker to successfully inject or replay EAP packets. 2281 An attacker may also modify EAP headers (Code, Identifier, Length, 2282 Type) within EAP packets where the header is unprotected. This could 2283 cause packets to be inappropriately discarded or misinterpreted. 2285 To protect EAP packets against modification, spoofing, or replay, 2286 methods supporting protected ciphersuite negotiation, mutual 2287 authentication, and key derivation, as well as integrity and replay 2288 protection, are recommended. See Section 7.2.1 for definitions of 2289 these security claims. 2291 Method-specific MICs may be used to provide protection. If a per- 2292 packet MIC is employed within an EAP method, then peers, 2293 authentication servers, and authenticators not operating in pass- 2294 through mode MUST validate the MIC. MIC validation failures SHOULD 2295 be logged. Whether a MIC validation failure is considered a fatal 2296 error or not is determined by the EAP method specification. 2298 It is RECOMMENDED that methods providing integrity protection of EAP 2299 packets include coverage of all the EAP header fields, including the 2300 Code, Identifier, Length, Type, and Type-Data fields. 2302 Since EAP messages of Types Identity, Notification, and Nak do not 2303 include their own MIC, it may be desirable for the EAP method MIC to 2304 cover information contained within these messages, as well as the 2305 header of each EAP message. 2307 To provide protection, EAP also may be encapsulated within a 2308 protected channel created by protocols such as ISAKMP [RFC2408], as 2309 is done in [RFC7296] or within TLS [RFC2246]. However, as noted in 2310 Section 7.4, EAP tunneling may result in a man-in-the-middle 2311 vulnerability. 2313 Existing EAP methods define message integrity checks (MICs) that 2314 cover more than one EAP packet. For example, EAP-TLS 2315 [RFC5216][I-D.ietf-emu-eap-tls13] defines a MIC over a TLS record 2316 that could be split into multiple fragments; within the FINISHED 2317 message, the MIC is computed over previous messages. Where the MIC 2318 covers more than one EAP packet, a MIC validation failure is 2319 typically considered a fatal error. 2321 Within EAP-TLS [RFC5216][I-D.ietf-emu-eap-tls13], a MIC validation 2322 failure is treated as a fatal error, since that is what is specified 2323 in TLS [RFC2246]. However, it is also possible to develop EAP 2324 methods that support per-packet MICs, and respond to verification 2325 failures by silently discarding the offending packet. 2327 In this document, descriptions of EAP message handling assume that 2328 per-packet MIC validation, where it occurs, is effectively performed 2329 as though it occurs before sending any responses or changing the 2330 state of the host which received the packet. 2332 7.6. Dictionary Attacks 2334 Password authentication algorithms such as EAP-MD5, MS-CHAPv1 2335 [RFC2433], and Kerberos V [RFC1510] are known to be vulnerable to 2336 dictionary attacks. MS-CHAPv1 vulnerabilities are documented in 2337 [PPTPv1]; MS-CHAPv2 vulnerabilities are documented in [PPTPv2]; 2338 Kerberos vulnerabilities are described in [KRBATTACK], [KRBLIM], and 2339 [KERB4WEAK]. 2341 In order to protect against dictionary attacks, authentication 2342 methods resistant to dictionary attacks (as defined in Section 7.2.1) 2343 are recommended. 2345 If an authentication algorithm is used that is known to be vulnerable 2346 to dictionary attacks, then the conversation may be tunneled within a 2347 protected channel in order to provide additional protection. 2348 However, as noted in Section 7.4, EAP tunneling may result in a man- 2349 in-the-middle vulnerability, and therefore dictionary attack 2350 resistant methods are preferred. 2352 7.7. Connection to an Untrusted Network 2354 With EAP methods supporting one-way authentication, such as EAP-MD5, 2355 the peer does not authenticate the authenticator, making the peer 2356 vulnerable to attack by a rogue authenticator. Methods supporting 2357 mutual authentication (as defined in Section 7.2.1) address this 2358 vulnerability. 2360 In EAP there is no requirement that authentication be full duplex or 2361 that the same protocol be used in both directions. It is perfectly 2362 acceptable for different protocols to be used in each direction. 2363 This will, of course, depend on the specific protocols negotiated. 2364 However, in general, completing a single unitary mutual 2365 authentication is preferable to two one-way authentications, one in 2366 each direction. This is because separate authentications that are 2367 not bound cryptographically so as to demonstrate they are part of the 2368 same session are subject to man-in-the-middle attacks, as discussed 2369 in Section 7.4. 2371 7.8. Negotiation Attacks 2373 In a negotiation attack, the attacker attempts to convince the peer 2374 and authenticator to negotiate a less secure EAP method. EAP does 2375 not provide protection for Nak Response packets, although it is 2376 possible for a method to include coverage of Nak Responses within a 2377 method-specific MIC. 2379 Within or associated with each authenticator, it is not anticipated 2380 that a particular named peer will support a choice of methods. This 2381 would make the peer vulnerable to attacks that negotiate the least 2382 secure method from among a set. Instead, for each named peer, there 2383 SHOULD be an indication of exactly one method used to authenticate 2384 that peer name. If a peer needs to make use of different 2385 authentication methods under different circumstances, then distinct 2386 identities SHOULD be employed, each of which identifies exactly one 2387 authentication method. 2389 7.9. Implementation Idiosyncrasies 2391 The interaction of EAP with lower layers such as PPP and IEEE 802 are 2392 highly implementation dependent. 2394 For example, upon failure of authentication, some PPP implementations 2395 do not terminate the link, instead limiting traffic in Network-Layer 2396 Protocols to a filtered subset, which in turn allows the peer the 2397 opportunity to update secrets or send mail to the network 2398 administrator indicating a problem. Similarly, while an 2399 authentication failure will result in denied access to the controlled 2400 port in [IEEE-802.1X], limited traffic may be permitted on the 2401 uncontrolled port. 2403 In EAP there is no provision for retries of failed authentication. 2404 However, in PPP the LCP state machine can renegotiate the 2405 authentication protocol at any time, thus allowing a new attempt. 2406 Similarly, in IEEE 802.1X the Supplicant or Authenticator can re- 2407 authenticate at any time. It is recommended that any counters used 2408 for authentication failure not be reset until after successful 2409 authentication, or subsequent termination of the failed link. 2411 7.10. Key Derivation 2413 It is possible for the peer and EAP server to mutually authenticate 2414 and derive keys. In order to provide keying material for use in a 2415 subsequently negotiated ciphersuite, an EAP method supporting key 2416 derivation MUST export a Master Session Key (MSK) of at least 64 2417 octets, and an Extended Master Session Key (EMSK) of at least 64 2418 octets. EAP Methods deriving keys MUST provide for mutual 2419 authentication between the EAP peer and the EAP Server. 2421 The MSK and EMSK MUST NOT be used directly to protect data; however, 2422 they are of sufficient size to enable derivation of a AAA-Key 2423 subsequently used to derive Transient Session Keys (TSKs) for use 2424 with the selected ciphersuite. Each ciphersuite is responsible for 2425 specifying how to derive the TSKs from the AAA-Key. 2427 The AAA-Key is derived from the keying material exported by the EAP 2428 method (MSK and EMSK). This derivation occurs on the AAA server. In 2429 many existing protocols that use EAP, the AAA-Key and MSK are 2430 equivalent, but more complicated mechanisms are possible (see 2431 [RFC5247] for details). 2433 EAP methods SHOULD ensure the freshness of the MSK and EMSK, even in 2434 cases where one party may not have a high quality random number 2435 generator. A RECOMMENDED method is for each party to provide a nonce 2436 of at least 128 bits, used in the derivation of the MSK and EMSK. 2438 EAP methods export the MSK and EMSK, but not Transient Session Keys 2439 so as to allow EAP methods to be ciphersuite and media independent. 2440 Keying material exported by EAP methods MUST be independent of the 2441 ciphersuite negotiated to protect data. 2443 Depending on the lower layer, EAP methods may run before or after 2444 ciphersuite negotiation, so that the selected ciphersuite may not be 2445 known to the EAP method. By providing keying material usable with 2446 any ciphersuite, EAP methods can used with a wide range of 2447 ciphersuites and media. 2449 In order to preserve algorithm independence, EAP methods deriving 2450 keys SHOULD support (and document) the protected negotiation of the 2451 ciphersuite used to protect the EAP conversation between the peer and 2452 server. This is distinct from the ciphersuite negotiated between the 2453 peer and authenticator, used to protect data. 2455 The strength of Transient Session Keys (TSKs) used to protect data is 2456 ultimately dependent on the strength of keys generated by the EAP 2457 method. If an EAP method cannot produce keying material of 2458 sufficient strength, then the TSKs may be subject to a brute force 2459 attack. In order to enable deployments requiring strong keys, EAP 2460 methods supporting key derivation SHOULD be capable of generating an 2461 MSK and EMSK, each with an effective key strength of at least 128 2462 bits. 2464 Methods supporting key derivation MUST demonstrate cryptographic 2465 separation between the MSK and EMSK branches of the EAP key 2466 hierarchy. Without violating a fundamental cryptographic assumption 2467 (such as the non-invertibility of a one-way function), an attacker 2468 recovering the MSK or EMSK MUST NOT be able to recover the other 2469 quantity with a level of effort less than brute force. 2471 Non-overlapping substrings of the MSK MUST be cryptographically 2472 separate from each other, as defined in Section 7.2.1. That is, 2473 knowledge of one substring MUST NOT help in recovering some other 2474 substring without breaking some hard cryptographic assumption. This 2475 is required because some existing ciphersuites form TSKs by simply 2476 splitting the AAA-Key to pieces of appropriate length. Likewise, 2477 non-overlapping substrings of the EMSK MUST be cryptographically 2478 separate from each other, and from substrings of the MSK. 2480 The EMSK is reserved for future use and MUST remain on the EAP peer 2481 and EAP server where it is derived; it MUST NOT be transported to, or 2482 shared with, additional parties, or used to derive any other keys. 2483 (This restriction will be relaxed in a future document that specifies 2484 how the EMSK can be used.) 2486 Since EAP does not provide for explicit key lifetime negotiation, EAP 2487 peers, authenticators, and authentication servers MUST be prepared 2488 for situations in which one of the parties discards the key state, 2489 which remains valid on another party. 2491 This specification does not provide detailed guidance on how EAP 2492 methods derive the MSK and EMSK, how the AAA-Key is derived from the 2493 MSK and/or EMSK, or how the TSKs are derived from the AAA-Key. 2495 The development and validation of key derivation algorithms is 2496 difficult, and as a result, EAP methods SHOULD re-use well 2497 established and analyzed mechanisms for key derivation (such as those 2498 specified in IKE [RFC2409] or TLS [RFC2246]), rather than inventing 2499 new ones. EAP methods SHOULD also utilize well established and 2500 analyzed mechanisms for MSK and EMSK derivation. Further details on 2501 EAP Key Derivation are provided within [RFC5247]. 2503 7.11. Weak Ciphersuites 2505 If after the initial EAP authentication, data packets are sent 2506 without per-packet authentication, integrity, and replay protection, 2507 an attacker with access to the media can inject packets, "flip bits" 2508 within existing packets, replay packets, or even hijack the session 2509 completely. Without per-packet confidentiality, it is possible to 2510 snoop data packets. 2512 To protect against data modification, spoofing, or snooping, it is 2513 recommended that EAP methods supporting mutual authentication and key 2514 derivation (as defined by Section 7.2.1) be used, along with lower 2515 layers providing per-packet confidentiality, authentication, 2516 integrity, and replay protection. 2518 Additionally, if the lower layer performs ciphersuite negotiation, it 2519 should be understood that EAP does not provide by itself integrity 2520 protection of that negotiation. Therefore, in order to avoid 2521 downgrading attacks which would lead to weaker ciphersuites being 2522 used, clients implementing lower layer ciphersuite negotiation SHOULD 2523 protect against negotiation downgrading. 2525 This can be done by enabling users to configure which ciphersuites 2526 are acceptable as a matter of security policy, or the ciphersuite 2527 negotiation MAY be authenticated using keying material derived from 2528 the EAP authentication and a MIC algorithm agreed upon in advance by 2529 lower-layer peers. 2531 7.11.1. Legacy Authentication Methods 2533 EAP has a long history, and the early authentication methods have 2534 severe issues. For instance, the MD5-Challenge method uses an 2535 algorithm that has problems described in [RFC6151]. These problems 2536 are particularly pressing, given that MD5-Challenge does not employ a 2537 HMAC construction. The use of MD5-Challenge is NOT RECOMMENDED, at 2538 least not outside an external, tunneled authentication method. 2540 Users and network administrators must be aware of the security issues 2541 in the authentication methods they choose to allow and use. Modern 2542 use of EAP employes typically newer authentication methods such as 2543 Transport Layer Security (EAP-TLS) [I-D.ietf-emu-eap-tls13], Tunnel 2544 Extensible Authentication Protocol (TEAP) [RFC7170], or 3rd 2545 Generation Authentication and Key Agreement (EAP-AKA') 2546 [I-D.ietf-emu-rfc5448bis]. 2548 7.12. Link Layer 2550 There are reliability and security issues with link layer indications 2551 in PPP, IEEE 802 LANs, and IEEE 802.11 wireless LANs: 2553 1. PPP. In PPP, link layer indications such as LCP-Terminate (a 2554 link failure indication) and NCP (a link success indication) are 2555 not authenticated or integrity protected. They can therefore be 2556 spoofed by an attacker with access to the link. 2558 2. IEEE 802. IEEE 802.1X EAPOL-Start and EAPOL-Logoff frames are 2559 not authenticated or integrity protected. They can therefore be 2560 spoofed by an attacker with access to the link. 2562 3. IEEE 802.11. In IEEE 802.11, link layer indications include 2563 Disassociate and Deauthenticate frames (link failure 2564 indications), and the first message of the 4-way handshake (link 2565 success indication). These messages are not authenticated or 2566 integrity protected, and although they are not forwardable, they 2567 are spoofable by an attacker within range. 2569 In IEEE 802.11, IEEE 802.1X data frames may be sent as Class 3 2570 unicast data frames, and are therefore forwardable. This implies 2571 that while EAPOL-Start and EAPOL-Logoff messages may be authenticated 2572 and integrity protected, they can be spoofed by an authenticated 2573 attacker far from the target when "pre-authentication" is enabled. 2575 In IEEE 802.11, a "link down" indication is an unreliable indication 2576 of link failure, since wireless signal strength can come and go and 2577 may be influenced by radio frequency interference generated by an 2578 attacker. To avoid unnecessary resets, it is advisable to damp these 2579 indications, rather than passing them directly to the EAP. Since EAP 2580 supports retransmission, it is robust against transient connectivity 2581 losses. 2583 7.13. Separation of Authenticator and Backend Authentication Server 2585 It is possible for the EAP peer and EAP server to mutually 2586 authenticate and derive a AAA-Key for a ciphersuite used to protect 2587 subsequent data traffic. This does not present an issue on the peer, 2588 since the peer and EAP client reside on the same machine; all that is 2589 required is for the client to derive the AAA-Key from the MSK and 2590 EMSK exported by the EAP method, and to subsequently pass a Transient 2591 Session Key (TSK) to the ciphersuite module. 2593 However, in the case where the authenticator and authentication 2594 server reside on different machines, there are several implications 2595 for security. 2597 1. Authentication will occur between the peer and the authentication 2598 server, not between the peer and the authenticator. This means 2599 that it is not possible for the peer to validate the identity of 2600 the authenticator that it is speaking to, using EAP alone. 2602 2. As discussed in [RFC3579], the authenticator is dependent on the 2603 AAA protocol in order to know the outcome of an authentication 2604 conversation, and does not look at the encapsulated EAP packet 2605 (if one is present) to determine the outcome. In practice, this 2606 implies that the AAA protocol spoken between the authenticator 2607 and authentication server MUST support per-packet authentication, 2608 integrity, and replay protection. 2610 3. After completion of the EAP conversation, where lower layer 2611 security services such as per-packet confidentiality, 2612 authentication, integrity, and replay protection will be enabled, 2613 a secure association protocol SHOULD be run between the peer and 2614 authenticator in order to provide mutual authentication between 2615 the peer and authenticator, guarantee liveness of transient 2616 session keys, provide protected ciphersuite and capabilities 2617 negotiation for subsequent data, and synchronize key usage. 2619 4. A AAA-Key derived from the MSK and/or EMSK negotiated between the 2620 peer and authentication server MAY be transmitted to the 2621 authenticator. Therefore, a mechanism needs to be provided to 2622 transmit the AAA-Key from the authentication server to the 2623 authenticator that needs it. The specification of the AAA-key 2624 derivation, transport, and wrapping mechanisms is outside the 2625 scope of this document. Further details on AAA-Key Derivation 2626 are provided within [RFC5247]. 2628 7.14. Cleartext Passwords 2630 This specification does not define a mechanism for cleartext password 2631 authentication. The omission is intentional. Use of cleartext 2632 passwords would allow the password to be captured by an attacker with 2633 access to a link over which EAP packets are transmitted. 2635 Since protocols encapsulating EAP, such as RADIUS [RFC3579], may not 2636 provide confidentiality, EAP packets may be subsequently encapsulated 2637 for transport over the Internet where they may be captured by an 2638 attacker. 2640 As a result, cleartext passwords cannot be securely used within EAP, 2641 except where encapsulated within a protected tunnel with server 2642 authentication. Some of the same risks apply to EAP methods without 2643 dictionary attack resistance, as defined in Section 7.2.1. For 2644 details, see Section 7.6. 2646 7.15. Channel Binding 2648 It is possible for a compromised or poorly implemented EAP 2649 authenticator to communicate incorrect information to the EAP peer 2650 and/or server. This may enable an authenticator to impersonate 2651 another authenticator or communicate incorrect information via out- 2652 of-band mechanisms (such as via a AAA or lower layer protocol). 2654 Where EAP is used in pass-through mode, the EAP peer typically does 2655 not verify the identity of the pass-through authenticator, it only 2656 verifies that the pass-through authenticator is trusted by the EAP 2657 server. This creates a potential security vulnerability. 2659 Section 4.3.7 of [RFC3579] describes how an EAP pass-through 2660 authenticator acting as a AAA client can be detected if it attempts 2661 to impersonate another authenticator (such by sending incorrect NAS- 2662 Identifier [RFC2865], NAS-IP-Address [RFC2865] or NAS-IPv6-Address 2663 [RFC3162] attributes via the AAA protocol). However, it is possible 2664 for a pass-through authenticator acting as a AAA client to provide 2665 correct information to the AAA server while communicating misleading 2666 information to the EAP peer via a lower layer protocol. 2668 For example, it is possible for a compromised authenticator to 2669 utilize another authenticator's Called-Station-Id or NAS-Identifier 2670 in communicating with the EAP peer via a lower layer protocol, or for 2671 a pass-through authenticator acting as a AAA client to provide an 2672 incorrect peer Calling-Station-Id [RFC2865][RFC3580] to the AAA 2673 server via the AAA protocol. 2675 In order to address this vulnerability, EAP methods may support a 2676 protected exchange of channel properties such as endpoint 2677 identifiers, including (but not limited to): Called-Station-Id 2678 [RFC2865][RFC3580], Calling-Station-Id [RFC2865][RFC3580], NAS- 2679 Identifier [RFC2865], NAS-IP-Address [RFC2865], and NAS-IPv6-Address 2680 [RFC3162]. 2682 Using such a protected exchange, it is possible to match the channel 2683 properties provided by the authenticator via out-of-band mechanisms 2684 against those exchanged within the EAP method. Where discrepancies 2685 are found, these SHOULD be logged; additional actions MAY also be 2686 taken, such as denying access. 2688 7.16. Protected Result Indications 2690 Within EAP, Success and Failure packets are neither acknowledged nor 2691 integrity protected. Result indications improve resilience to loss 2692 of Success and Failure packets when EAP is run over lower layers 2693 which do not support retransmission or synchronization of the 2694 authentication state. In media such as IEEE 802.11, which provides 2695 for retransmission, as well as synchronization of authentication 2696 state via the 4-way handshake defined in [IEEE-802.11i], additional 2697 resilience is typically of marginal benefit. 2699 Depending on the method and circumstances, result indications can be 2700 spoofable by an attacker. A method is said to provide protected 2701 result indications if it supports result indications, as well as the 2702 "integrity protection" and "replay protection" claims. A method 2703 supporting protected result indications MUST indicate which result 2704 indications are protected, and which are not. 2706 Protected result indications are not required to protect against 2707 rogue authenticators. Within a mutually authenticating method, 2708 requiring that the server authenticate to the peer before the peer 2709 will accept a Success packet prevents an attacker from acting as a 2710 rogue authenticator. 2712 However, it is possible for an attacker to forge a Success packet 2713 after the server has authenticated to the peer, but before the peer 2714 has authenticated to the server. If the peer were to accept the 2715 forged Success packet and attempt to access the network when it had 2716 not yet successfully authenticated to the server, a denial of service 2717 attack could be mounted against the peer. After such an attack, if 2718 the lower layer supports failure indications, the authenticator can 2719 synchronize state with the peer by providing a lower layer failure 2720 indication. See Section 7.12 for details. 2722 If a server were to authenticate the peer and send a Success packet 2723 prior to determining whether the peer has authenticated the 2724 authenticator, an idle timeout can occur if the authenticator is not 2725 authenticated by the peer. Where supported by the lower layer, an 2726 authenticator sensing the absence of the peer can free resources. 2728 In a method supporting result indications, a peer that has 2729 authenticated the server does not consider the authentication 2730 successful until it receives an indication that the server 2731 successfully authenticated it. Similarly, a server that has 2732 successfully authenticated the peer does not consider the 2733 authentication successful until it receives an indication that the 2734 peer has authenticated the server. 2736 In order to avoid synchronization problems, prior to sending a 2737 success result indication, it is desirable for the sender to verify 2738 that sufficient authorization exists for granting access, though, as 2739 discussed below, this is not always possible. 2741 While result indications may enable synchronization of the 2742 authentication result between the peer and server, this does not 2743 guarantee that the peer and authenticator will be synchronized in 2744 terms of their authorization or that timeouts will not occur. For 2745 example, the EAP server may not be aware of an authorization decision 2746 made by a AAA proxy; the AAA server may check authorization only 2747 after authentication has completed successfully, to discover that 2748 authorization cannot be granted, or the AAA server may grant access 2749 but the authenticator may be unable to provide it due to a temporary 2750 lack of resources. In these situations, synchronization may only be 2751 achieved via lower layer result indications. 2753 Success indications may be explicit or implicit. For example, where 2754 a method supports error messages, an implicit success indication may 2755 be defined as the reception of a specific message without a preceding 2756 error message. Failures are typically indicated explicitly. As 2757 described in Section 4.2, a peer silently discards a Failure packet 2758 received at a point where the method does not explicitly permit this 2759 to be sent. For example, a method providing its own error messages 2760 might require the peer to receive an error message prior to accepting 2761 a Failure packet. 2763 Per-packet authentication, integrity, and replay protection of result 2764 indications protects against spoofing. Since protected result 2765 indications require use of a key for per-packet authentication and 2766 integrity protection, methods supporting protected result indications 2767 MUST also support the "key derivation", "mutual authentication", 2768 "integrity protection", and "replay protection" claims. 2770 Protected result indications address some denial-of-service 2771 vulnerabilities due to spoofing of Success and Failure packets, 2772 though not all. EAP methods can typically provide protected result 2773 indications only in some circumstances. For example, errors can 2774 occur prior to key derivation, and so it may not be possible to 2775 protect all failure indications. It is also possible that result 2776 indications may not be supported in both directions or that 2777 synchronization may not be achieved in all modes of operation. 2779 For example, within EAP-TLS [RFC5216][I-D.ietf-emu-eap-tls13], in the 2780 client authentication handshake, the server authenticates the peer, 2781 but does not receive a protected indication of whether the peer has 2782 authenticated it. In contrast, the peer authenticates the server and 2783 is aware of whether the server has authenticated it. In the session 2784 resumption handshake, the peer authenticates the server, but does not 2785 receive a protected indication of whether the server has 2786 authenticated it. In this mode, the server authenticates the peer 2787 and is aware of whether the peer has authenticated it. 2789 8. References 2791 8.1. Normative References 2793 [RFC1661] Simpson, W., Ed., "The Point-to-Point Protocol (PPP)", 2794 STD 51, RFC 1661, DOI 10.17487/RFC1661, July 1994, 2795 . 2797 [RFC1994] Simpson, W., "PPP Challenge Handshake Authentication 2798 Protocol (CHAP)", RFC 1994, DOI 10.17487/RFC1994, August 2799 1996, . 2801 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 2802 Requirement Levels", BCP 14, RFC 2119, 2803 DOI 10.17487/RFC2119, March 1997, . 2806 [RFC2243] Metz, C., "OTP Extended Responses", RFC 2243, 2807 DOI 10.17487/RFC2243, November 1997, . 2810 [RFC2289] Haller, N., Metz, C., Nesser, P., and M. Straw, "A One- 2811 Time Password System", STD 61, RFC 2289, 2812 DOI 10.17487/RFC2289, February 1998, . 2815 [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 2816 10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November 2817 2003, . 2819 [RFC6298] Paxson, V., Allman, M., Chu, J., and M. Sargent, 2820 "Computing TCP's Retransmission Timer", RFC 6298, 2821 DOI 10.17487/RFC6298, June 2011, . 2824 [RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for 2825 Writing an IANA Considerations Section in RFCs", BCP 26, 2826 RFC 8126, DOI 10.17487/RFC8126, June 2017, 2827 . 2829 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2830 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 2831 May 2017, . 2833 [IEEE-802] 2834 Institute of Electrical and Electronics Engineers, "Local 2835 and Metropolitan Area Networks: Overview and 2836 Architecture", IEEE Standard 802, 1990. 2838 [IEEE-802.1X] 2839 Institute of Electrical and Electronics Engineers, "Local 2840 and Metropolitan Area Networks: Port-Based Network Access 2841 Control", IEEE Standard 802.1X, January 2020. 2843 [TS.33.501] 2844 3GPP, "Security architecture and procedures for 5G 2845 System", 3GPP TS 33.501 17.0.0, December 2020. 2847 8.2. Informative References 2849 [RFC0793] Postel, J., "Transmission Control Protocol", STD 7, 2850 RFC 793, DOI 10.17487/RFC0793, September 1981, 2851 . 2853 [RFC1510] Kohl, J. and C. Neuman, "The Kerberos Network 2854 Authentication Service (V5)", RFC 1510, 2855 DOI 10.17487/RFC1510, September 1993, . 2858 [RFC1750] Eastlake 3rd, D., Crocker, S., and J. Schiller, 2859 "Randomness Recommendations for Security", RFC 1750, 2860 DOI 10.17487/RFC1750, December 1994, . 2863 [RFC2246] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0", 2864 RFC 2246, DOI 10.17487/RFC2246, January 1999, 2865 . 2867 [RFC2284] Blunk, L. and J. Vollbrecht, "PPP Extensible 2868 Authentication Protocol (EAP)", RFC 2284, 2869 DOI 10.17487/RFC2284, March 1998, . 2872 [RFC2408] Maughan, D., Schertler, M., Schneider, M., and J. Turner, 2873 "Internet Security Association and Key Management Protocol 2874 (ISAKMP)", RFC 2408, DOI 10.17487/RFC2408, November 1998, 2875 . 2877 [RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange 2878 (IKE)", RFC 2409, DOI 10.17487/RFC2409, November 1998, 2879 . 2881 [RFC2433] Zorn, G. and S. Cobb, "Microsoft PPP CHAP Extensions", 2882 RFC 2433, DOI 10.17487/RFC2433, October 1998, 2883 . 2885 [RFC2486] Aboba, B. and M. Beadles, "The Network Access Identifier", 2886 RFC 2486, DOI 10.17487/RFC2486, January 1999, 2887 . 2889 [RFC2607] Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy 2890 Implementation in Roaming", RFC 2607, 2891 DOI 10.17487/RFC2607, June 1999, . 2894 [RFC2661] Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, 2895 G., and B. Palter, "Layer Two Tunneling Protocol "L2TP"", 2896 RFC 2661, DOI 10.17487/RFC2661, August 1999, 2897 . 2899 [RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson, 2900 "Remote Authentication Dial In User Service (RADIUS)", 2901 RFC 2865, DOI 10.17487/RFC2865, June 2000, 2902 . 2904 [RFC3162] Aboba, B., Zorn, G., and D. Mitton, "RADIUS and IPv6", 2905 RFC 3162, DOI 10.17487/RFC3162, August 2001, 2906 . 2908 [RFC3454] Hoffman, P. and M. Blanchet, "Preparation of 2909 Internationalized Strings ("stringprep")", RFC 3454, 2910 DOI 10.17487/RFC3454, December 2002, . 2913 [RFC3579] Aboba, B. and P. Calhoun, "RADIUS (Remote Authentication 2914 Dial In User Service) Support For Extensible 2915 Authentication Protocol (EAP)", RFC 3579, 2916 DOI 10.17487/RFC3579, September 2003, . 2919 [RFC3580] Congdon, P., Aboba, B., Smith, A., Zorn, G., and J. Roese, 2920 "IEEE 802.1X Remote Authentication Dial In User Service 2921 (RADIUS) Usage Guidelines", RFC 3580, 2922 DOI 10.17487/RFC3580, September 2003, . 2925 [RFC3692] Narten, T., "Assigning Experimental and Testing Numbers 2926 Considered Useful", BCP 82, RFC 3692, 2927 DOI 10.17487/RFC3692, January 2004, . 2930 [RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H. 2931 Levkowetz, Ed., "Extensible Authentication Protocol 2932 (EAP)", RFC 3748, DOI 10.17487/RFC3748, June 2004, 2933 . 2935 [RFC4072] Eronen, P., Ed., Hiller, T., and G. Zorn, "Diameter 2936 Extensible Authentication Protocol (EAP) Application", 2937 RFC 4072, DOI 10.17487/RFC4072, August 2005, 2938 . 2940 [RFC4137] Vollbrecht, J., Eronen, P., Petroni, N., and Y. Ohba, 2941 "State Machines for Extensible Authentication Protocol 2942 (EAP) Peer and Authenticator", RFC 4137, 2943 DOI 10.17487/RFC4137, August 2005, . 2946 [RFC4960] Stewart, R., Ed., "Stream Control Transmission Protocol", 2947 RFC 4960, DOI 10.17487/RFC4960, September 2007, 2948 . 2950 [RFC5113] Arkko, J., Aboba, B., Korhonen, J., Ed., and F. Bari, 2951 "Network Discovery and Selection Problem", RFC 5113, 2952 DOI 10.17487/RFC5113, January 2008, . 2955 [RFC5216] Simon, D., Aboba, B., and R. Hurst, "The EAP-TLS 2956 Authentication Protocol", RFC 5216, DOI 10.17487/RFC5216, 2957 March 2008, . 2959 [RFC5247] Aboba, B., Simon, D., and P. Eronen, "Extensible 2960 Authentication Protocol (EAP) Key Management Framework", 2961 RFC 5247, DOI 10.17487/RFC5247, August 2008, 2962 . 2964 [RFC4013] Zeilenga, K., "SASLprep: Stringprep Profile for User Names 2965 and Passwords", RFC 4013, DOI 10.17487/RFC4013, February 2966 2005, . 2968 [RFC6151] Turner, S. and L. Chen, "Updated Security Considerations 2969 for the MD5 Message-Digest and the HMAC-MD5 Algorithms", 2970 RFC 6151, DOI 10.17487/RFC6151, March 2011, 2971 . 2973 [RFC6677] Hartman, S., Ed., Clancy, T., and K. Hoeper, "Channel- 2974 Binding Support for Extensible Authentication Protocol 2975 (EAP) Methods", RFC 6677, DOI 10.17487/RFC6677, July 2012, 2976 . 2978 [RFC6696] Cao, Z., He, B., Shi, Y., Wu, Q., Ed., and G. Zorn, Ed., 2979 "EAP Extensions for the EAP Re-authentication Protocol 2980 (ERP)", RFC 6696, DOI 10.17487/RFC6696, July 2012, 2981 . 2983 [RFC7029] Hartman, S., Wasserman, M., and D. Zhang, "Extensible 2984 Authentication Protocol (EAP) Mutual Cryptographic 2985 Binding", RFC 7029, DOI 10.17487/RFC7029, October 2013, 2986 . 2988 [RFC7170] Zhou, H., Cam-Winget, N., Salowey, J., and S. Hanna, 2989 "Tunnel Extensible Authentication Protocol (TEAP) Version 2990 1", RFC 7170, DOI 10.17487/RFC7170, May 2014, 2991 . 2993 [RFC7296] Kaufman, C., Hoffman, P., Nir, Y., Eronen, P., and T. 2994 Kivinen, "Internet Key Exchange Protocol Version 2 2995 (IKEv2)", STD 79, RFC 7296, DOI 10.17487/RFC7296, October 2996 2014, . 2998 [RFC7613] Saint-Andre, P. and A. Melnikov, "Preparation, 2999 Enforcement, and Comparison of Internationalized Strings 3000 Representing Usernames and Passwords", RFC 7613, 3001 DOI 10.17487/RFC7613, August 2015, . 3004 [RFC8265] Saint-Andre, P. and A. Melnikov, "Preparation, 3005 Enforcement, and Comparison of Internationalized Strings 3006 Representing Usernames and Passwords", RFC 8265, 3007 DOI 10.17487/RFC8265, October 2017, . 3010 [DECEPTION] 3011 Slatalla, M. and J. Quittner, "Masters of Deception", 3012 Harper-Collins New York, 1995. 3014 [KRBATTACK] 3015 Wu, T., "A Real-World Analysis of Kerberos Password 3016 Security", Proceedings of the 1999 ISOC Network and 3017 Distributed System Security Symposium 3018 http://www.isoc.org/isoc/conferences/ndss/99/proceedings/ 3019 papers/wu.pdf. 3021 [KRBLIM] Bellovin, S. and M. Merrit, "Limitations of the Kerberos 3022 authentication system", Proceedings of the 1991 Winter 3023 USENIX Conference pp. 253-267, 1991. 3025 [KERB4WEAK] 3026 Dole, B., Lodin, S., and E. Spafford, "Misplaced trust: 3027 Kerberos 4 session keys", Proceedings of the Internet 3028 Society Network and Distributed System Security 3029 Symposium pp. 60-70, March 1997. 3031 [I-D.ietf-ipsra-pic] 3032 Sheffer, Y., Krawczyk, H., and B. Aboba, "PIC, A Pre-IKE 3033 Credential Provisioning Protocol", draft-ietf-ipsra-pic-05 3034 (work in progress), February 2002. 3036 [PPTPv1] Schneier, B. and Mudge, "Cryptanalysis of Microsoft's 3037 Point-to- Point Tunneling Protocol", Proceedings of the 3038 5th ACM Conference on Communications and Computer 3039 Security ACM Press, November 1998. 3041 [IEEE-802.11] 3042 Institute of Electrical and Electronics Engineers, 3043 "Wireless LAN Medium Access Control (MAC) and Physical 3044 Layer (PHY) Specifications", IEEE Standard 802.11, 1999. 3046 [SILVERMAN] 3047 Silverman, R., "A Cost-Based Security Analysis of 3048 Symmetric and Asymmetric Key Lengths", RSA Laboratories 3049 Bulletin 13 (Revised November 2001) 3050 http://www.rsasecurity.com/rsalabs/bulletins/ 3051 bulletin13.html, April 2000. 3053 [IEEE-802.11i] 3054 Institute of Electrical and Electronics Engineers, 3055 "Unapproved Draft Supplement to Standard for 3056 Telecommunications and Information Exchange Between 3057 Systems - LAN/MAN Specific Requirements - Part 11: 3058 Wireless LAN Medium Access Control (MAC) and Physical 3059 Layer (PHY) Specifications: Specification for Enhanced 3060 Security", IEEE Draft 802.11i (work in progress), 2003. 3062 [I-D.zorn-eap-eval] 3063 Zorn, G., "Specifying Security Claims for EAP 3064 Authentication Types", draft-zorn-eap-eval-00 (work in 3065 progress), October 2002. 3067 [I-D.puthenkulam-eap-binding] 3068 Puthenkulam, J., "The Compound Authentication Binding 3069 Problem", draft-puthenkulam-eap-binding-04 (work in 3070 progress), October 2003. 3072 [MITM] Asokan, N., Niemi, V., and K. Nyberg, "Man-in-the-Middle 3073 in Tunneled Authentication Protocols", IACR ePrint Archive 3074 Report 2002/163 http://eprint.iacr.org/2002/163, October 3075 2002. 3077 [IEEE-802.11i-req] 3078 Stanley, D., "EAP Method Requirements for Wireless LANs", 3079 February 2004. 3081 [PPTPv2] Schneier, B. and Mudge, "Cryptanalysis of Microsoft's PPTP 3082 Authentication Extensions (MS-CHAPv2)", CQRE 99, Springer- 3083 Verlag pp. 192-203, 1999. 3085 [Terminology] 3086 Alissa Cooper et al., , "Inclusive terminology in IETF 3087 Documents", Contribution under the IETF 3088 GitHub https://github.com/ietf/terminology, October 2020. 3090 [W3C] Le Hegaret, P. and C. Mercier, "W3C Manual of Style", W3C 3091 Document https://w3c.github.io/manual-of-style/, January 3092 2021. 3094 [RedHat] Wright, C., "Making open source more inclusive by 3095 eradicating problematic language", RedHat Blog 3096 https://www.redhat.com/en/blog/making-open-source-more- 3097 inclusive-eradicating-problematic-language, January 2021. 3099 [GitLab] Ramsay, J., "Change the default initial branch name for 3100 new projects on GitLab", GitLab issue 221164 3101 https://gitlab.com/gitlab-org/gitlab/-/issues/221164, June 3102 2020. 3104 [Mozilla] Davidson, J., "Replace all user-facing instances that 3105 refer to "master" password", Mozilla Bug 1644807 3106 https://bugzilla.mozilla.org/show_bug.cgi?id=1644807, 3107 November 2016. 3109 [IESG] IESG, , "IESG Statement On Oppressive or Exclusionary 3110 Language", IESG Statement 3111 https://www.ietf.org/about/groups/iesg/statements/ 3112 statement-on-oppressive-exclusionary-language/, July 2020. 3114 [I-D.ietf-emu-eap-tls13] 3115 Mattsson, J. and M. Sethi, "Using EAP-TLS with TLS 1.3", 3116 draft-ietf-emu-eap-tls13-13 (work in progress), November 3117 2020. 3119 [I-D.ietf-emu-rfc5448bis] 3120 Arkko, J., Lehtovirta, V., Torvinen, V., and P. Eronen, 3121 "Improved Extensible Authentication Protocol Method for 3122 3GPP Mobile Network Authentication and Key Agreement (EAP- 3123 AKA')", draft-ietf-emu-rfc5448bis-09 (work in progress), 3124 January 2021. 3126 Appendix A. Changes from RFC 3748 3128 There are no changes with related to interoperability. Minor 3129 changes, including style, grammar, spelling, and editorial changes 3130 are not mentioned here. The only changes are the following: 3132 o The names of the MSK and EMSK terms used to discuss and specify 3133 the protocol have been changed. 3135 o The security considerations note the deficiencies in legacy EAP 3136 methods such as MD5-Challenge in Section 7.11.1, and recommend the 3137 use of more modern authentication methods. 3139 o Ivo Sedlacek's errata on a reference to Section 7.12 rather than 3140 Section 7.2 from Section 3.4 has been adopted. 3142 o IANA rules have been updated to comply with RFC 8126 and current 3143 allocations. 3145 o References have been updated to their most recent versions. 3147 o The security claim perfect forward secrecy has been added. 3149 o References to 3GPP 5G has been added. 3151 o The peer-name portion of the NAI SHOULD be omitted in the EAP- 3152 Response/Identity. 3154 o Since the publication of RFC3748, several documents related to the 3155 core EAP document have been published: [RFC4137] offers a proposed 3156 state machine [RFC5113] defines the network discovery and 3157 selection problem, [RFC5247] specifies the EAP key hierarchy, 3158 [RFC6677] [RFC7029] explores man-in-the-middle attacks and defines 3159 how to implement channel bindings. References to RFC 4137, RFC 3160 5113, RFC 5247, RFC 6677, and RFC 7029 3GPP have been added. 3162 There are still some open questions, however: 3164 o RFC 3748 referred to an early version of the SASLPREP document, 3165 which turned into [RFC4013], then [RFC7613], and is currently 3167 [RFC8265]. Does this still apply? Has something been learned in 3168 the meanwhile about internationalization and passwords? 3170 o Is there a need to update security considerations beyond what was 3171 done already? The is likly more to say about privacy, identity 3172 protection, pervasive monitoring and perfect forward secrecy. 3174 o IEEE references need to be updated to newer ones. Some aspects of 3175 IEEE have changed since 2004 3177 o IEEE links are discussed a lot in the document, and some of 3GPP 3178 link technologies and related EAP methods. Should the document 3179 say something more about 3GPP and 5G? 3181 o Could some sections be replaced by links to RFC 4137, RFC 5113, 3182 RFC 5247, RFC 6677, and RFC 7029? Should the document say more 3183 about RFC 4137, RFC 5113, RFC 5247, RFC 6677, and RFC 7029? 3185 o What other issues have been discussed since since 2004, but not 3186 recorded in errata? 3188 A summary of the changes between RFC 3748 and RFC 2284 were listed in 3189 Appendix A of RFC 3748 [RFC3748] [RFC2284]. 3191 Appendix B. Rationale 3193 In 2020, the Internet Engineering Steering Group (IESG) noted that 3194 terminology used in IETF documents is important [IESG]. When the 3195 objective of an organization is to be inclusive and respectful, 3196 terminology can also have an effect. There are obvious challenges 3197 for creating good terminology for the parts of Internet technology 3198 currently under development, both in a technical sense and in our 3199 ability to agree what terms are inclusive. There are also difficult 3200 tradeoffs related to changing terminology for existing technology, or 3201 for spending valuable effort on terminology vs. other things. 3203 This update is both a refresh of the RFC in general, bringing in the 3204 noted errata, updates to referred documents, but also an update of 3205 the terminology. 3207 With regards to terminology, the authors have worked for a long time 3208 with EAP technology, and continue to make contributions in this 3209 space. In the authors' view, while there is no need for a change, 3210 some of the terms that are used when referring to various parts of 3211 the overall EAP technology could be improved. As a result, the 3212 authors wanted to make a modest proposal for a change that would 3213 improve the terms without changing the associated acronyms, and 3214 enable better use of the terms in future documents. 3216 It should be noted that the issues with EAP terms are minor, compared 3217 many other terminology or other problems with Internet technology. 3218 The authors do not wish to start a big debate; if the WG finds this 3219 useful, we can perhaps make an update and move on. If not, we can 3220 simply move on without making a change. 3222 The specific change that is suggested in this document relates to the 3223 use of the word "master" in various EAP terms. This word is rather 3224 benign when compared to the use of master/slave or black/whitelists, 3225 and other similar terms. Indeed, "master" is commonly used in a 3226 large number of everyday terms. Given this, some authors and 3227 organizations have chosen to make updates only with the most 3228 egregious terms, such as master/slave. 3230 Nevertheless, at least the authors of this document feel that he 3231 would use another word if a different word or term was available. It 3232 should be noted that: 3234 o The slavery-related meaning comes up in any dictionary search for 3235 the word "master". 3237 o The word "master" and some suggested alternatives (such as "main") 3238 are listed in [Terminology]. 3240 o Several organisations have recommended changing the word "master" 3241 in various aspects of their documentation or software. Others are 3242 considering changes. See, for instance, [W3C] [RedHat] [GitLab] 3243 [Mozilla]. 3245 In any case, as noted, this proposal is for the working group to 3246 discuss. Discussion may find that the proposal is considered useful, 3247 unnecessary, or flawed in some fashion. 3249 Appendix C. Acknowledgements 3251 This version of the document is a minor update with respect to RFC 3252 3748. The acknowledgements from RFC 3748 apply: 3254 This protocol derives much of its inspiration from Dave Carrel's 3255 AHA document, as well as the PPP CHAP protocol [RFC1994]. 3256 Valuable feedback was provided by Yoshihiro Ohba of Toshiba 3257 America Research, Jari Arkko of Ericsson, Sachin Seth of 3258 Microsoft, Glen Zorn of Cisco Systems, Jesse Walker of Intel, Bill 3259 Arbaugh, Nick Petroni and Bryan Payne of the University of 3260 Maryland, Steve Bellovin of AT&T Research, Paul Funk of Funk 3261 Software, Pasi Eronen of Nokia, Joseph Salowey of Cisco, Paul 3262 Congdon of HP, and members of the EAP working group. 3264 The use of Security Claims sections for EAP methods, as required 3265 by Section 7.2 and specified for each EAP method described in this 3266 document, was inspired by Glen Zorn through [I-D.zorn-eap-eval]. 3268 The authors of the most recent version of this document would like to 3269 thank Stephen Hayes, Lars Eggert, Mohit Sethi, Alissa Cooper, and Ivo 3270 Sedlacek for englightening discussions and general contributions in 3271 this area. 3273 Authors' Addresses 3275 Bernard Aboba 3276 Microsoft Corporation 3277 USA 3279 Email: bernarda@microsoft.com 3281 Larry J. Blunk 3282 Merit Network, Inc 3283 USA 3285 Email: ljb@merit.edu 3287 John R. Vollbrecht 3288 Vollbrecht Consulting LLC 3289 USA 3291 Email: jrv@umich.edu 3293 James Carlson 3294 Sun Microsystems, Inc 3295 USA 3297 Email: james.d.carlson@sun.com 3299 Henrik Levkowetz 3300 ipUnplugged AB 3301 Sweden 3303 Email: henrik@levkowetz.com 3304 Jari Arkko (Editor) 3305 Ericsson 3306 Jorvas 02420 3307 Finland 3309 Email: jari.arkko@piuha.net 3311 John Mattsson (Editor) 3312 Ericsson 3313 Stockholm 3314 Sweden 3316 Email: john.mattsson@ericsson.com