idnits 2.17.1 draft-ietf-eap-rfc2284bis-05.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Looks like you're using RFC 2026 boilerplate. This must be updated to follow RFC 3978/3979, as updated by RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- == No 'Intended status' indicated for this document; assuming Proposed Standard Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** There are 8 instances of lines with control characters in the document. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year == Line 551 has weird spacing: '...d would need ...' == Line 634 has weird spacing: '...methods origi...' == Line 1358 has weird spacing: '...ed Type of 6 ...' == Line 1436 has weird spacing: '...pe-Data field...' == Line 1756 has weird spacing: '...; or by gener...' -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (September 5, 2003) is 7539 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) -- Looks like a reference, but probably isn't: '1' on line 1749 -- Looks like a reference, but probably isn't: '2' on line 1752 -- Looks like a reference, but probably isn't: '3' on line 1754 -- Looks like a reference, but probably isn't: '4' on line 1759 -- Looks like a reference, but probably isn't: '5' on line 1762 -- Looks like a reference, but probably isn't: '6' on line 1765 -- Looks like a reference, but probably isn't: '7' on line 1768 -- Looks like a reference, but probably isn't: '8' on line 1771 -- Looks like a reference, but probably isn't: '9' on line 1774 == Unused Reference: 'RFC2401' is defined on line 2380, but no explicit reference was found in the text == Unused Reference: 'IEEE-802.3' is defined on line 2447, but no explicit reference was found in the text ** Obsolete normative reference: RFC 1750 (Obsoleted by RFC 4086) ** Obsolete normative reference: RFC 2279 (Obsoleted by RFC 3629) ** Obsolete normative reference: RFC 2434 (Obsoleted by RFC 5226) ** Obsolete normative reference: RFC 2988 (Obsoleted by RFC 6298) -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE-802' -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE-802.1X' -- Obsolete informational reference (is this intentional?): RFC 793 (Obsoleted by RFC 9293) -- Obsolete informational reference (is this intentional?): RFC 1510 (Obsoleted by RFC 4120, RFC 6649) -- Obsolete informational reference (is this intentional?): RFC 2222 (Obsoleted by RFC 4422, RFC 4752) -- Obsolete informational reference (is this intentional?): RFC 2246 (Obsoleted by RFC 4346) -- Obsolete informational reference (is this intentional?): RFC 2284 (Obsoleted by RFC 3748) -- Obsolete informational reference (is this intentional?): RFC 2486 (Obsoleted by RFC 4282) -- Obsolete informational reference (is this intentional?): RFC 2401 (Obsoleted by RFC 4301) -- Obsolete informational reference (is this intentional?): RFC 2408 (Obsoleted by RFC 4306) -- Obsolete informational reference (is this intentional?): RFC 2409 (Obsoleted by RFC 4306) -- Obsolete informational reference (is this intentional?): RFC 2716 (Obsoleted by RFC 5216) -- Obsolete informational reference (is this intentional?): RFC 2960 (Obsoleted by RFC 4960) -- Obsolete informational reference (is this intentional?): RFC 3454 (Obsoleted by RFC 7564) == Outdated reference: A later version (-17) exists of draft-ietf-ipsec-ikev2-10 == Outdated reference: A later version (-05) exists of draft-narten-iana-experimental-allocations-03 == Outdated reference: A later version (-10) exists of draft-ietf-sasl-saslprep-03 == Outdated reference: A later version (-10) exists of draft-ietf-aaa-eap-02 Summary: 6 errors (**), 0 flaws (~~), 13 warnings (==), 25 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 EAP Working Group L. Blunk 3 Internet-Draft Merit Network, Inc 4 Obsoletes: 2284 (if approved) J. Vollbrecht 5 Expires: March 5, 2004 Vollbrecht Consulting LLC 6 B. Aboba 7 Microsoft 8 J. Carlson 9 Sun 10 H. Levkowetz, Ed. 11 ipUnplugged 12 September 5, 2003 14 Extensible Authentication Protocol (EAP) 15 17 Status of this Memo 19 This document is an Internet-Draft and is in full conformance with 20 all provisions of Section 10 of RFC2026. 22 Internet-Drafts are working documents of the Internet Engineering 23 Task Force (IETF), its areas, and its working groups. Note that other 24 groups may also distribute working documents as Internet-Drafts. 26 Internet-Drafts are draft documents valid for a maximum of six months 27 and may be updated, replaced, or obsoleted by other documents at any 28 time. It is inappropriate to use Internet-Drafts as reference 29 material or to cite them other than as "work in progress." 31 The list of current Internet-Drafts can be accessed at http:// 32 www.ietf.org/ietf/1id-abstracts.txt. 34 The list of Internet-Draft Shadow Directories can be accessed at 35 http://www.ietf.org/shadow.html. 37 This Internet-Draft will expire on March 5, 2004. 39 Copyright Notice 41 Copyright (C) The Internet Society (2003). All Rights Reserved. 43 Abstract 45 This document defines the Extensible Authentication Protocol (EAP), 46 an authentication framework which supports multiple authentication 47 methods. EAP typically runs directly over data link layers such as 48 PPP or IEEE 802, without requiring IP. EAP provides its own support 49 for duplicate elimination and retransmission, but is reliant on lower 50 layer ordering guarantees. Fragmentation is not supported within EAP 51 itself; however, individual EAP methods may support this. 53 This document obsoletes RFC 2284. A summary of the changes between 54 this document and RFC 2284 is available in Appendix A. 56 Table of Contents 58 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4 59 1.1 Specification of Requirements . . . . . . . . . . . . 4 60 1.2 Terminology . . . . . . . . . . . . . . . . . . . . . 4 61 1.3 Applicability . . . . . . . . . . . . . . . . . . . . 6 62 2. Extensible Authentication Protocol (EAP) . . . . . . . . . . 7 63 2.1 Support for sequences . . . . . . . . . . . . . . . . 9 64 2.2 EAP multiplexing model . . . . . . . . . . . . . . . . 10 65 2.3 Pass-through behavior . . . . . . . . . . . . . . . . 12 66 2.4 Peer-to-Peer Operation . . . . . . . . . . . . . . . . 13 67 3. Lower layer behavior . . . . . . . . . . . . . . . . . . . . 14 68 3.1 Lower layer requirements . . . . . . . . . . . . . . . 14 69 3.2 EAP usage within PPP . . . . . . . . . . . . . . . . . 16 70 3.2.1 PPP Configuration Option Format . . . . . . . . 17 71 3.3 EAP usage within IEEE 802 . . . . . . . . . . . . . . 17 72 3.4 Lower layer indications . . . . . . . . . . . . . . . 17 73 4. EAP Packet format . . . . . . . . . . . . . . . . . . . . . 18 74 4.1 Request and Response . . . . . . . . . . . . . . . . . 19 75 4.2 Success and Failure . . . . . . . . . . . . . . . . . 22 76 4.3 Retransmission Behavior . . . . . . . . . . . . . . . 24 77 5. Initial EAP Request/Response Types . . . . . . . . . . . . . 25 78 5.1 Identity . . . . . . . . . . . . . . . . . . . . . . . 26 79 5.2 Notification . . . . . . . . . . . . . . . . . . . . . 27 80 5.3 Nak . . . . . . . . . . . . . . . . . . . . . . . . . 28 81 5.3.1 Legacy Nak . . . . . . . . . . . . . . . . . . . 28 82 5.3.2 Expanded Nak . . . . . . . . . . . . . . . . . . 29 83 5.4 MD5-Challenge . . . . . . . . . . . . . . . . . . . . 31 84 5.5 One-Time Password (OTP) . . . . . . . . . . . . . . . 33 85 5.6 Generic Token Card (GTC) . . . . . . . . . . . . . . . 34 86 5.7 Expanded Types . . . . . . . . . . . . . . . . . . . . 35 87 5.8 Experimental . . . . . . . . . . . . . . . . . . . . . 37 88 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . 37 89 6.1 Packet Codes . . . . . . . . . . . . . . . . . . . . . 38 90 6.2 Method Types . . . . . . . . . . . . . . . . . . . . . 38 91 7. Security Considerations . . . . . . . . . . . . . . . . . . 38 92 7.1 Threat model . . . . . . . . . . . . . . . . . . . . . 39 93 7.2 Security claims . . . . . . . . . . . . . . . . . . . 40 94 7.2.1 Security claims terminology for EAP methods . . 41 95 7.3 Identity protection . . . . . . . . . . . . . . . . . 43 96 7.4 Man-in-the-middle attacks . . . . . . . . . . . . . . 43 97 7.5 Packet modification attacks . . . . . . . . . . . . . 44 98 7.6 Dictionary attacks . . . . . . . . . . . . . . . . . . 45 99 7.7 Connection to an untrusted network . . . . . . . . . . 46 100 7.8 Negotiation attacks . . . . . . . . . . . . . . . . . 46 101 7.9 Implementation idiosyncrasies . . . . . . . . . . . . 47 102 7.10 Key derivation . . . . . . . . . . . . . . . . . . . . 47 103 7.11 Weak ciphersuites . . . . . . . . . . . . . . . . . . 48 104 7.12 Link layer . . . . . . . . . . . . . . . . . . . . . . 49 105 7.13 Separation of authenticator and backend authentication 106 server . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 107 7.14 Cleartext Passwords . . . . . . . . . . . . . . . . . 50 108 8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . 51 109 Normative References . . . . . . . . . . . . . . . . . . . . 51 110 Informative References . . . . . . . . . . . . . . . . . . . 52 111 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 55 112 A. Changes from RFC 2284 . . . . . . . . . . . . . . . . . . . 56 113 B. Open issues . . . . . . . . . . . . . . . . . . . . . . . . 57 114 Intellectual Property and Copyright Statements . . . . . . . 59 116 1. Introduction 118 This document defines the Extensible Authentication Protocol (EAP), 119 an authentication framework which supports multiple authentication 120 methods. EAP typically runs directly over data link layers such as 121 PPP or IEEE 802, without requiring IP. EAP provides its own support 122 for duplicate elimination and retransmission, but is reliant on lower 123 layer ordering guarantees. Fragmentation is not supported within EAP 124 itself; however, individual EAP methods may support this. 126 EAP may be used on dedicated links as well as switched circuits, and 127 wired as well as wireless links. To date, EAP has been implemented 128 with hosts and routers that connect via switched circuits or dial-up 129 lines using PPP [RFC1661]. It has also been implemented with switches 130 and access points using IEEE 802 [IEEE-802]. EAP encapsulation on 131 IEEE 802 wired media is described in [IEEE-802.1X], and encapsulation 132 on IEEE wireless LANs in [IEEE-802.11i]. 134 One of the advantages of the EAP architecture is its flexibility. EAP 135 is used to select a specific authentication mechanism, typically 136 after the authenticator requests more information in order to 137 determine the specific authentication method to be used. Rather than 138 requiring the authenticator to be updated to support each new 139 authentication method, EAP permits the use of a backend 140 authentication server which may implement some or all authentication 141 methods, with the authenticator acting as a pass-through for some or 142 all methods and peers. 144 Within this document, authenticator requirements apply regardless of 145 whether the authenticator is operating as a pass-through or not. 146 Where the requirement is meant to apply to either the authenticator 147 or backend authentication server, depending on where the EAP 148 authentication is terminated, the term "EAP server" will be used. 150 1.1 Specification of Requirements 152 In this document, several words are used to signify the requirements 153 of the specification. These words are often capitalized. The key 154 words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", 155 "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document 156 are to be interpreted as described in [RFC2119]. 158 1.2 Terminology 160 This document frequently uses the following terms: 162 authenticator 163 The end of the link initiating EAP authentication. The term 164 Authenticator is used in [IEEE-802.1X], and authenticator 165 has the same meaning in this document. 167 peer 168 The end of the link that responds to the authenticator. In 169 [IEEE-802.1X], this end is known as the Supplicant. 171 backend authentication server 172 A backend authentication server is an entity that provides 173 an authentication service to an authenticator. When used, 174 this server typically executes EAP methods for the 175 authenticator. This terminology is also used in 176 [IEEE-802.1X]. 178 Displayable Message 179 This is interpreted to be a human readable string of 180 characters. The message encoding MUST follow the UTF-8 181 transformation format [RFC2279]. 183 EAP server 184 The entity that terminates the EAP authentication method 185 with the peer. In the case where no backend authentication 186 server is used, the EAP server is part of the 187 authenticator. In the case where the authenticator 188 operates in pass-through mode, the EAP server is located on 189 the backend authentication server. 191 Silently Discard 192 This means the implementation discards the packet without 193 further processing. The implementation SHOULD provide the 194 capability of logging the event, including the contents of 195 the silently discarded packet, and SHOULD record the event 196 in a statistics counter. 198 Successful authentication 199 In the context of this document, "successful 200 authentication" is an exchange of EAP messages, as a result 201 of which the authenticator decides to allow access by the 202 peer, and the peer decides to use this access. The 203 authenticator's decision typically involves both 204 authentication and authorization aspects; the peer may 205 successfully authenticate to the authenticator but access 206 may be denied by the authenticator due to policy reasons. 208 Message Integrity Check (MIC) 209 A keyed hash function used for authentication and integrity 210 protection of data. This is usually called a Message 211 Authentication Code (MAC), but IEEE 802 specifications (and 212 this document) use the acronym MIC to avoid confusion with 213 Medium Access Control. 215 Cryptographic separation 216 Two keys (x and y) are "cryptographically separate" if an 217 adversary that knows all messages exchanged in the protocol 218 cannot compute x from y or y from x without "breaking" some 219 cryptographic assumption. In particular, this definition 220 allows that the adversary has the knowledge of all nonces 221 sent in cleartext as well as all predictable counter values 222 used in the protocol. Breaking a cryptographic assumption 223 would typically require inverting a one-way function or 224 predicting the outcome of a cryptographic pseudo-random 225 number generator without knowledge of the secret state. In 226 other words, if the keys are cryptographically separate, 227 there is no shortcut to compute x from y or y from x, but 228 the work an adversary must do to perform this computation 229 is equivalent to performing exhaustive search for the 230 secret state value. 232 Master Session Key (MSK) 233 Keying material that is derived between the EAP peer and 234 server and exported by the EAP method. The MSK is used in 235 the derivation of Transient Session Keys (TSKs) for the 236 ciphersuite negotiated between the EAP peer and 237 authenticator. Where a backend authentication server is 238 present, acting as an EAP server, it will typically 239 transport the MSK to the authenticator, so that in this 240 case, the MSK is available to the peer, authenticator and 241 authentication server. 243 Extended Master Session Key (EMSK) 244 Additional keying material derived between the EAP client 245 and server that is exported by the EAP method. Unlike the 246 MSK, the EMSK is known only to the EAP peer and EAP server 247 and is not provided to a third party. The EMSK is reserved 248 for future uses that are not defined yet. For example, it 249 could be used to derive additional keying material for 250 purposes such as fast handoff, cryptographic binding, etc. 252 1.3 Applicability 254 EAP is an authentication framework primarily for use in situations 255 such as network access, in which IP layer connectivity may not be 256 available. 258 Since the goal of EAP is to support authentication without requiring 259 IP connectivity, it provides just enough support for the reliable 260 transport of authentication protocols, and no more. EAP is a 261 lock-step protocol and does not support an efficient reliable 262 transport service as in TCP [RFC793] or SCTP [RFC2960]. While EAP 263 provides support for retransmission, it assumes ordering guarantees 264 provided by the lower layer, so that out of order reception is not 265 supported. 267 As noted in Section 3.1, EAP does not support fragmentation and 268 reassembly as in IP, although EAP methods may provide support for 269 this. As a result, authentication protocols generating payloads 270 larger than the EAP MTU will need to be modified in order to provide 271 fragmentation support. 273 EAP authentication is initiated by the authenticator, whereas many 274 authentication protocols are initiated by the client (peer). As a 275 result, it may be necessary for an algorithm to add 0.5 - 1 276 additional roundtrips between the client and authenticator in order 277 to run over EAP. 279 As a result, an authentication algorithm will typically require more 280 round-trips when run over EAP than when run directly over IP. 281 Additionally, certificate-based authentication algorithms using long 282 certificate chains can result in many round-trips due to 283 fragmentation. 285 Where EAP runs over a lower layer in which significant packet loss is 286 experienced, or where the connection between the authenticator and 287 authentication server experiences significant packet loss, EAP 288 methods requiring many round-trips may experience difficulties. In 289 these situations, use of EAP methods with fewer round trips is 290 advisable. 292 Where transport efficiency is a consideration, and IP transport is 293 available, it may be preferable to expose an artificially high EAP 294 MTU to EAP and allow fragmentation to take place in IP. 295 Alternatively, it is possible to choose other security mechanisms 296 such as TLS [RFC2246] or IKE [RFC2409] or an alternative 297 authentication framework such as SASL [RFC2222] or GSS-API [RFC2743]. 299 2. Extensible Authentication Protocol (EAP) 301 The EAP authentication exchange proceeds as follows: 303 [1] The authenticator sends a Request to authenticate the peer. The 304 Request has a Type field to indicate what is being requested. 305 Examples of Request Types include Identity, MD5-challenge, etc. 306 The MD5-challenge Type corresponds closely to the CHAP 307 authentication protocol [RFC1994]. Typically, the authenticator 308 will send an initial Identity Request; however, an initial 309 Identity Request is not required, and MAY be bypassed. For 310 example, the identity may not be required where it is determined 311 by the port to which the peer has connected (leased lines, 312 dedicated switch or dial-up ports); or where the identity is 313 obtained in another fashion (via calling station identity or MAC 314 address, in the Name field of the MD5-Challenge Response, etc.). 316 [2] The peer sends a Response packet in reply to a valid Request. As 317 with the Request packet the Response packet contains a Type 318 field, which corresponds to the Type field of the Request. 320 [3] The authenticator sends an additional Request packet, and the 321 peer replies with a Response. The sequence of Requests and 322 Responses continues as long as needed. EAP is a 'lock step' 323 protocol, so that other than the initial Request, a new Request 324 cannot be sent prior to receiving a valid Response. The 325 authenticator is responsible for retransmitting requests as 326 described in Section 4.1. After a suitable number of 327 retransmissions, the authenticator SHOULD end the EAP 328 conversation. The authenticator MUST NOT send a Success or 329 Failure packet when retransmitting or when it fails to get a 330 response from the peer. 332 [4] The conversation continues until the authenticator cannot 333 authenticate the peer (unacceptable Responses to one or more 334 Requests), in which case the authenticator implementation MUST 335 transmit an EAP Failure (Code 4). Alternatively, the 336 authentication conversation can continue until the authenticator 337 determines that successful authentication has occurred, in which 338 case the authenticator MUST transmit an EAP Success (Code 3). 340 Advantages: 342 o The EAP protocol can support multiple authentication mechanisms 343 without having to pre-negotiate a particular one. 345 o Network Access Server (NAS) devices (e.g., a switch or access 346 point) do not have to understand each authentication method and 347 MAY act as a pass-through agent for a backend authentication 348 server. Support for pass-through is optional. An authenticator 349 MAY authenticate local peers while at the same time acting as a 350 pass-through for non-local peers and authentication methods it 351 does not implement locally. 353 o Separation of the authenticator from the backend authentication 354 server simplifies credentials management and policy decision 355 making. 357 Disadvantages: 359 o For use in PPP, EAP does require the addition of a new 360 authentication Type to PPP LCP and thus PPP implementations will 361 need to be modified to use it. It also strays from the previous 362 PPP authentication model of negotiating a specific authentication 363 mechanism during LCP. Similarly, switch or access point 364 implementations need to support [IEEE-802.1X] in order to use EAP. 366 o Where the authenticator is separate from the backend 367 authentication server, this complicates the security analysis and, 368 if needed, key distribution. 370 2.1 Support for sequences 372 An EAP conversation MAY utilize a sequence of methods. A common 373 example of this is an Identity request followed by a single EAP 374 authentication method such as an MD5-Challenge. However the peer and 375 authenticator MUST utilize only one authentication method (Type 4 or 376 greater) within an EAP conversation, after which the authenticator 377 MUST send a Success or Failure packet. 379 Once a peer has sent a Response of the same Type as the initial 380 Request, an authenticator MUST NOT send a Request of a different Type 381 prior to completion of the final round of a given method (with the 382 exception of a Notification-Request) and MUST NOT send a Request for 383 an additional method of any Type after completion of the initial 384 authentication method; a peer receiving such Requests MUST treat them 385 as invalid, and silently discard them. As a result, Identity Requery 386 is not supported. 388 A peer MUST NOT send a Nak (legacy or expanded) in reply to a 389 Request, after an initial non-Nak Response has been sent. Since 390 spoofed EAP Request packets may be sent by an attacker, an 391 authenticator receiving an unexpected Nak SHOULD discard it and log 392 the event. 394 Multiple authentication methods within an EAP conversation are not 395 supported due to their vulnerability to man-in-the-middle attacks 396 (see Section 7.4) and incompatibility with existing implementations. 398 Where a single EAP authentication method is utilized, but other 399 methods are run within it (a "tunneled" method) the prohibition 400 against multiple authentication methods does not apply. Such 401 "tunneled" methods appear as a single authentication method to EAP. 402 Backward compatibility can be provided, since a peer not supporting a 403 "tunneled" method can reply to the initial EAP-Request with a Nak 404 (legacy or expanded). To address security vulnerabilities, 405 "tunneled" methods MUST support protection against man-in-the-middle 406 attacks. 408 2.2 EAP multiplexing model 410 Conceptually, EAP implementations consist of the following 411 components: 413 [a] Lower layer. The lower layer is responsible for transmitting and 414 receiving EAP frames between the peer and authenticator. EAP has 415 been run over a variety of lower layers including PPP; wired IEEE 416 802 LANs [IEEE-802.1X]; IEEE 802.11 wireless LANs [IEEE-802.11]; 417 UDP (L2TP [RFC2661] and ISAKMP [IKEv2]); and TCP [IKEv2]. Lower 418 layer behavior is discussed in Section 3. 420 [b] EAP layer. The EAP layer receives and transmits EAP packets via 421 the lower layer, implements duplicate detection and 422 retransmission, and delivers and receives EAP messages to and 423 from EAP methods. 425 [c] EAP method. EAP methods implement the authentication algorithms 426 and receive and transmit EAP messages via the EAP layer. Since 427 fragmentation support is not provided by EAP itself, this is the 428 responsibility of EAP methods, which are discussed in Section 5. 430 The EAP multiplexing model is illustrated in Figure 1 below. Note 431 that there is no requirement that an implementation conform to this 432 model, as long as the on-the-wire behavior is consistent with it. 434 +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ 435 | | | | | | 436 | EAP method| EAP method| | EAP method| EAP method| 437 | Type = X | Type = Y | | Type = X | Type = Y | 438 | V | | | ^ | | 439 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 440 | ! | | ! | 441 | EAP ! Layer | | EAP ! Layer | 442 | ! | | ! | 443 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 444 | ! | | ! | 445 | Lower ! Layer | | Lower ! Layer | 446 | ! | | ! | 447 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 448 ! ! 449 ! Peer ! Authenticator 450 +------------>-------------+ 452 Figure 1: EAP Multiplexing Model 454 Within EAP, the Type field functions much like a port number in UDP 455 or TCP. It is assumed that the EAP layer multiplexes incoming EAP 456 packets according to their Type, and delivers them only to the EAP 457 method corresponding to that Type code. 459 Since EAP authentication methods may wish to access the Identity, 460 implementations SHOULD make the Identity Request and Response 461 accessible to authentication methods (Types 4 or greater) in addition 462 to the Identity method. The Identity Type is discussed in Section 463 5.1. 465 A Notification Response is only used as confirmation that the peer 466 received the Notification Request, not that it has processed it, or 467 displayed the message to the user. It cannot be assumed that the 468 contents of the Notification Request or Response is available to 469 another method. The Notification Type is discussed in Section 5.2. 471 Nak (Type 3) or Expanded Nak (Type 254) are utilized for the purposes 472 of method negotiation. Peers respond to an initial EAP Request for 473 an unacceptable Type with a Nak Response (Type 3) or Expanded Nak 474 Response (Type 254). It cannot be assumed that the contents of the 475 Nak Response(s) are available to another method. The Nak Type(s) are 476 discussed in Section 5.3. 478 EAP packets with codes of Success or Failure do not include a Type, 479 and are not delivered to an EAP method. Success and Failure are 480 discussed in Section 4.2. 482 Given these considerations, the Success, Failure, Nak Response(s) and 483 Notification Request/Response messages MUST NOT be used to carry data 484 destined for delivery to other EAP methods. 486 2.3 Pass-through behavior 488 Where an authenticator operates as a pass-through, it forwards 489 packets back and forth between the peer and a backend authentication 490 server, based on the EAP layer header fields (Code, Identifier, 491 Length). This includes performing validity checks on the Code, 492 Identifier and Length fields, as described in Section 4.1. 494 Since pass-through authenticators rely on a backend authenticator 495 server to implement methods, the EAP method layer header fields 496 (Type, Type-Data) are not examined as part of the forwarding 497 decision. The forwarding model is illustrated in Figure 2. Compliant 498 pass-through authenticator implementations MUST by default be capable 499 of forwarding packets from any EAP method. The use of the RADIUS 500 protocol for encapsulation of EAP in pass-through operation is 501 described in [RFC3579]. 503 Peer Pass-through Authenticator Authentication 504 Server 506 +-+-+-+-+-+-+ +-+-+-+-+-+-+ 507 | | | | 508 |EAP method | |EAP method | 509 | V | | ^ | 510 +-+-+-!-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-!-+-+-+ 511 | ! | | | | | ! | 512 |EAP !layer| | EAP layer | EAP layer | |EAP !layer| 513 | ! | | +-----+-----+ | | ! | 514 | ! | | ! | ! | | ! | 515 +-+-+-!-+-+-+ +-+-+-!-+-+-+-+-+-!-+-+-+ +-+-+-!-+-+-+ 516 | ! | | ! | ! | | ! | 517 |Lower!layer| |Lower!layer| AAA ! /IP | | AAA ! /IP | 518 | ! | | ! | ! | | ! | 519 +-+-+-!-+-+-+ +-+-+-!-+-+-+-+-+-!-+-+-+ +-+-+-!-+-+-+ 520 ! ! ! ! 521 ! ! ! ! 522 +-------->-----+ +------->------+ 524 Figure 2: Pass-through Authenticator 526 For sessions in which the authenticator acts as a pass-through, it 527 MUST determine the outcome of the authentication solely based on the 528 Accept/Reject indication sent by the backend authentication server; 529 the outcome MUST NOT be determined by the contents of an EAP packet 530 sent along with the Accept/Reject indication, or the absence of such 531 an encapsulated EAP packet. 533 2.4 Peer-to-Peer Operation 535 Since EAP is a peer-to-peer protocol, an independent and simultaneous 536 authentication may take place in the reverse direction (depending on 537 the capabilities of the lower layer). Both peers may act as 538 authenticators and authenticatees at the same time. 540 Although EAP supports peer-to-peer operation, selected EAP methods, 541 AAA protocols and link layers may not support this. For example, 542 EAP-TLS [RFC2716] is a client-server protocol requiring a different 543 certificate profile for the client and server. This implies that a 544 host supporting both the EAP-TLS peer and authenticator roles would 545 need to be provisioned with two distinct certificates, one 546 appropriate for each role. 548 Some EAP methods may support asymmetric authentication, with one type 549 of credential being required for the peer and another type for the 550 authenticator. Hosts supporting peer-to-peer operation with such a 551 method would need to be provisioned with both types of credentials. 553 AAA protocols such as RADIUS/EAP [RFC3579] and Diameter EAP 554 [DIAM-EAP] only support "passthrough" operation on behalf of an 555 authenticator, not a peer. For example, as noted in [RFC3579] Section 556 2.6.2, a RADIUS server responds to an Access-Request encapsulating an 557 EAP-Request with an Access-Reject. 559 Link layers such as IEEE 802.11 may only support uni-directional 560 derivation and transport of transient session keys. For example, the 561 group-key handshake defined in [IEEE-802.11i] is uni-directional, 562 since in IEEE 802.11 only the Access Point (AP) sends multicast 563 traffic. This means that in ad-hoc operation where either peer may 564 send multicast traffic, two uni-directional group-key exchanges are 565 required. Due to constraints imposed by the 4-way unicast key 566 handshake state machine, this also implies two 4-way handshake and 567 EAP method exchanges. 569 Link layers such as IEEE 802.11 adhoc also do not support "tie 570 breaking" wherein two hosts initiating authentication with each other 571 will only go forward with a single authentication. This implies that 572 even if 802.11 were to support a bi-directional group-key handshake, 573 then two authentications, one in each direction, might still occur. 575 3. Lower layer behavior 577 3.1 Lower layer requirements 579 EAP makes the following assumptions about lower layers: 581 [1] Unreliable transport. In EAP, the authenticator retransmits 582 Requests that have not yet received Responses, so that EAP does 583 not assume that lower layers are reliable. Since EAP defines its 584 own retransmission behavior, it is possible (though undesirable) 585 for retransmission to occur both in the lower layer and the EAP 586 layer when EAP is run over a reliable lower layer. 588 Note that EAP Success and Failure packets are not retransmitted. 589 Without a reliable lower layer, and a non-negligible error rate, 590 these packets can be lost, resulting in timeouts. It is therefore 591 desirable for implementations to improve their resilience to loss 592 of EAP Success or Failure packets, as described in Section 4.2. 594 [2] Lower layer error detection. While EAP does not assume that the 595 lower layer is reliable, it does rely on lower layer error 596 detection (e.g., CRC, Checksum, MIC, etc.). EAP methods may not 597 include a MIC, or if they do, it may not be computed over all the 598 fields in the EAP packet, such as the Code, Identifier, Length or 599 Type fields. As a result, without lower layer error detection, 600 undetected errors could creep into the EAP layer or EAP method 601 layer header fields, resulting in authentication failures. 603 For example, EAP TLS [RFC2716], which computes its MIC over the 604 Type-Data field only, regards MIC validation failures as a fatal 605 error. Without lower layer error detection, this method and 606 others like it will not perform reliably. 608 [3] Lower layer security. EAP assumes that lower layers either 609 provide physical security (e.g., wired PPP or IEEE 802 links) or 610 support per-packet authentication, integrity and replay 611 protection. EAP SHOULD NOT be used on physically insecure links 612 (e.g., wireless or the Internet) where subsequent data is not 613 protected by per-packet authentication, integrity and replay 614 protection. 616 [4] Minimum MTU. EAP is capable of functioning on lower layers that 617 provide an EAP MTU size of 1020 octets or greater. 619 EAP does not support path MTU discovery, and fragmentation and 620 reassembly is not supported by EAP, nor by the methods defined in 621 this specification: the Identity (1), Notification (2), Nak 622 Response (3), MD5-Challenge (4), One Time Password (5), Generic 623 Token Card (6) and expanded Nak Response (254) Types. 625 Typically, the EAP peer obtains information on the EAP MTU from 626 the lower layers and sets the EAP frame size to an appropriate 627 value. Where the authenticator operates in pass-through mode, 628 the authentication server does not have a direct way of 629 determining the EAP MTU, and therefore relies on the 630 authenticator to provide it with this information, such as via 631 the Framed-MTU attribute, as described in [RFC3579], Section 2.4. 633 While methods such as EAP-TLS [RFC2716] support fragmentation and 634 reassembly, EAP methods originally designed for use within PPP 635 where a 1500 octet MTU is guaranteed for control frames (see 636 [RFC1661], Section 6.1) may lack fragmentation and reassembly 637 features. 639 EAP methods can assume a minimum EAP MTU of 1020 octets, in the 640 absence of other information. EAP methods SHOULD include support 641 for fragmentation and reassembly if their payloads can be larger 642 than this minimum EAP MTU. 644 EAP is a lock-step protocol, which implies a certain inefficiency 645 when handling fragmentation and reassembly. Therefore if the 646 lower layer supports fragmentation and reassembly (such as where 647 EAP is transported over IP), it may be preferable for 648 fragmentation and reassembly to occur in the lower layer rather 649 than in EAP. This can be accomplished by providing an 650 artificially large EAP MTU to EAP, causing fragmentation and 651 reassembly to be handled within the lower layer. 653 [5] Possible duplication. Where the lower layer is reliable, it will 654 provide the EAP layer with a non-duplicated stream of packets. 655 However, while it is desirable that lower layers provide for 656 non-duplication, this is not a requirement. The Identifier field 657 provides both the peer and authenticator with the ability to 658 detect duplicates. 660 [6] Ordering guarantees. EAP does not require the Identifier to be 661 monotonically increasing, and so is reliant on lower layer 662 ordering guarantees for correct operation. EAP was originally 663 defined to run on PPP, and [RFC1661] Section 1 has an ordering 664 requirement: 666 "The Point-to-Point Protocol is designed for simple links 667 which transport packets between two peers. These links 668 provide full-duplex simultaneous bi-directional operation, and 669 are assumed to deliver packets in order." 671 Lower layer transports for EAP MUST preserve ordering between a 672 source and destination, at a given priority level (the ordering 673 guarantee provided by [IEEE-802]). 675 3.2 EAP usage within PPP 677 In order to establish communications over a point-to-point link, each 678 end of the PPP link must first send LCP packets to configure the data 679 link during Link Establishment phase. After the link has been 680 established, PPP provides for an optional Authentication phase before 681 proceeding to the Network-Layer Protocol phase. 683 By default, authentication is not mandatory. If authentication of 684 the link is desired, an implementation MUST specify the 685 Authentication Protocol Configuration Option during Link 686 Establishment phase. 688 If the identity of the peer has been established in the 689 Authentication phase, the server can use that identity in the 690 selection of options for the following network layer negotiations. 692 When implemented within PPP, EAP does not select a specific 693 authentication mechanism at PPP Link Control Phase, but rather 694 postpones this until the Authentication Phase. This allows the 695 authenticator to request more information before determining the 696 specific authentication mechanism. This also permits the use of a 697 "backend" server which actually implements the various mechanisms 698 while the PPP authenticator merely passes through the authentication 699 exchange. The PPP Link Establishment and Authentication phases, and 700 the Authentication Protocol Configuration Option, are defined in The 701 Point-to-Point Protocol (PPP) [RFC1661]. 703 3.2.1 PPP Configuration Option Format 705 A summary of the PPP Authentication Protocol Configuration Option 706 format to negotiate EAP is shown below. The fields are transmitted 707 from left to right. 709 Exactly one EAP packet is encapsulated in the Information field of a 710 PPP Data Link Layer frame where the protocol field indicates type hex 711 C227 (PPP EAP). 713 0 1 2 3 714 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 715 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 716 | Type | Length | Authentication Protocol | 717 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 719 Type 721 3 723 Length 725 4 727 Authentication Protocol 729 C227 (Hex) for Extensible Authentication Protocol (EAP) 731 3.3 EAP usage within IEEE 802 733 The encapsulation of EAP over IEEE 802 is defined in [IEEE-802.1X]. 734 The IEEE 802 encapsulation of EAP does not involve PPP, and IEEE 735 802.1X does not include support for link or network layer 736 negotiations. As a result, within IEEE 802.1X it is not possible to 737 negotiate non-EAP authentication mechanisms, such as PAP or CHAP 738 [RFC1994]. 740 3.4 Lower layer indications 742 The reliability and security of lower layer indications is dependent 743 on the lower layer. Since EAP is media independent, the presence or 744 absence of lower layer security is not taken into account in the 745 processing of EAP messages. 747 To improve reliability, if a peer receives a lower layer success 748 indication as defined in Section 7.2, it MAY conclude that a Success 749 packet has been lost, and behave as it had actually received a 750 Success packet. This includes choosing to ignore the Success in some 751 circumstances as described in Section 4.2. 753 A discussion of some reliability and security issues with lower layer 754 indications in PPP, IEEE 802 wired networks and IEEE 802.11 wireless 755 LANs can be found in the Security Considerations, Section 7.12. 757 After EAP authentication is complete, the peer will typically 758 transmit data to the network via the authenticator. In order to 759 provide assurance that the peer transmitting data is the same entity 760 that successfully completed EAP authentication, the lower layer needs 761 to bind per-packet integrity, authentication and replay protection to 762 the original EAP authentication, using keys derived during EAP 763 authentication. Alternatively, the lower layer needs to be 764 physically secure. Otherwise it is possible for subsequent data 765 traffic to be hijacked or replayed. 767 As a result of these considerations, EAP SHOULD be used only when 768 lower layers provide physical security for data (e.g., wired PPP or 769 IEEE 802 links), or for insecure links, where per-packet 770 authentication, integrity and replay protection is provided. 772 Where keying material for the lower layer ciphersuite is itself 773 provided by EAP, ciphersuite negotiation and key activation is 774 controlled by the lower layer. In PPP, ciphersuites are negotiated 775 within ECP so that it is not possible to use keys derived from EAP 776 authentication until the completion of ECP. Therefore an initial EAP 777 exchange cannot protected by a PPP ciphersuite, although EAP 778 re-authentication can be protected. 780 In IEEE 802 media, initial key activation also typically occurs after 781 completion of EAP authentication. Therefore an initial EAP exchange 782 typically cannot be protected by the lower layer ciphersuite, 783 although an EAP re-authentication or pre-authentication exchange can 784 be protected. 786 4. EAP Packet format 787 A summary of the EAP packet format is shown below. The fields are 788 transmitted from left to right. 790 0 1 2 3 791 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 792 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 793 | Code | Identifier | Length | 794 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 795 | Data ... 796 +-+-+-+-+ 798 Code 800 The Code field is one octet and identifies the Type of EAP packet. 801 EAP Codes are assigned as follows: 803 1 Request 804 2 Response 805 3 Success 806 4 Failure 808 Since EAP only defines Codes 1-4, EAP packets with other codes 809 MUST be silently discarded by both authenticators and peers. 811 Identifier 813 The Identifier field is one octet and aids in matching Responses 814 with Requests. 816 Length 818 The Length field is two octets and indicates the length of the EAP 819 packet including the Code, Identifier, Length and Data fields. 820 Octets outside the range of the Length field should be treated as 821 Data Link Layer padding and MUST be ignored on reception. A 822 message with the Length field set to a value larger than the 823 number of received octets MUST be silently discarded. 825 Data 827 The Data field is zero or more octets. The format of the Data 828 field is determined by the Code field. 830 4.1 Request and Response 831 Description 833 The Request packet (Code field set to 1) is sent by the 834 authenticator to the peer. Each Request has a Type field which 835 serves to indicate what is being requested. Additional Request 836 packets MUST be sent until a valid Response packet is received, or 837 an optional retry counter expires. 839 Retransmitted Requests MUST be sent with the same Identifier value 840 in order to distinguish them from new Requests. The content of the 841 data field is dependent on the Request Type. The peer MUST send a 842 Response packet in reply to a valid Request packet. Responses 843 MUST only be sent in reply to a valid Request and never 844 retransmitted on a timer. 846 If a peer receives a valid duplicate Request for which it has 847 already sent a Response, it MUST resend its original Response 848 without reprocessing the Request. Requests MUST be processed in 849 the order that they are received, and MUST be processed to their 850 completion before inspecting the next Request. 852 A summary of the Request and Response packet format is shown below. 853 The fields are transmitted from left to right. 855 0 1 2 3 856 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 857 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 858 | Code | Identifier | Length | 859 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 860 | Type | Type-Data ... 861 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 863 Code 865 1 for Request 866 2 for Response 868 Identifier 870 The Identifier field is one octet. The Identifier field MUST be 871 the same if a Request packet is retransmitted due to a timeout 872 while waiting for a Response. Any new (non-retransmission) 873 Requests MUST modify the Identifier field. 875 The Identifier field of the Response MUST match that of the 876 currently outstanding Request. An authenticator receiving a 877 Response whose Identifier value does not match that of the 878 currently outstanding Request MUST silently discard the Response. 880 In order to avoid confusion between new Requests and 881 retransmissions, the Identifier value chosen for each new Request 882 need only be different from the previous Request, but need not be 883 unique within the conversation. One way to achieve this is to 884 start the Identifier at an initial value and increment it for each 885 new Request. Initializing the first Identifier with a random 886 number rather than starting from zero is recommended, since it 887 makes sequence attacks somewhat harder. 889 Since the Identifier space is unique to each session, 890 authenticators are not restricted to only 256 simultaneous 891 authentication conversations. Similarly, with re-authentication, 892 an EAP conversation might continue over a long period of time, and 893 is not limited to only 256 roundtrips. 895 Implementation Note: The authenticator is responsible for 896 retransmitting Request messages. If the Request message is 897 obtained from elsewhere (such as from a backend authentication 898 server), then the authenticator will need to save a copy of the 899 Request in order to accomplish this. The peer is responsible 900 for detecting and handling duplicate Request messages before 901 processing them in any way, including passing them on to an 902 outside party. The authenticator is also responsible for 903 discarding Response messages with a non-matching Identifier 904 value before acting on them in any way, including passing them 905 on to the backend authentication server for verification. 906 Since the authenticator can retransmit before receiving a 907 Response from the peer, the authenticator can receive multiple 908 Responses, each with a matching Identifier. Until a new Request 909 is received by the authenticator, the Identifier value is not 910 updated, so that the authenticator forwards Responses to the 911 backend authentication server, one at a time. 913 Length 915 The Length field is two octets and indicates the length of the EAP 916 packet including the Code, Identifier, Length, Type, and Type-Data 917 fields. Octets outside the range of the Length field should be 918 treated as Data Link Layer padding and MUST be ignored on 919 reception. A message with the Length field set to a value larger 920 than the number of received octets MUST be silently discarded. 922 Type 924 The Type field is one octet. This field indicates the Type of 925 Request or Response. A single Type MUST be specified for each EAP 926 Request or Response. An initial specification of Types follows in 927 Section 5 of this document. 929 The Type field of a Response MUST either match that of the 930 Request, or correspond to a legacy or Expanded Nak (see Section 931 5.3) indicating that a Request Type is unacceptable to the peer. 932 A peer MUST NOT send a Nak (legacy or expanded) in response to a 933 Request, after an initial non-Nak Response has been sent. An EAP 934 server receiving a Response not meeting these requirements MUST 935 silently discard it. 937 Type-Data 939 The Type-Data field varies with the Type of Request and the 940 associated Response. 942 4.2 Success and Failure 944 The Success packet is sent by the authenticator to the peer after 945 completion of an EAP authentication method (Type 4 or greater), to 946 indicate that the peer has authenticated successfully to the 947 authenticator. The authenticator MUST transmit an EAP packet with 948 the Code field set to 3 (Success). If the authenticator cannot 949 authenticate the peer (unacceptable Responses to one or more 950 Requests) then after unsuccessful completion of the EAP method in 951 progress, the implementation MUST transmit an EAP packet with the 952 Code field set to 4 (Failure). An authenticator MAY wish to issue 953 multiple Requests before sending a Failure response in order to allow 954 for human typing mistakes. Success and Failure packets MUST NOT 955 contain additional data. 957 Success and Failure packets MUST NOT be sent by an EAP authenticator 958 if the specification of the given method does not explicitly permit 959 the method to finish at that point. A peer EAP implementation 960 receiving a Success or Failure packet where sending one is not 961 explicitly permitted MUST silently discard it. By default, an EAP 962 peer MUST silently discard a "canned" Success packet (a Success 963 packet sent immediately upon connection). This ensures that a rogue 964 authenticator will not be able to bypass mutual authentication by 965 sending a Success packet prior to conclusion of the EAP method 966 conversation. 968 Implementation Note: Because the Success and Failure packets are 969 not acknowledged, they are not retransmitted by the authenticator, 970 and may be potentially lost. A peer MUST allow for this 971 circumstance as described in this note. See also Section 3.4 for 972 guidance on the processing of lower layer success and failure 973 indications. 975 As described in Section 2.1, only a single EAP authentication 976 method is allowed within an EAP conversation. EAP methods MAY 977 implement acknowledged result indications. After the authenticator 978 sends a method-specific failure indication to the peer, regardless 979 of the response from the peer, it MUST subsequently send a Failure 980 packet. After the authenticator sends a method-specific success 981 indication to the peer, and receives a method-specific success 982 indication from the peer, it MUST subsequently send a Success 983 packet. 985 On the peer, once the method completes unsuccessfully (that is, 986 either the authenticator sends a method-specific failure 987 indication, or the peer decides that it does want to continue the 988 conversation, possibly after sending a method-specific failure 989 indication), the peer MUST terminate the conversation and indicate 990 failure to the lower layer. The peer MUST silently discard 991 Success packets and MAY silently discard Failure packets. As a 992 result, loss of a Failure packet need not result in a timeout. 994 On the peer, after acknowledged successful result indications have 995 been exchanged by both sides, a Failure packet MUST be silently 996 discarded. The peer MAY, in the event that an EAP Success is not 997 received, conclude that the EAP Success packet was lost and that 998 authentication concluded successfully. 1000 A mutually authenticating method (such as EAP-TLS [RFC2716]) that 1001 provides authorization error messages provides acknowledged result 1002 indications for the purpose of this specification. Within 1003 EAP-TLS, the peer always authenticates the authenticator, and may 1004 send a TLS-alert message in the event of an authentication 1005 failure. An authenticator may use the "access denied" TLS alert 1006 after successfully authenticating the peer to indicate that a 1007 valid certificate was received from the peer, but when access 1008 control was applied, the authenticator decided not to proceed. If 1009 a method provides authorization error messages, the authenticator 1010 SHOULD use them so as to ensure consistency with the final access 1011 decision and avoid lengthy timeouts. 1013 If the authenticator has not sent a method-specific result 1014 indication, and the peer is willing to continue the conversation, 1015 once the method completes the peer waits for a Success or Failure 1016 packet and MUST NOT silently discard either of them. In the event 1017 that neither a Success nor Failure packet is received, the peer 1018 SHOULD terminate the conversation to avoid lengthy timeouts in 1019 case the lost packet was an EAP Failure. 1021 If the peer attempts to authenticate to the authenticator and 1022 fails to do so, the authenticator MUST send a Failure packet and 1023 MUST NOT grant access by sending a Success packet. However, an 1024 authenticator MAY omit having the peer authenticate to it in 1025 situations where limited access is offered (e.g., guest access). 1026 In this case the authenticator MUST send a Success packet. 1028 Where the peer authenticates successfully to the authenticator, 1029 but the authenticator does not send a method-specific result 1030 indication the authenticator MAY deny access by sending a Failure 1031 packet where the peer is not currently authorized for network 1032 access. 1034 A summary of the Success and Failure packet format is shown below. 1035 The fields are transmitted from left to right. 1037 0 1 2 3 1038 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1039 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1040 | Code | Identifier | Length | 1041 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1043 Code 1045 3 for Success 1046 4 for Failure 1048 Identifier 1050 The Identifier field is one octet and aids in matching replies to 1051 Responses. The Identifier field MUST match the Identifier field 1052 of the Response packet that it is sent in response to. 1054 Length 1056 4 1058 4.3 Retransmission Behavior 1060 Because the authentication process will often involve user input, 1061 some care must be taken when deciding upon retransmission strategies 1062 and authentication timeouts. By default, where EAP is run over an 1063 unreliable lower layer, the EAP retransmission timer SHOULD be 1064 dynamically estimated. A maximum of 3-5 retransmissions is 1065 suggested. 1067 When run over a reliable lower layer (e.g., EAP over ISAKMP/TCP, as 1068 within [IKEv2]), the authenticator retransmission timer SHOULD be set 1069 to an infinite value, so that retransmissions do not occur at the EAP 1070 layer. The peer may still maintain a timeout value so as to avoid 1071 waiting indefinitely for a Request. 1073 Where the authentication process requires user input, the measured 1074 round trip times may be determined by user responsiveness rather than 1075 network characteristics, so that dynamic RTO estimation may not be 1076 helpful. Instead, the retransmission timer SHOULD be set so as to 1077 provide sufficient time for the user to respond, with longer timeouts 1078 required in certain cases, such as where Token Cards (see Section 1079 5.6) are involved. 1081 In order to provide the EAP authenticator with guidance as to the 1082 appropriate timeout value, a hint can be communicated to the 1083 authenticator by the backend authentication server (such as via the 1084 RADIUS Session-Timeout attribute). 1086 In order to dynamically estimate the EAP retransmission timer, the 1087 algorithms for estimation of SRTT, RTTVAR and RTO described in 1088 [RFC2988] are RECOMMENDED, including use of Karn's algorithm, with 1089 the following potential modifications: 1091 [a] In order to avoid synchronization behaviors that can occur with 1092 fixed timers among distributed systems, the retransmission timer 1093 is calculated with a jitter by using the RTO value and randomly 1094 adding a value drawn between -RTOmin/2 and RTOmin/2. Alternative 1095 calculations to create jitter MAY be used. These MUST be 1096 pseudo-random, generated by a PRNG seeded as per [RFC1750]. 1098 [b] When EAP is transported over a single link (as opposed to over 1099 the Internet), smaller values of RTOinitial, RTOmin and RTOmax 1100 MAY be used. Recommended values are RTOinitial=1 second, 1101 RTOmin=200ms, RTOmax=20 seconds. 1103 [c] When EAP is transported over a single link (as opposed to over 1104 the Internet), estimates MAY be done on a per-authenticator 1105 basis, rather than a per-session basis. This enables the 1106 retransmission estimate to make the most use of information on 1107 link-layer behavior. 1109 [d] An EAP implementation MAY clear SRTT and RTTVAR after backing off 1110 the timer multiple times as it is likely that the current SRTT 1111 and RTTVAR are bogus in this situation. Once SRTT and RTTVAR are 1112 cleared they should be initialized with the next RTT sample taken 1113 as described in [RFC2988] equation 2.2. 1115 5. Initial EAP Request/Response Types 1117 This section defines the initial set of EAP Types used in Request/ 1118 Response exchanges. More Types may be defined in follow-on 1119 documents. The Type field is one octet and identifies the structure 1120 of an EAP Request or Response packet. The first 3 Types are 1121 considered special case Types. 1123 The remaining Types define authentication exchanges. Nak (Type 3) or 1124 Expanded Nak (Type 254) are valid only for Response packets, they 1125 MUST NOT be sent in a Request. 1127 All EAP implementations MUST support Types 1-4, which are defined in 1128 this document, and SHOULD support Type 254. Implementations MAY 1129 support other Types defined here or in future RFCs. 1131 1 Identity 1132 2 Notification 1133 3 Nak (Response only) 1134 4 MD5-Challenge 1135 5 One Time Password (OTP) 1136 6 Generic Token Card (GTC) 1137 254 Expanded Types 1138 255 Experimental use 1140 EAP methods MAY support authentication based on shared secrets. If 1141 the shared secret is a passphrase entered by the user, 1142 implementations MAY support entering passphrases with non-ASCII 1143 characters. In this case, the input should be processed using an 1144 appropriate stringprep [RFC3454] profile, and encoded in octets using 1145 UTF-8 encoding [RFC2279]. A preliminary version of a possible 1146 stringprep profile is described in [SASLPREP]. 1148 5.1 Identity 1150 Description 1152 The Identity Type is used to query the identity of the peer. 1153 Generally, the authenticator will issue this as the initial 1154 Request. An optional displayable message MAY be included to 1155 prompt the peer in the case where there is an expectation of 1156 interaction with a user. A Response of Type 1 (Identity) SHOULD 1157 be sent in Response to a Request with a Type of 1 (Identity). 1159 Some EAP implementations piggy-back various options into the 1160 Identity Request after a NUL-character. By default an EAP 1161 implementation SHOULD NOT assume that an Identity Request or 1162 Response can be larger than 1020 octets. 1164 Since Identity Requests and Responses are not protected, from a 1165 privacy perspective, it may be preferable for protected 1166 method-specific Identity exchanges to be used instead. Where the 1167 peer is configured to only accept authentication methods 1168 supporting protected identity exchanges, the peer MAY provide an 1169 abbreviated Identity Response (such as omitting the peer-name 1170 portion of the NAI [RFC2486]). For further discussion of identity 1171 protection, see Section 7.3. 1173 Implementation Note: The peer MAY obtain the Identity via user 1174 input. It is suggested that the authenticator retry the 1175 Identity Request in the case of an invalid Identity or 1176 authentication failure to allow for potential typos on the part 1177 of the user. It is suggested that the Identity Request be 1178 retried a minimum of 3 times before terminating the 1179 authentication. The Notification Request MAY be used to 1180 indicate an invalid authentication attempt prior to 1181 transmitting a new Identity Request (optionally, the failure 1182 MAY be indicated within the message of the new Identity Request 1183 itself). 1185 Type 1187 1 1189 Type-Data 1191 This field MAY contain a displayable message in the Request, 1192 containing UTF-8 encoded ISO 10646 characters [RFC2279]. Where 1193 the Request contains a null, only the portion of the field prior 1194 to the null is displayed. If the Identity is unknown, the 1195 Identity Response field should be zero bytes in length. The 1196 Identity Response field MUST NOT be null terminated. In all 1197 cases, the length of the Type-Data field is derived from the 1198 Length field of the Request/Response packet. 1200 5.2 Notification 1202 Description 1204 The Notification Type is optionally used to convey a displayable 1205 message from the authenticator to the peer. An authenticator MAY 1206 send a Notification Request to the peer at any time when there is 1207 no outstanding Request, prior to completion of an EAP 1208 authentication method. The peer MUST respond to a Notification 1209 Request with a Notification Response unless the EAP authentication 1210 method specification prohibits the use of Notification message. 1211 In any case, a Nak Response MUST NOT be sent in response to a 1212 Notification Request. Note that the default maximum length of a 1213 Notification Request is 1020 octets. By default, this leaves at 1214 most 1015 octets for the human readable message. 1216 An EAP method MAY indicate within its specification that 1217 Notification messages must not be sent during that method. In this 1218 case, the peer MUST silently discard Notification Requests from 1219 the point where an initial Request for that Type is answered with 1220 a Response of the same Type. 1222 The peer SHOULD display this message to the user or log it if it 1223 cannot be displayed. The Notification Type is intended to provide 1224 an acknowledged notification of some imperative nature, but it is 1225 not an error indication, and therefore does not change the state 1226 of the peer. Examples include a password with an expiration time 1227 that is about to expire, an OTP sequence integer which is nearing 1228 0, an authentication failure warning, etc. In most circumstances, 1229 Notification should not be required. 1231 Type 1233 2 1235 Type-Data 1237 The Type-Data field in the Request contains a displayable message 1238 greater than zero octets in length, containing UTF-8 encoded ISO 1239 10646 characters [RFC2279]. The length of the message is 1240 determined by Length field of the Request packet. The message 1241 MUST NOT be null terminated. A Response MUST be sent in reply to 1242 the Request with a Type field of 2 (Notification). The Type-Data 1243 field of the Response is zero octets in length. The Response 1244 should be sent immediately (independent of how the message is 1245 displayed or logged). 1247 5.3 Nak 1249 5.3.1 Legacy Nak 1251 Description 1253 The legacy Nak Type is valid only in Response messages. It is 1254 sent in reply to a Request where the desired authentication Type 1255 is unacceptable. Authentication Types are numbered 4 and above. 1257 The Response contains one or more authentication Types desired by 1258 the Peer. Type zero (0) is used to indicate that the sender has 1259 no viable alternatives, and therefore the authenticator SHOULD NOT 1260 send another Request after receiving a Nak Response containing a 1261 zero value. 1263 Since the legacy Nak Type is valid only in Responses and has very 1264 limited functionality, it MUST NOT be used as a general purpose 1265 error indication, such as for communication of error messages, or 1266 negotiation of parameters specific to a particular EAP method. 1268 Code 1270 2 for Response. 1272 Identifier 1274 The Identifier field is one octet and aids in matching Responses 1275 with Requests. The Identifier field of a legacy Nak Response MUST 1276 match the Identifier field of the Request packet that it is sent 1277 in response to. 1279 Length 1281 >=6 1283 Type 1285 3 1287 Type-Data 1289 Where a peer receives a Request for an unacceptable authentication 1290 Type (4-253,255), or a peer lacking support for Expanded Types 1291 receives a Request for Type 254, a Nak Response (Type 3) MUST be 1292 sent. The Type-Data field of the Nak Response (Type 3) MUST 1293 contain one or more octets indicating the desired authentication 1294 Type(s), one octet per Type, or the value zero (0) to indicate no 1295 proposed alternative. A peer supporting Expanded Types that 1296 receives a Request for an unacceptable authentication Type (4-253, 1297 255) MAY include the value 254 in the Nak Response (Type 3) in 1298 order to indicate the desire for an Expanded authentication Type. 1299 If the authenticator can accommodate this preference, it will 1300 respond with an Expanded Type Request (Type 254). 1302 5.3.2 Expanded Nak 1304 Description 1306 The Expanded Nak Type is valid only in Response messages. It MUST 1307 be sent only in reply to a Request of Type 254 (Expanded Type) 1308 where the authentication Type is unacceptable. The Expanded Nak 1309 Type uses the Expanded Type format itself, and the Response 1310 contains one or more authentication Types desired by the peer, all 1311 in Expanded Type format. Type zero (0) is used to indicate that 1312 the sender has no viable alternatives. The general format of the 1313 Expanded Type is described in Section 5.7. 1315 Since the Expanded Nak Type is valid only in Responses and has 1316 very limited functionality, it MUST NOT be used as a general 1317 purpose error indication, such as for communication of error 1318 messages, or negotiation of parameters specific to a particular 1319 EAP method. 1321 Code 1323 2 for Response. 1325 Identifier 1327 The Identifier field is one octet and aids in matching Responses 1328 with Requests. The Identifier field of an Expanded Nak Response 1329 MUST match the Identifier field of the Request packet that it is 1330 sent in response to. 1332 Length 1334 >=20 1336 Type 1338 254 1340 Vendor-Id 1342 0 (IETF) 1344 Vendor-Type 1346 3 (Nak) 1348 Vendor-Data 1350 The Expanded Nak Type is only sent when the Request contains an 1351 Expanded Type (254) as defined in Section 5.7. The Vendor-Data 1352 field of the Nak Response MUST contain one or more authentication 1353 Types (4 or greater), all in expanded format, 8 octets per Type, 1354 or the value zero (0), also in Expanded Type format, to indicate 1355 no proposed alternative. The desired authentication Types may 1356 include a mixture of Vendor-Specific and IETF Types. For example, 1357 an Expanded Nak Response indicating a preference for OTP (Type 5), 1358 and an MIT (Vendor-Id=20) Expanded Type of 6 would appear as 1359 follows: 1361 0 1 2 3 1362 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1363 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1364 | 2 | Identifier | Length=28 | 1365 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1366 | Type=254 | 0 (IETF) | 1367 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1368 | 3 (Nak) | 1369 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1370 | Type=254 | 0 (IETF) | 1371 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1372 | 5 (OTP) | 1373 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1374 | Type=254 | 20 (MIT) | 1375 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1376 | 6 | 1377 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1379 An Expanded Nak Response indicating a no desired alternative would 1380 appear as follows: 1382 0 1 2 3 1383 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1384 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1385 | 2 | Identifier | Length=20 | 1386 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1387 | Type=254 | 0 (IETF) | 1388 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1389 | 3 (Nak) | 1390 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1391 | Type=254 | 0 (IETF) | 1392 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1393 | 0 (No alternative) | 1394 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1396 5.4 MD5-Challenge 1398 Description 1400 The MD5-Challenge Type is analogous to the PPP CHAP protocol 1401 [RFC1994] (with MD5 as the specified algorithm). The Request 1402 contains a "challenge" message to the peer. A Response MUST be 1403 sent in reply to the Request. The Response MAY be either of Type 1404 4 (MD5-Challenge), Nak (Type 3) or Expanded Nak (Type 254). The 1405 Nak reply indicates the peer's desired authentication Type(s). 1406 EAP peer and EAP server implementations MUST support the 1407 MD5-Challenge mechanism. An authenticator that supports only 1408 pass-through MUST allow communication with a backend 1409 authentication server that is capable of supporting MD5-Challenge, 1410 although the EAP authenticator implementation need not support 1411 MD5-Challenge itself. However, if the EAP authenticator can be 1412 configured to authenticate peers locally (e.g., not operate in 1413 pass-through), then the requirement for support of the 1414 MD5-Challenge mechanism applies. 1416 Note that the use of the Identifier field in the MD5-Challenge 1417 Type is different from that described in [RFC1994]. EAP allows 1418 for retransmission of MD5-Challenge Request packets while 1419 [RFC1994] states that both the Identifier and Challenge fields 1420 MUST change each time a Challenge (the CHAP equivalent of the 1421 MD5-Challenge Request packet) is sent. 1423 Note: [RFC1994] treats the shared secret as an octet string, and 1424 does not specify how it is entered into the system (or if it is 1425 handled by the user at all). EAP MD5-Challenge implementations MAY 1426 support entering passphrases with non-ASCII characters. See 1427 Section 5 for instructions how the input should be processed and 1428 encoded into octets. 1430 Type 1432 4 1434 Type-Data 1436 The contents of the Type-Data field is summarized below. For 1437 reference on the use of these fields see the PPP Challenge 1438 Handshake Authentication Protocol [RFC1994]. 1440 0 1 2 3 1441 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1442 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1443 | Value-Size | Value ... 1444 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1445 | Name ... 1446 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1448 Security Claims (see Section 7.2): 1450 Intended use: Wired networks, including PPP, PPPOE, and 1451 IEEE 802 wired media. Use over the 1452 Internet or with wireless media only when 1453 protected. 1454 Mechanism: Password or pre-shared key. 1455 Mutual authentication: No 1456 Integrity protection: No 1457 Replay protection: No 1458 Confidentiality: No 1459 Key Derivation: No 1460 Key strength: N/A 1461 Dictionary attack prot: No 1462 Key hierarchy: N/A 1463 Fast reconnect: No 1464 Crypt. binding: N/A 1465 Acknowledged S/F: No 1467 5.5 One-Time Password (OTP) 1469 Description 1471 The One-Time Password system is defined in "A One-Time Password 1472 System" [RFC2289] and "OTP Extended Responses" [RFC2243]. The 1473 Request contains an OTP challenge in the format described in 1474 [RFC2289]. A Response MUST be sent in reply to the Request. The 1475 Response MUST be of Type 5 (OTP), Nak (Type 3) or Expanded Nak 1476 (Type 254). The Nak Response indicates the peer's desired 1477 authentication Type(s). The EAP OTP method is intended for use 1478 with the One-Time Password system only, and MUST NOT be used to 1479 provide support for cleartext passwords. 1481 Type 1483 5 1485 Type-Data 1487 The Type-Data field contains the OTP "challenge" as a displayable 1488 message in the Request. In the Response, this field is used for 1489 the 6 words from the OTP dictionary [RFC2289]. The messages MUST 1490 NOT be null terminated. The length of the field is derived from 1491 the Length field of the Request/Reply packet. 1493 Note: [RFC2289] does not specify how the secret pass-phrase is 1494 entered by the user, or how the pass-phrase is converted into 1495 octets. EAP OTP implementations MAY support entering passphrases 1496 with non-ASCII characters. See Section 5 for instructions how the 1497 input should be processed and encoded into octets. 1499 Security Claims (see Section 7.2): 1501 Intended use: Wired networks, including PPP, PPPOE, and 1502 IEEE 802 wired media. Use over the 1503 Internet or with wireless media only when 1504 protected. 1505 Mechanism: One-Time Password 1506 Mutual authentication: No 1507 Integrity protection: No 1508 Replay protection: Yes 1509 Confidentiality: No 1510 Key Derivation: No 1511 Key strength: N/A 1512 Dictionary attack prot: No 1513 Key hierarchy: N/A 1514 Fast reconnect: No 1515 Crypt. binding: N/A 1516 Acknowledged S/F: No 1518 5.6 Generic Token Card (GTC) 1520 Description 1522 The Generic Token Card Type is defined for use with various Token 1523 Card implementations which require user input. The Request 1524 contains a displayable message and the Response contains the Token 1525 Card information necessary for authentication. Typically, this 1526 would be information read by a user from the Token card device and 1527 entered as ASCII text. A Response MUST be sent in reply to the 1528 Request. The Response MUST be of Type 6 (GTC), Nak (Type 3) or 1529 Expanded Nak (Type 254). The Nak Response indicates the peer's 1530 desired authentication Type(s). The EAP GTC method is intended 1531 for use with the Token Cards supporting challenge/response 1532 authentication and MUST NOT be used to provide support for 1533 cleartext passwords in the absence of a protected tunnel with 1534 server authentication. 1536 Type 1538 6 1540 Type-Data 1542 The Type-Data field in the Request contains a displayable message 1543 greater than zero octets in length. The length of the message is 1544 determined by the Length field of the Request packet. The message 1545 MUST NOT be null terminated. A Response MUST be sent in reply to 1546 the Request with a Type field of 6 (Generic Token Card). The 1547 Response contains data from the Token Card required for 1548 authentication. The length of the data is determined by the 1549 Length field of the Response packet. 1551 EAP GTC implementations MAY support entering a response with 1552 non-ASCII characters. See Section 5 for instructions how the 1553 input should be processed and encoded into octets. 1555 Security Claims (see Section 7.2): 1557 Intended use: Wired networks, including PPP, PPPOE, and 1558 IEEE 802 wired media. Use over the 1559 Internet or with wireless media only when 1560 protected. 1561 Mechanism: Hardware token. 1562 Mutual authentication: No 1563 Integrity protection: No 1564 Replay protection: No 1565 Confidentiality: No 1566 Key Derivation: No 1567 Key strength: N/A 1568 Dictionary attack prot: No 1569 Key hierarchy: N/A 1570 Fast reconnect: No 1571 Crypt. binding: N/A 1572 Acknowledged S/F: No 1574 5.7 Expanded Types 1575 Description 1577 Since many of the existing uses of EAP are vendor-specific, the 1578 Expanded method Type is available to allow vendors to support 1579 their own Expanded Types not suitable for general usage. 1581 The Expanded Type is also used to expand the global Method Type 1582 space beyond the original 255 values. A Vendor-Id of 0 maps the 1583 original 255 possible Types onto a space of 2^32-1 possible Types. 1584 (Type 0 is only used in a Nak Response, to indicate no acceptable 1585 alternative) 1587 An implementation that supports the Expanded attribute MUST treat 1588 EAP Types that are less than 256 equivalently whether they appear 1589 as a single octet or as the 32-bit Vendor-Type within a Expanded 1590 Type where Vendor-Id is 0. Peers not equipped to interpret the 1591 Expanded Type MUST send a Nak as described in Section 5.3.1, and 1592 negotiate a more suitable authentication method. 1594 A summary of the Expanded Type format is shown below. The fields 1595 are transmitted from left to right. 1597 0 1 2 3 1598 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1599 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1600 | Type | Vendor-Id | 1601 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1602 | Vendor-Type | 1603 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1604 | Vendor data... 1605 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1607 Type 1609 254 for Expanded Type 1611 Vendor-Id 1613 The Vendor-Id is 3 octets and represents the SMI Network 1614 Management Private Enterprise Code of the Vendor in network byte 1615 order, as allocated by IANA. A Vendor-Id of zero is reserved for 1616 use by the IETF in providing an expanded global EAP Type space. 1618 Vendor-Type 1620 The Vendor-Type field is four octets and represents the 1621 vendor-specific method Type. 1623 If the Vendor-Id is zero, the Vendor-Type field is an extension 1624 and superset of the existing namespace for EAP Types. The first 1625 256 Types are reserved for compatibility with single-octet EAP 1626 Types that have already been assigned or may be assigned in the 1627 future. Thus, EAP Types from 0 through 255 are semantically 1628 identical whether they appear as single octet EAP Types or as 1629 Vendor-Types when Vendor-Id is zero. There is one exception to 1630 this rule: Expanded Nak and Legacy Nak packets share the same 1631 code, but must be treated differently because they have a 1632 different format. 1634 Vendor-Data 1636 The Vendor-Data field is defined by the vendor. Where a Vendor-Id 1637 of zero is present, the Vendor-Data field will be used for 1638 transporting the contents of EAP methods of Types defined by the 1639 IETF. 1641 5.8 Experimental 1643 Description 1645 The Experimental Type has no fixed format or content. It is 1646 intended for use when experimenting with new EAP Types. This Type 1647 is intended for experimental and testing purposes. No guarantee 1648 is made for interoperability between peers using this Type, as 1649 outlined in [IANA-EXP]. 1651 Type 1653 255 1655 Type-Data 1657 Undefined 1659 6. IANA Considerations 1661 This section provides guidance to the Internet Assigned Numbers 1662 Authority (IANA) regarding registration of values related to the EAP 1663 protocol, in accordance with BCP 26, [RFC2434]. 1665 There are two name spaces in EAP that require registration: Packet 1666 Codes and method Types. 1668 EAP is not intended as a general-purpose protocol, and allocations 1669 SHOULD NOT be made for purposes unrelated to authentication. 1671 The following terms are used here with the meanings defined in BCP 1672 26: "name space", "assigned value", "registration". 1674 The following policies are used here with the meanings defined in BCP 1675 26: "Private Use", "First Come First Served", "Expert Review", 1676 "Specification Required", "IETF Consensus", "Standards Action". 1678 For registration requests where a Designated Expert should be 1679 consulted, the responsible IESG area director should appoint the 1680 Designated Expert. The intention is that any allocation will be 1681 accompanied by a published RFC. But in order to allow for the 1682 allocation of values prior to the RFC being approved for publication, 1683 the Designated Expert can approve allocations once it seems clear 1684 that an RFC will be published. The Designated expert will post a 1685 request to the EAP WG mailing list (or a successor designated by the 1686 Area Director) for comment and review, including an Internet-Draft. 1687 Before a period of 30 days has passed, the Designated Expert will 1688 either approve or deny the registration request and publish a notice 1689 of the decision to the EAP WG mailing list or its successor, as well 1690 as informing IANA. A denial notice must be justified by an 1691 explanation and, in the cases where it is possible, concrete 1692 suggestions on how the request can be modified so as to become 1693 acceptable. 1695 6.1 Packet Codes 1697 Packet Codes have a range from 1 to 255, of which 1-4 have been 1698 allocated. Because a new Packet Code has considerable impact on 1699 interoperability, a new Packet Code requires Standards Action, and 1700 should be allocated starting at 5. 1702 6.2 Method Types 1704 The original EAP method Type space has a range from 1 to 255, and is 1705 the scarcest resource in EAP, and thus must be allocated with care. 1706 Method Types 1-41 have been allocated, with 20 available for re-use. 1707 Method Types 42-191 may be allocated on the advice of a Designated 1708 Expert, with Specification Required. 1710 Allocation of blocks of method Types (more than one for a given 1711 purpose) should require IETF Consensus. EAP Type Values 192-253 are 1712 reserved and allocation requires Standards Action. 1714 Method Type 254 is allocated for the Expanded Type. Where the 1715 Vendor-Id field is non-zero, the Expanded Type is used for functions 1716 specific only to one vendor's implementation of EAP, where no 1717 interoperability is deemed useful. When used with a Vendor-Id of 1718 zero, method Type 254 can also be used to provide for an expanded 1719 IETF method Type space. Method Type values 256-4294967295 may be 1720 allocated after Type values 1-191 have been allocated. 1722 Method Type 255 is allocated for Experimental use, such as testing of 1723 new EAP methods before a permanent Type code is allocated. 1725 7. Security Considerations 1727 EAP was designed for use with dialup PPP [RFC1661] and was later 1728 adapted for use in wired IEEE 802 networks [IEEE-802] in 1729 [IEEE-802.1X]. On these networks, an attacker would need to gain 1730 physical access to the telephone or switch infrastructure in order to 1731 mount an attack. While such attacks have been documented, such as in 1732 [DECEPTION], they are assumed to be rare. 1734 However, subsequently EAP has been proposed for use on wireless 1735 networks, and over the Internet, where physical security cannot be 1736 assumed. On such networks, the security vulnerabilities are greater, 1737 as are the requirements for EAP security. 1739 This section defines the threat model and security terms and 1740 describes the security claims section required in EAP method 1741 specifications. We then discuss threat mitigation. 1743 7.1 Threat model 1745 On physically insecure networks, it is possible for an attacker to 1746 gain access to the physical medium. This enables a range of attacks, 1747 including the following: 1749 [1] An attacker may try to discover user identities by snooping 1750 authentication traffic. 1752 [2] An attacker may try to modify or spoof EAP packets. 1754 [3] An attacker may launch denial of service attacks by spoofing 1755 lower layer indications or Success/Failure packets; by replaying 1756 EAP packets; or by generating packets with overlapping 1757 Identifiers. 1759 [4] An attacker may attempt to recover the pass-phrase by mounting an 1760 offline dictionary attack. 1762 [5] An attacker may attempt to convince the peer to connect to an 1763 untrusted network, by mounting a man-in-the-middle attack. 1765 [6] An attacker may attempt to disrupt the EAP negotiation in order 1766 cause a weak authentication method to be selected. 1768 [7] An attacker may attempt to recover keys by taking advantage of 1769 weak key derivation techniques used within EAP methods. 1771 [8] An attacker may attempt to take advantage of weak ciphersuites 1772 subsequently used after the EAP conversation is complete. 1774 [9] An attacker may attempt to perform downgrading attacks on lower 1775 layer ciphersuite negotiation in order to ensure that a weaker 1776 ciphersuite is used subsequently to EAP authentication. 1778 Where EAP is used over wired networks, an attacker typically requires 1779 access to the physical infrastructure in order to carry out these 1780 attacks. However, where EAP is used over wireless networks, EAP 1781 packets may be forwarded by authenticators (e.g., pre-authentication) 1782 so that the attacker need not be within the coverage area of an 1783 authenticator in order to carry out an attack on it or its peers. 1784 Where EAP is used over the Internet, attacks may be carried out at an 1785 even greater distance. 1787 7.2 Security claims 1789 In order to clearly articulate the security provided by an EAP 1790 method, EAP method specifications MUST include a Security Claims 1791 section including the following declarations: 1793 [a] Intended use. This includes a statement of whether the method is 1794 intended for use over a physically secure or insecure network, as 1795 well as a statement of the applicable lower layers. 1797 [b] Mechanism. This is a statement of the authentication technology: 1798 certificates, pre-shared keys, passwords, token cards, etc. 1800 [c] Security claims. This is a statement of the claimed security 1801 properties of the method, using terms defined in Section 1.2: 1802 mutual authentication, integrity protection, replay protection, 1803 confidentiality, key derivation, dictionary attack resistance, 1804 fast reconnect, cryptographic binding, acknowledged result 1805 indications. The Security Claims section of an EAP method 1806 specification SHOULD provide justification for the claims that 1807 are made. This can be accomplished by including a proof in an 1808 Appendix, or including a reference to a proof. 1810 [d] Key strength. If the method derives keys, then the effective key 1811 strength MUST be estimated. This estimate is meant for potential 1812 users of the method to determine if the keys produced are strong 1813 enough for the intended application. 1815 The effective key strength SHOULD be stated as number of bits, 1816 defined as follows: If the effective key strength is N bits, the 1817 best currently known methods to recover the key (with 1818 non-negligible probability) require an effort comparable to 2^N 1819 operations of a typical block cipher. The statement SHOULD be 1820 accompanied by a short rationale, explaining how this number was 1821 arrived at. This explanation SHOULD include the parameters 1822 required to achieve the stated key strength based on current 1823 knowledge of the algorithms. 1825 (Note: Although it is difficult to define what "comparable 1826 effort" and "typical block cipher" exactly mean, reasonable 1827 approximations are sufficient here. Refer to e.g. [SILVERMAN] 1828 for more discussion.) 1830 The key strength depends on the methods used to derive the keys. 1831 For instance, if keys are derived from a shared secret (such as a 1832 password or a long-term secret), and possibly some public 1833 information such as nonces, the effective key strength is limited 1834 by the strength of the long-term secret (assuming that the 1835 derivation procedure is computationally simple). To take another 1836 example, when using public key algorithms, the strength of the 1837 symmetric key depends on the strength of the public keys used. 1839 [e] Description of key hierarchy. EAP methods deriving keys MUST 1840 either provide a reference to a key hierarchy specification, or 1841 describe how Master Session Keys (MSKs) and Extended Master 1842 Session Keys (EMSKs) are to be derived. 1844 [f] Indication of vulnerabilities. In addition to the security 1845 claims that are made, the specification MUST indicate which of 1846 the security claims detailed in Section 1.2 are NOT being made. 1848 7.2.1 Security claims terminology for EAP methods 1850 These terms are used to described the security properties of EAP 1851 methods: 1853 Mutual authentication 1854 This refers to an EAP method in which, within an 1855 interlocked exchange, the authenticator authenticates the 1856 peer and the peer authenticates the authenticator. Two 1857 independent one-way methods, running in opposite directions 1858 do not provide mutual authentication as defined here. 1860 Integrity protection 1861 This refers to providing data origin authentication and 1862 protection against unauthorized modification of information 1863 for EAP packets (including EAP Requests and Responses). 1864 When making this claim, a method specification MUST 1865 describe the EAP packets and fields within the EAP packet 1866 that are protected. 1868 Replay protection 1869 This refers to protection against replay of an EAP method 1870 or its messages, including method-specific success and 1871 failure indications. 1873 Confidentiality 1874 This refers to encryption of EAP messages, including EAP 1875 Requests and Responses, and method-specific success and 1876 failure indications. A method making this claim MUST 1877 support identity protection (see Section 7.3). 1879 Key derivation 1880 This refers to the ability of the EAP method to derive 1881 exportable keying material such as the Master Session Key 1882 (MSK), and Extended Master Session Key (EMSK). The MSK is 1883 used only for further key derivation, not directly for 1884 protection of the EAP conversation or subsequent data. Use 1885 of the EMSK is reserved. 1887 Key strength 1888 If the effective key strength is N bits, the best currently 1889 known methods to recover the key (with non-negligible 1890 probability) require an effort comparable to 2^N operations 1891 of a typical block cipher. 1893 Dictionary attack resistance 1894 Where password authentication is used, passwords are 1895 commonly selected from a small set (as compared to a set of 1896 N-bit keys), which raises a concern about dictionary 1897 attacks. A method may be said to provide protection against 1898 dictionary attacks if, when it uses a password as a secret, 1899 the method does not allow an offline attack that has a work 1900 factor based on the number of passwords in an attacker's 1901 dictionary. 1903 Fast reconnect 1904 The ability, in the case where a security association has 1905 been previously established, to create a new or refreshed 1906 security association in a smaller number of round-trips. 1908 Cryptographic binding 1909 The demonstration of the EAP peer to the EAP server that a 1910 single entity has acted as the EAP peer for all methods 1911 executed within a tunnel method. Binding MAY also imply 1912 that the EAP server demonstrates to the peer that a single 1913 entity has acted as the EAP server for all methods executed 1914 within a tunnel method. If executed correctly, binding 1915 serves to mitigate man-in-the-middle vulnerabilities. 1917 Acknowledged result indications 1918 The ability within a method for the authenticator to 1919 indicate to the peer whether it has successfully 1920 authenticated to it, and for the peer to acknowledge 1921 receipt of that indication as well as indicating to the 1922 authenticator whether it has successfully authenticated to 1923 the peer. Since EAP Success and Failure packets are neither 1924 acknowledged nor integrity protected, this claim requires 1925 implementation of a method-specific result exchange that is 1926 authenticated, integrity and replay protected on a 1927 per-packet basis. 1929 7.3 Identity protection 1931 An Identity exchange is optional within the EAP conversation. 1932 Therefore, it is possible to omit the Identity exchange entirely, or 1933 to use a method-specific identity exchange once a protected channel 1934 has been established. 1936 However, where roaming is supported as described in [RFC2607], it may 1937 be necessary to locate the appropriate backend authentication server 1938 before the authentication conversation can proceed. The realm 1939 portion of the Network Access Identifier (NAI) [RFC2486] is typically 1940 included within the EAP-Response/Identity in order to enable the 1941 authentication exchange to be routed to the appropriate backend 1942 authentication server. Therefore while the peer-name portion of the 1943 NAI may be omitted in the EAP-Response/Identity, where proxies or 1944 relays are present, the realm portion may be required. 1946 It is possible for the identity in the identity response to be 1947 different from the identity authenticated by the EAP method. This may 1948 be intentional in the case of identity privacy. An EAP method SHOULD 1949 use the authenticated identity when making access control decisions. 1951 7.4 Man-in-the-middle attacks 1953 Where EAP is tunneled within another protocol that omits peer 1954 authentication, there exists a potential vulnerability to 1955 man-in-the-middle attack. 1957 As noted in Section 2.1, EAP does not permit untunnelled sequences of 1958 authentication methods. Were a sequence of EAP authentication 1959 methods to be permitted, the peer might not have proof that a single 1960 entity has acted as the authenticator for all EAP methods within the 1961 sequence. For example, an authenticator might terminate one EAP 1962 method, then forward the next method in the sequence to another party 1963 without the peer's knowledge or consent. Similarly, the 1964 authenticator might not have proof that a single entity has acted as 1965 the peer for all EAP methods within the sequence. 1967 Tunnelling EAP within another protocol enables an attack by a rogue 1968 EAP authenticator tunneling EAP to a legitimate server. Where the 1969 tunneling protocol is used for key establishment but does not require 1970 peer authentication, an attacker convincing a legitimate peer to 1971 connect to it will be able to tunnel EAP packets to a legitimate 1972 server, successfully authenticating and obtaining the key. This 1973 allows the attacker to successfully establish itself as a 1974 man-in-the-middle, gaining access to the network, as well as the 1975 ability to decrypt data traffic between the legitimate peer and 1976 server. 1978 This attack may be mitigated by the following measures: 1980 [a] Requiring mutual authentication within EAP tunneling mechanisms. 1982 [b] Requiring cryptographic binding between the EAP tunneling 1983 protocol and the tunneled EAP methods. Where cryptographic 1984 binding is supported, a mechanism is also needed to protect 1985 against downgrade attacks that would bypass it. 1987 [c] Limiting the EAP methods authorized for use without protection, 1988 based on peer and authenticator policy. 1990 [d] Avoiding the use of tunnels when a single, strong method is 1991 available. 1993 7.5 Packet modification attacks 1995 While EAP methods may support per-packet data origin authentication, 1996 integrity and replay protection, support is not provided within the 1997 EAP layer. 1999 Since the Identifier is only a single octet, it is easy to guess, 2000 allowing an attacker to successfully inject or replay EAP packets. An 2001 attacker may also modify EAP headers (Code, Identifier, Length, Type) 2002 within EAP packets where the header is unprotected. This could cause 2003 packets to be inappropriately discarded or misinterpreted. 2005 In the case of PPP and IEEE 802 wired links, it is assumed that such 2006 attacks are restricted to attackers who can gain access to the 2007 physical link. However, where EAP is run over physically insecure 2008 lower layers such as wireless (802.11 or cellular) or the Internet 2009 (such as within protocols supporting PPP, EAP or Ethernet Tunneling), 2010 this assumption is no longer valid and the vulnerability to attack is 2011 greater. 2013 To protect EAP messages sent over physically insecure lower layers, 2014 methods providing mutual authentication and key derivation, as well 2015 as per-packet origin authentication, integrity and replay protection 2016 SHOULD be used. 2018 Method-specific MICs may be used to provide protection. If a 2019 per-packet MIC is employed within an EAP method, then peers, 2020 authentication servers, and authenticators not operating in 2021 pass-through mode MUST validate the MIC. MIC validation failures 2022 SHOULD be logged. Whether a MIC validation failure is considered a 2023 fatal error or not is determined by the EAP method specification. 2025 Since EAP messages of Types Identity, Notification, and Nak do not 2026 include their own MIC, it may be desirable for the EAP method MIC to 2027 cover information contained within these messages, as well as the 2028 header of each EAP message. 2030 To provide protection, EAP also may be encapsulated within a 2031 protected channel created by protocols such as ISAKMP [RFC2408] as is 2032 done in [IKEv2] or within TLS [RFC2246]. However, as noted in Section 2033 7.4, EAP tunneling may result in a man-in-the-middle vulnerability. 2035 Existing EAP methods define message integrity checks (MICs) that 2036 cover more than one EAP packet. For example, EAP-TLS [RFC2716] 2037 defines a MIC over a TLS record that could be split into multiple 2038 fragments; within the FINISHED message, the MIC is computed over 2039 previous messages. Where the MIC covers more than one EAP packet, a 2040 MIC validation failure is typically considered a fatal error. 2042 Within EAP-TLS [RFC2716] a MIC validation failure is treated as a 2043 fatal error, since that is what is specified in TLS [RFC2246]. 2044 However, it is also possible to develop EAP methods that support 2045 per-packet MICs, and respond to verification failures by silently 2046 discarding the offending packet. 2048 In this document, descriptions of EAP message handling assume that 2049 per-packet MIC validation, where it occurs, is effectively performed 2050 as though it occurs before sending any responses or changing the 2051 state of the host which received the packet. 2053 7.6 Dictionary attacks 2055 Password authentication algorithms such as EAP-MD5, MS-CHAPv1 2056 [RFC2433] and Kerberos V [RFC1510] are known to be vulnerable to 2057 dictionary attacks. MS-CHAPv1 vulnerabilities are documented in 2058 [PPTPv1]; Kerberos vulnerabilities are described in [KRBATTACK], 2059 [KRBLIM], and [KERB4WEAK]. 2061 In order to protect against dictionary attacks, an authentication 2062 algorithm resistant to dictionary attack (as defined in Section 7.2) 2063 SHOULD be used where EAP runs over lower layers which are not 2064 physically secure. 2066 If an authentication algorithm is used that is known to be vulnerable 2067 to dictionary attack, then the conversation may be tunneled within a 2068 protected channel in order to provide additional protection. However, 2069 as noted in Section 7.4, EAP tunneling may result in a 2070 man-in-the-middle vulnerability, and therefore dictionary attack 2071 resistant methods are preferred. 2073 7.7 Connection to an untrusted network 2075 With EAP methods supporting one-way authentication, such as EAP-MD5, 2076 the peer does not authenticate the authenticator. Where the lower 2077 layer is not physically secure (such as where EAP runs over wireless 2078 media or the Internet), the peer is vulnerable to a rogue 2079 authenticator. As a result, where the lower layer is not physically 2080 secure, a method supporting mutual authentication is RECOMMENDED. 2082 In EAP there is no requirement that authentication be full duplex or 2083 that the same protocol be used in both directions. It is perfectly 2084 acceptable for different protocols to be used in each direction. This 2085 will, of course, depend on the specific protocols negotiated. 2086 However, in general, completing a single unitary mutual 2087 authentication is preferable to two one-way authentications, one in 2088 each direction. This is because separate authentications that are 2089 not bound cryptographically so as to demonstrate they are part of the 2090 same session are subject to man-in-the-middle attacks, as discussed 2091 in Section 7.4. 2093 7.8 Negotiation attacks 2095 In a negotiation attack, the attacker attempts to convince the peer 2096 and authenticator to negotiate a less secure EAP method. EAP does 2097 not provide protection for Nak Response packets, although it is 2098 possible for a method to include coverage of Nak Responses within a 2099 method-specific MIC. 2101 Within or associated with each authenticator, it is not anticipated 2102 that a particular named peer will support a choice of methods. This 2103 would make the peer vulnerable to attacks that negotiate the least 2104 secure method from among a set. Instead, for each named peer there 2105 SHOULD be an indication of exactly one method used to authenticate 2106 that peer name. If a peer needs to make use of different 2107 authentication methods under different circumstances, then distinct 2108 identities SHOULD be employed, each of which identifies exactly one 2109 authentication method. 2111 7.9 Implementation idiosyncrasies 2113 The interaction of EAP with lower layers such as PPP and IEEE 802 are 2114 highly implementation dependent. 2116 For example, upon failure of authentication, some PPP implementations 2117 do not terminate the link, instead limiting traffic in Network-Layer 2118 Protocols to a filtered subset, which in turn allows the peer the 2119 opportunity to update secrets or send mail to the network 2120 administrator indicating a problem. Similarly, while in 2121 [IEEE-802.1X] an authentication failure will result in denied access 2122 to the controlled port, limited traffic may be permitted on the 2123 uncontrolled port. 2125 In EAP there is no provision for retries of failed authentication. 2126 However, in PPP the LCP state machine can renegotiate the 2127 authentication protocol at any time, thus allowing a new attempt. 2128 Similarly, in IEEE 802.1X the Supplicant or Authenticator can 2129 re-authenticate at any time. It is recommended that any counters 2130 used for authentication failure not be reset until after successful 2131 authentication, or subsequent termination of the failed link. 2133 7.10 Key derivation 2135 It is possible for the peer and EAP server to mutually authenticate, 2136 and derive keys. In order to provide keying material for use in a 2137 subsequently negotiated ciphersuite, an EAP method supporting key 2138 derivation MUST export a Master Session Key (MSK) of at least 64 2139 octets, and an Extended Master Session Key (EMSK) of at least 64 2140 octets. 2142 The MSK and EMSK are not used directly to protect data; however, they 2143 are of sufficient size to enable subsequent derivation of Transient 2144 Session Keys (TSKs) for use with the selected ciphersuite. Each 2145 ciphersuite is responsible for specifying how to derive the TSKs from 2146 the MSK. The EAP method is also responsible for the derivation of 2147 Transient EAP Keys (TEKs) used for protection of the EAP conversation 2148 itself. 2150 EAP methods provide Master Session Keys and not Transient Session 2151 Keys so as to allow EAP methods to be ciphersuite and media 2152 independent. Depending on the lower layer, EAP methods may run 2153 before or after ciphersuite negotiation, so that the selected 2154 ciphersuite may not be known to the EAP method. By providing keying 2155 material usable with any ciphersuite, EAP methods can used with a 2156 wide range of ciphersuites and media. 2158 Non-overlapping substrings of the MSK MUST be cryptographically 2159 separate from each other, as defined in Section 7.2.1. That is, 2160 knowledge of one substring MUST NOT help in recovering some other 2161 substring without breaking some hard cryptographic assumption. This 2162 is required because some existing ciphersuites form TSKs by simply 2163 splitting the MSK to pieces of appropriate length. Likewise, 2164 non-overlapping substrings of the EMSK MUST be cryptographically 2165 separate from each other, and from substrings of the MSK. 2167 The EMSK is reserved for future use and MUST remain on the EAP peer 2168 and EAP server where it is derived; it MUST NOT be transported to, or 2169 shared with, additional parties, or used to derive any other keys. 2170 (This restriction will be relaxed in a future document that specifies 2171 how the EMSK can be used.) 2173 This specification does not provide detailed guidance on how EAP 2174 methods are to derive the MSK, EMSK and TEKs, or how the TSKs are to 2175 be derived from the MSK. Key derivation is an art that is best 2176 practiced by professionals; rather than inventing new key derivation 2177 algorithms, reuse of existing algorithms such as those specified in 2178 IKE [RFC2409], or TLS [RFC2246] is recommended. 2180 Further details on EAP Key Derivation are provided within [KEYFRAME]. 2182 7.11 Weak ciphersuites 2184 If after the initial EAP authentication, data packets are sent 2185 without per-packet authentication, integrity and replay protection, 2186 an attacker with access to the media can inject packets, "flip bits" 2187 within existing packets, replay packets, or even hijack the session 2188 completely. Without per-packet confidentiality, it is possible to 2189 snoop data packets. 2191 As a result, as noted in Section 3.1, where EAP is used over a 2192 physically insecure lower layer, per-packet authentication, integrity 2193 and replay protection SHOULD be used, and per-packet confidentiality 2194 is also recommended. 2196 Additionally, if the lower layer performs ciphersuite negotiation, it 2197 should be understood that EAP does not provide by itself integrity 2198 protection of that negotiation. Therefore, in order to avoid 2199 downgrading attacks which would lead to weaker ciphersuites being 2200 used, clients implementing lower layer ciphersuite negotiation SHOULD 2201 protect against negotiation downgrading. 2203 This can be done by enabling users to configure which are the 2204 acceptable ciphersuites as a matter of security policy; or, the 2205 ciphersuite negotiation MAY be authenticated using keying material 2206 derived from the EAP authentication and a MIC algorithm agreed upon 2207 in advance by lower-layer peers. 2209 7.12 Link layer 2211 There exists a number of reliability and security issues with link 2212 layer indications in PPP, IEEE 802 wired networks and IEEE 802.11 2213 wireless LANs: 2215 [a] PPP. In PPP, link layer indications such as LCP-Terminate (a 2216 link failure indication) and NCP (a link success indication) are 2217 not authenticated or integrity protected. They can therefore be 2218 spoofed by an attacker with access to the physical medium. 2220 [b] IEEE 802 wired networks. On wired networks, IEEE 802.1X messages 2221 are sent to a non-forwardable multicast MAC address. As a 2222 result, while the IEEE 802.1X EAPOL-Start and EAPOL-Logoff frames 2223 are not authenticated or integrity protected, only an attacker 2224 with access to the physical link can spoof these messages. 2226 [c] IEEE 802.11 wireless LANs. In IEEE 802.11, link layer 2227 indications include Disassociate and Deauthenticate frames (link 2228 failure indications), and the first message of the 4-way 2229 handshake (link success indication). These messages are not 2230 authenticated or integrity protected, and although they are not 2231 forwardable, they are spoofable by an attacker within range. 2233 In IEEE 802.11, IEEE 802.1X data frames may be sent as Class 3 2234 unicast data frames, and are therefore forwardable. This implies 2235 that while EAPOL-Start and EAPOL-Logoff messages may be 2236 authenticated and integrity protected, they can be spoofed by an 2237 authenticated attacker far from the target when 2238 "pre-authentication" is enabled. 2240 In IEEE 802.11 a "link down" indication is an unreliable 2241 indication of link failure, since wireless signal strength can 2242 come and go and may be influenced by radio frequency interference 2243 generated by an attacker. To avoid unnecessary resets, it is 2244 advisable to damp these indications, rather than passing them 2245 directly to the EAP. Since EAP supports retransmission, it is 2246 robust against transient connectivity losses. 2248 7.13 Separation of authenticator and backend authentication server 2250 It is possible for the EAP peer and authenticator to mutually 2251 authenticate, and derive a Master Session Key (MSK) for a ciphersuite 2252 used to protect subsequent data traffic. This does not present an 2253 issue on the peer, since the peer and EAP client reside on the same 2254 machine; all that is required is for the EAP client module to derive 2255 and pass a Transient Session Key (TSK) to the ciphersuite module. 2257 However, in the case where the authenticator and authentication 2258 server reside on different machines, there are several implications 2259 for security. 2261 [a] Authentication will occur between the peer and the authentication 2262 server, not between the peer and the authenticator. This means 2263 that it is not possible for the peer to validate the identity of 2264 the authenticator that it is speaking to, using EAP alone. 2266 [b] As discussed in [RFC3579], the authenticator is dependent on the 2267 AAA protocol in order to know the outcome of an authentication 2268 conversation, and does not look at the encapsulated EAP packet 2269 (if one is present) to determine the outcome. In practice this 2270 means that the AAA protocol spoken between the authenticator and 2271 authentication server MUST support per-packet authentication, 2272 integrity and replay protection. 2274 [c] Where EAP is used over lower layers which are not physically 2275 secure, subsequent to completion of the EAP conversation, a 2276 subsequent protocol SHOULD be run between the peer and 2277 authentication in order to mutually authenticate the peer and 2278 authenticator; guarantee liveness of the TSKs; provide protected 2279 ciphersuite and capabilities negotiation; and provide for 2280 synchronized key usage. 2282 [d] An EAP Master Session Key (MSK) negotiated between the peer and 2283 authentication server MAY be transmitted to the authenticator. 2284 Therefore a mechanism needs to be provided to transmit the MSK 2285 from the authentication server to the authenticator that needs 2286 it. The specification of the key transport and wrapping 2287 mechanism is outside the scope of this document. 2289 7.14 Cleartext Passwords 2291 EAP does not support cleartext password authentication. This 2292 omission is intentional. Where EAP is carried over physically 2293 insecure lower layers, including wireless LANs [IEEE-802.11] or the 2294 Internet, use of cleartext passwords would allow the password to be 2295 captured by an attacker with access to the lower layer. 2297 Since protocols encapsulating EAP, such as RADIUS [RFC3579], may not 2298 provide confidentiality, even where the lower layer is physically 2299 secure, EAP frames may be subsequently encapsulated for transport 2300 over the Internet where they may be captured by an attacker. 2302 As a result, cleartext passwords cannot be securely used within EAP, 2303 except where encapsulated within a protected tunnel with server 2304 authentication. Some of the same risks apply to EAP methods without 2305 dictionary attack resistance, as defined in Section 7.2.1. For 2306 details, see Section 7.6. 2308 8. Acknowledgments 2310 This protocol derives much of its inspiration from Dave Carrel's AHA 2311 draft as well as the PPP CHAP protocol [RFC1994]. Valuable feedback 2312 was provided by Yoshihiro Ohba of Toshiba America Research, Jari 2313 Arkko of Ericsson, Sachin Seth of Microsoft, Glen Zorn of Cisco 2314 Systems, Jesse Walker of Intel, Bill Arbaugh, Nick Petroni and Bryan 2315 Payne of the University of Maryland, Steve Bellovin of AT&T Research, 2316 Paul Funk of Funk Software, Pasi Eronen of Nokia, Joseph Salowey of 2317 Cisco and Paul Congdon of HP and members of the EAP working group. 2319 Normative References 2321 [RFC1661] Simpson, W., "The Point-to-Point Protocol (PPP)", STD 51, 2322 RFC 1661, July 1994. 2324 [RFC1750] Eastlake, D., Crocker, S. and J. Schiller, "Randomness 2325 Recommendations for Security", RFC 1750, December 1994. 2327 [RFC1994] Simpson, W., "PPP Challenge Handshake Authentication 2328 Protocol (CHAP)", RFC 1994, August 1996. 2330 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 2331 Requirement Levels", BCP 14, RFC 2119, March 1997. 2333 [RFC2243] Metz, C., "OTP Extended Responses", RFC 2243, November 2334 1997. 2336 [RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO 2337 10646", RFC 2279, January 1998. 2339 [RFC2289] Haller, N., Metz, C., Nesser, P. and M. Straw, "A One-Time 2340 Password System", RFC 2289, February 1998. 2342 [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an 2343 IANA Considerations Section in RFCs", BCP 26, RFC 2434, 2344 October 1998. 2346 [RFC2988] Paxson, V. and M. Allman, "Computing TCP's Retransmission 2347 Timer", RFC 2988, November 2000. 2349 [IEEE-802] 2350 Institute of Electrical and Electronics Engineers, "Local 2351 and Metropolitan Area Networks: Overview and 2352 Architecture", IEEE Standard 802, 1990. 2354 [IEEE-802.1X] 2355 Institute of Electrical and Electronics Engineers, "Local 2356 and Metropolitan Area Networks: Port-Based Network Access 2357 Control", IEEE Standard 802.1X, September 2001. 2359 Informative References 2361 [RFC793] Postel, J., "Transmission Control Protocol", STD 7, RFC 2362 793, September 1981. 2364 [RFC1510] Kohl, J. and B. Neuman, "The Kerberos Network 2365 Authentication Service (V5)", RFC 1510, September 1993. 2367 [RFC2222] Myers, J., "Simple Authentication and Security Layer 2368 (SASL)", RFC 2222, October 1997. 2370 [RFC2246] Dierks, T., Allen, C., Treese, W., Karlton, P., Freier, A. 2371 and P. Kocher, "The TLS Protocol Version 1.0", RFC 2246, 2372 January 1999. 2374 [RFC2284] Blunk, L. and J. Vollbrecht, "PPP Extensible 2375 Authentication Protocol (EAP)", RFC 2284, March 1998. 2377 [RFC2486] Aboba, B. and M. Beadles, "The Network Access Identifier", 2378 RFC 2486, January 1999. 2380 [RFC2401] Kent, S. and R. Atkinson, "Security Architecture for the 2381 Internet Protocol", RFC 2401, November 1998. 2383 [RFC2408] Maughan, D., Schneider, M. and M. Schertler, "Internet 2384 Security Association and Key Management Protocol 2385 (ISAKMP)", RFC 2408, November 1998. 2387 [RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange 2388 (IKE)", RFC 2409, November 1998. 2390 [RFC2433] Zorn, G. and S. Cobb, "Microsoft PPP CHAP Extensions", RFC 2391 2433, October 1998. 2393 [RFC2607] Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy 2394 Implementation in Roaming", RFC 2607, June 1999. 2396 [RFC2661] Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, G. 2397 and B. Palter, "Layer Two Tunneling Protocol "L2TP"", RFC 2398 2661, August 1999. 2400 [RFC2716] Aboba, B. and D. Simon, "PPP EAP TLS Authentication 2401 Protocol", RFC 2716, October 1999. 2403 [RFC2743] Linn, J., "Generic Security Service Application Program 2404 Interface Version 2, Update 1", RFC 2743, January 2000. 2406 [RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C., 2407 Schwarzbauer, H., Taylor, T., Rytina, I., Kalla, M., 2408 Zhang, L. and V. Paxson, "Stream Control Transmission 2409 Protocol", RFC 2960, October 2000. 2411 [RFC3454] Hoffman, P. and M. Blanchet, "Preparation of 2412 Internationalized Strings ("stringprep")", RFC 3454, 2413 December 2002. 2415 [DECEPTION] 2416 Slatalla, M. and J. Quittner, "Masters of Deception", 2417 Harper-Collins , New York, 1995. 2419 [RFC3579] Aboba, B. and P. Calhoun, "RADIUS Support For Extensible 2420 Authentication Protocol (EAP)", RFC 3579, May 2003. 2422 [KRBATTACK] 2423 Wu, T., "A Real-World Analysis of Kerberos Password 2424 Security", Proceedings of the 1999 ISOC Network and 2425 Distributed System Security Symposium, http:// 2426 www.isoc.org/isoc/conferences/ndss/99/proceedings/papers/ 2427 wu.pdf. 2429 [KRBLIM] Bellovin, S. and M. Merrit, "Limitations of the Kerberos 2430 authentication system", Proceedings of the 1991 Winter 2431 USENIX Conference, pp. 253-267, 1991. 2433 [KERB4WEAK] 2434 Dole, B., Lodin, S. and E. Spafford, "Misplaced trust: 2435 Kerberos 4 session keys", Proceedings of the Internet 2436 Society Network and Distributed System Security Symposium, 2437 pp. 60-70, March 1997. 2439 [IKEv2] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", 2440 draft-ietf-ipsec-ikev2-10 (work in progress), May 2003. 2442 [PPTPv1] Schneier, B. and Mudge, "Cryptanalysis of Microsoft's 2443 Point-to- Point Tunneling Protocol", Proceedings of the 2444 5th ACM Conference on Communications and Computer 2445 Security, ACM Press, November 1998. 2447 [IEEE-802.3] 2448 Institute of Electrical and Electronics Engineers, 2449 "Information technology - Telecommunications and 2450 Information Exchange between Systems - Local and 2451 Metropolitan Area Networks - Specific requirements - Part 2452 3: Carrier sense multiple access with collision detection 2453 (CSMA/CD) Access Method and Physical Layer 2454 Specifications", IEEE Standard 802.3, September 1998. 2456 [IEEE-802.11] 2457 Institute of Electrical and Electronics Engineers, 2458 "Information Technology - Telecommunications and 2459 Information Exchange between Systems - Local and 2460 Metropolitan Area Network - Specific Requirements - Part 2461 11: Wireless LAN Medium Access Control (MAC) and Physical 2462 Layer (PHY) Specifications", IEEE Standard 802.11, 1999. 2464 [SILVERMAN] 2465 Silverman, Robert D., "A Cost-Based Security Analysis of 2466 Symmetric and Asymmetric Key Lengths", RSA Laboratories 2467 Bulletin 13, April 2000 (Revised November 2001), http:// 2468 www.rsasecurity.com/rsalabs/bulletins/bulletin13.html. 2470 [IANA-EXP] 2471 Narten, T., "Assigning Experimental and Testing Numbers 2472 Considered Useful", 2473 draft-narten-iana-experimental-allocations-03 (work in 2474 progress), December 2002. 2476 [KEYFRAME] 2477 Aboba, B. and D. Simon, "EAP Keying Framework", 2478 draft-aboba-pppext-key-problem-07 (work in progress), 2479 March 2003. 2481 [SASLPREP] 2482 Zeilenga, K., "SASLprep: Stringprep profile for user names 2483 and passwords", draft-ietf-sasl-saslprep-03 (work in 2484 progress), May 2003. 2486 [IEEE-802.11i] 2487 Institute of Electrical and Electronics Engineers, 2488 "Unapproved Draft Supplement to Standard for 2489 Telecommunications and Information Exchange Between 2490 Systems - LAN/MAN Specific Requirements - Part 11: 2491 Wireless LAN Medium Access Control (MAC) and Physical 2492 Layer (PHY) Specifications: Specification for Enhanced 2493 Security", IEEE Draft 802.11i (work in progress), 2003. 2495 [DIAM-EAP] 2496 Eronen, P., Hiller, T. and G. Zorn, "Diameter Extensible 2497 Authentication Protocol (EAP) Application", 2498 draft-ietf-aaa-eap-02 (work in progress), June 2003. 2500 Authors' Addresses 2502 Larry J. Blunk 2503 Merit Network, Inc 2504 4251 Plymouth Rd., Suite 2000 2505 Ann Arbor, MI 48105-2785 2506 USA 2508 Phone: +1 734-647-9563 2509 Fax: +1 734-647-3185 2510 EMail: ljb@merit.edu 2512 John R. Vollbrecht 2513 Vollbrecht Consulting LLC 2514 9682 Alice Hill Drive 2515 Dexter, MI 48130 2516 USA 2518 Phone: 2519 EMail: jrv@umich.edu 2520 Bernard Aboba 2521 Microsoft Corporation 2522 One Microsoft Way 2523 Redmond, WA 98052 2524 USA 2526 Phone: +1 425 706 6605 2527 Fax: +1 425 936 6605 2528 EMail: bernarda@microsoft.com 2530 James Carlson 2531 Sun Microsystems, Inc 2532 1 Network Drive 2533 Burlington, MA 01803-2757 2534 USA 2536 Phone: +1 781 442 2084 2537 Fax: +1 781 442 1677 2538 EMail: james.d.carlson@sun.com 2540 Henrik Levkowetz 2541 ipUnplugged AB 2542 Arenavagen 33 2543 Stockholm S-121 28 2544 SWEDEN 2546 Phone: +46 8 725 9513 2547 EMail: henrik@levkowetz.com 2549 Appendix A. Changes from RFC 2284 2551 This section lists the major changes between [RFC2284] and this 2552 document. Minor changes, including style, grammar, spelling and 2553 editorial changes are not mentioned here. 2555 o The Terminology section (Section 1.2) has been expanded, defining 2556 more concepts and giving more exact definitions. 2558 o The two concepts Mutual authentication and Key derivation are 2559 introduced, and discussed throughout the document where 2560 appropriate. 2562 o In Section 2, it is explicitly specified that more than one 2563 exchange of Request and Response packets may occur as part of the 2564 EAP authentication exchange. How this may and may not be used is 2565 specified in detail in Section 2.1. 2567 o Also in Section 2, some requirements on the authenticator when 2568 acting in pass-through mode has been made explicit. 2570 o An EAP multiplexing model (Section 2.2) has been added, to 2571 illustrate a typical implementation of EAP. There is no 2572 requirement that an implementation conforms to this model, as long 2573 as the on-the-wire behavior is consistent with it. 2575 o As EAP is now in use with a variety of lower layers, not just PPP 2576 for which it was first designed, Section 3 on lower layer behavior 2577 has been added. 2579 o In the description of the EAP Request and Response interaction 2580 (Section 4.1), it has been more exactly specified when packets 2581 should be silently discarded, and also the behavior on receiving 2582 duplicate requests. The implementation notes in this section has 2583 been substantially expanded. 2585 o In Section 4.2, it has been clarified that Success and Failure 2586 packets must not contain additional data, and the implementation 2587 note has been expanded. A subsection giving requirements on 2588 processing of success and failure packets has been added. 2590 o Section 5 on EAP Request/Response Types lists two new Type values: 2591 the Expanded Type (Section 5.7), which is used to expand the Type 2592 value number space, and the Experimental Type. In the Expanded 2593 Type number space, the new Expanded Nak (Section 5.3.2) Type has 2594 been added. Clarifications have been made in the description of 2595 most of the existing Types. Security claims summaries have been 2596 added for authentication methods. 2598 o In Section 5, Section 5.1 and Section 5.2, requirements has been 2599 added that fields with displayable messages should contain UTF-8 2600 encoded ISO 10646 characters. 2602 o In Section 5.5, support for OTP Extended Responses [RFC2243] has 2603 been added to EAP OTP. 2605 o An IANA Considerations section (Section 6) has been added, giving 2606 registration policies for the numbering spaces defined for EAP. 2608 o The Security Considerations (Section 7) have been greatly 2609 expanded, aiming at giving a much more comprehensive coverage of 2610 possible threats and other security considerations. 2612 o In Section 7.5, text has been added on method-specific behavior, 2613 providing guidance on how EAP method-specific integrity checks 2614 should be processed. Where possible, it is desirable for a 2615 method-specific MIC to be computed over the entire EAP packet, 2616 including the EAP layer header (Code, Identifier, Length) and EAP 2617 method layer header (Type, Type-Data). 2619 Appendix B. Open issues 2621 (This section should be removed by the RFC editor before publication) 2623 Open issues relating to this specification are tracked on the 2624 following web site: 2626 http://www.drizzle.com/~aboba/EAP/eapissues.html 2628 The current working documents for this draft are available at this 2629 web site: 2631 http://www.levkowetz.com/pub/ietf/drafts/eap/ 2633 Intellectual Property Statement 2635 The IETF takes no position regarding the validity or scope of any 2636 intellectual property or other rights that might be claimed to 2637 pertain to the implementation or use of the technology described in 2638 this document or the extent to which any license under such rights 2639 might or might not be available; neither does it represent that it 2640 has made any effort to identify any such rights. Information on the 2641 IETF's procedures with respect to rights in standards-track and 2642 standards-related documentation can be found in BCP-11. Copies of 2643 claims of rights made available for publication and any assurances of 2644 licenses to be made available, or the result of an attempt made to 2645 obtain a general license or permission for the use of such 2646 proprietary rights by implementors or users of this specification can 2647 be obtained from the IETF Secretariat. 2649 The IETF invites any interested party to bring to its attention any 2650 copyrights, patents or patent applications, or other proprietary 2651 rights which may cover technology that may be required to practice 2652 this standard. Please address the information to the IETF Executive 2653 Director. 2655 Full Copyright Statement 2657 Copyright (C) The Internet Society (2003). All Rights Reserved. 2659 This document and translations of it may be copied and furnished to 2660 others, and derivative works that comment on or otherwise explain it 2661 or assist in its implementation may be prepared, copied, published 2662 and distributed, in whole or in part, without restriction of any 2663 kind, provided that the above copyright notice and this paragraph are 2664 included on all such copies and derivative works. However, this 2665 document itself may not be modified in any way, such as by removing 2666 the copyright notice or references to the Internet Society or other 2667 Internet organizations, except as needed for the purpose of 2668 developing Internet standards in which case the procedures for 2669 copyrights defined in the Internet Standards process must be 2670 followed, or as required to translate it into languages other than 2671 English. 2673 The limited permissions granted above are perpetual and will not be 2674 revoked by the Internet Society or its successors or assignees. 2676 This document and the information contained herein is provided on an 2677 "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING 2678 TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 2679 BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION 2680 HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF 2681 MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 2683 Acknowledgement 2685 Funding for the RFC Editor function is currently provided by the 2686 Internet Society.