idnits 2.17.1 draft-ietf-eap-rfc2284bis-06.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Looks like you're using RFC 2026 boilerplate. This must be updated to follow RFC 3978/3979, as updated by RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- == No 'Intended status' indicated for this document; assuming Proposed Standard Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** There are 8 instances of lines with control characters in the document. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year == Line 552 has weird spacing: '...d would need ...' == Line 635 has weird spacing: '...methods origi...' == Line 1417 has weird spacing: '...ed Type of 6 ...' == Line 1515 has weird spacing: '...pe-Data field...' == Line 1843 has weird spacing: '...; or by gener...' -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (September 29, 2003) is 7514 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) -- Looks like a reference, but probably isn't: '1' on line 1836 -- Looks like a reference, but probably isn't: '2' on line 1839 -- Looks like a reference, but probably isn't: '3' on line 1841 -- Looks like a reference, but probably isn't: '4' on line 1846 -- Looks like a reference, but probably isn't: '5' on line 1849 -- Looks like a reference, but probably isn't: '6' on line 1852 -- Looks like a reference, but probably isn't: '7' on line 1855 -- Looks like a reference, but probably isn't: '8' on line 1858 -- Looks like a reference, but probably isn't: '9' on line 1861 == Unused Reference: 'RFC2401' is defined on line 2534, but no explicit reference was found in the text == Unused Reference: 'IEEE-802.3' is defined on line 2605, but no explicit reference was found in the text ** Obsolete normative reference: RFC 1750 (Obsoleted by RFC 4086) ** Obsolete normative reference: RFC 2279 (Obsoleted by RFC 3629) ** Obsolete normative reference: RFC 2434 (Obsoleted by RFC 5226) ** Obsolete normative reference: RFC 2988 (Obsoleted by RFC 6298) -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE-802' -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE-802.1X' -- Obsolete informational reference (is this intentional?): RFC 793 (Obsoleted by RFC 9293) -- Obsolete informational reference (is this intentional?): RFC 1510 (Obsoleted by RFC 4120, RFC 6649) -- Obsolete informational reference (is this intentional?): RFC 2222 (Obsoleted by RFC 4422, RFC 4752) -- Obsolete informational reference (is this intentional?): RFC 2246 (Obsoleted by RFC 4346) -- Obsolete informational reference (is this intentional?): RFC 2284 (Obsoleted by RFC 3748) -- Obsolete informational reference (is this intentional?): RFC 2486 (Obsoleted by RFC 4282) -- Obsolete informational reference (is this intentional?): RFC 2401 (Obsoleted by RFC 4301) -- Obsolete informational reference (is this intentional?): RFC 2408 (Obsoleted by RFC 4306) -- Obsolete informational reference (is this intentional?): RFC 2409 (Obsoleted by RFC 4306) -- Obsolete informational reference (is this intentional?): RFC 2716 (Obsoleted by RFC 5216) -- Obsolete informational reference (is this intentional?): RFC 2960 (Obsoleted by RFC 4960) -- Obsolete informational reference (is this intentional?): RFC 3454 (Obsoleted by RFC 7564) == Outdated reference: A later version (-07) exists of draft-ietf-ipsra-pic-06 == Outdated reference: A later version (-17) exists of draft-ietf-ipsec-ikev2-10 == Outdated reference: A later version (-05) exists of draft-narten-iana-experimental-allocations-03 == Outdated reference: A later version (-10) exists of draft-ietf-sasl-saslprep-03 == Outdated reference: A later version (-10) exists of draft-ietf-aaa-eap-02 Summary: 6 errors (**), 0 flaws (~~), 14 warnings (==), 25 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 EAP Working Group L. Blunk 3 Internet-Draft Merit Network, Inc 4 Obsoletes: 2284 (if approved) J. Vollbrecht 5 Expires: March 29, 2004 Vollbrecht Consulting LLC 6 B. Aboba 7 Microsoft 8 J. Carlson 9 Sun 10 H. Levkowetz, Ed. 11 ipUnplugged 12 September 29, 2003 14 Extensible Authentication Protocol (EAP) 15 17 Status of this Memo 19 This document is an Internet-Draft and is in full conformance with 20 all provisions of Section 10 of RFC2026. 22 Internet-Drafts are working documents of the Internet Engineering 23 Task Force (IETF), its areas, and its working groups. Note that other 24 groups may also distribute working documents as Internet-Drafts. 26 Internet-Drafts are draft documents valid for a maximum of six months 27 and may be updated, replaced, or obsoleted by other documents at any 28 time. It is inappropriate to use Internet-Drafts as reference 29 material or to cite them other than as "work in progress." 31 The list of current Internet-Drafts can be accessed at http:// 32 www.ietf.org/ietf/1id-abstracts.txt. 34 The list of Internet-Draft Shadow Directories can be accessed at 35 http://www.ietf.org/shadow.html. 37 This Internet-Draft will expire on March 29, 2004. 39 Copyright Notice 41 Copyright (C) The Internet Society (2003). All Rights Reserved. 43 Abstract 45 This document defines the Extensible Authentication Protocol (EAP), 46 an authentication framework which supports multiple authentication 47 methods. EAP typically runs directly over data link layers such as 48 PPP or IEEE 802, without requiring IP. EAP provides its own support 49 for duplicate elimination and retransmission, but is reliant on lower 50 layer ordering guarantees. Fragmentation is not supported within EAP 51 itself; however, individual EAP methods may support this. 53 This document obsoletes RFC 2284. A summary of the changes between 54 this document and RFC 2284 is available in Appendix A. 56 Table of Contents 58 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4 59 1.1 Specification of Requirements . . . . . . . . . . . . 4 60 1.2 Terminology . . . . . . . . . . . . . . . . . . . . . 4 61 1.3 Applicability . . . . . . . . . . . . . . . . . . . . 6 62 2. Extensible Authentication Protocol (EAP) . . . . . . . . . . 7 63 2.1 Support for sequences . . . . . . . . . . . . . . . . 9 64 2.2 EAP multiplexing model . . . . . . . . . . . . . . . . 10 65 2.3 Pass-through behavior . . . . . . . . . . . . . . . . 12 66 2.4 Peer-to-Peer Operation . . . . . . . . . . . . . . . . 13 67 3. Lower layer behavior . . . . . . . . . . . . . . . . . . . . 14 68 3.1 Lower layer requirements . . . . . . . . . . . . . . . 14 69 3.2 EAP usage within PPP . . . . . . . . . . . . . . . . . 16 70 3.2.1 PPP Configuration Option Format . . . . . . . . 17 71 3.3 EAP usage within IEEE 802 . . . . . . . . . . . . . . 17 72 3.4 Lower layer indications . . . . . . . . . . . . . . . 17 73 4. EAP Packet format . . . . . . . . . . . . . . . . . . . . . 18 74 4.1 Request and Response . . . . . . . . . . . . . . . . . 19 75 4.2 Success and Failure . . . . . . . . . . . . . . . . . 22 76 4.3 Retransmission Behavior . . . . . . . . . . . . . . . 24 77 5. Initial EAP Request/Response Types . . . . . . . . . . . . . 25 78 5.1 Identity . . . . . . . . . . . . . . . . . . . . . . . 26 79 5.2 Notification . . . . . . . . . . . . . . . . . . . . . 28 80 5.3 Nak . . . . . . . . . . . . . . . . . . . . . . . . . 29 81 5.3.1 Legacy Nak . . . . . . . . . . . . . . . . . . . 29 82 5.3.2 Expanded Nak . . . . . . . . . . . . . . . . . . 31 83 5.4 MD5-Challenge . . . . . . . . . . . . . . . . . . . . 33 84 5.5 One-Time Password (OTP) . . . . . . . . . . . . . . . 35 85 5.6 Generic Token Card (GTC) . . . . . . . . . . . . . . . 36 86 5.7 Expanded Types . . . . . . . . . . . . . . . . . . . . 37 87 5.8 Experimental . . . . . . . . . . . . . . . . . . . . . 39 88 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . 39 89 6.1 Packet Codes . . . . . . . . . . . . . . . . . . . . . 40 90 6.2 Method Types . . . . . . . . . . . . . . . . . . . . . 40 91 7. Security Considerations . . . . . . . . . . . . . . . . . . 41 92 7.1 Threat model . . . . . . . . . . . . . . . . . . . . . 41 93 7.2 Security claims . . . . . . . . . . . . . . . . . . . 42 94 7.2.1 Security claims terminology for EAP methods . . 43 95 7.3 Identity protection . . . . . . . . . . . . . . . . . 45 96 7.4 Man-in-the-middle attacks . . . . . . . . . . . . . . 46 97 7.5 Packet modification attacks . . . . . . . . . . . . . 47 98 7.6 Dictionary attacks . . . . . . . . . . . . . . . . . . 48 99 7.7 Connection to an untrusted network . . . . . . . . . . 48 100 7.8 Negotiation attacks . . . . . . . . . . . . . . . . . 49 101 7.9 Implementation idiosyncrasies . . . . . . . . . . . . 49 102 7.10 Key derivation . . . . . . . . . . . . . . . . . . . . 50 103 7.11 Weak ciphersuites . . . . . . . . . . . . . . . . . . 52 104 7.12 Link layer . . . . . . . . . . . . . . . . . . . . . . 52 105 7.13 Separation of authenticator and backend authentication 106 server . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 107 7.14 Cleartext Passwords . . . . . . . . . . . . . . . . . 54 108 8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . 54 109 Normative References . . . . . . . . . . . . . . . . . . . . 55 110 Informative References . . . . . . . . . . . . . . . . . . . 55 111 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 58 112 A. Changes from RFC 2284 . . . . . . . . . . . . . . . . . . . 59 113 B. Open issues . . . . . . . . . . . . . . . . . . . . . . . . 61 114 Intellectual Property and Copyright Statements . . . . . . . 62 116 1. Introduction 118 This document defines the Extensible Authentication Protocol (EAP), 119 an authentication framework which supports multiple authentication 120 methods. EAP typically runs directly over data link layers such as 121 PPP or IEEE 802, without requiring IP. EAP provides its own support 122 for duplicate elimination and retransmission, but is reliant on lower 123 layer ordering guarantees. Fragmentation is not supported within EAP 124 itself; however, individual EAP methods may support this. 126 EAP may be used on dedicated links as well as switched circuits, and 127 wired as well as wireless links. To date, EAP has been implemented 128 with hosts and routers that connect via switched circuits or dial-up 129 lines using PPP [RFC1661]. It has also been implemented with switches 130 and access points using IEEE 802 [IEEE-802]. EAP encapsulation on 131 IEEE 802 wired media is described in [IEEE-802.1X], and encapsulation 132 on IEEE wireless LANs in [IEEE-802.11i]. 134 One of the advantages of the EAP architecture is its flexibility. EAP 135 is used to select a specific authentication mechanism, typically 136 after the authenticator requests more information in order to 137 determine the specific authentication method to be used. Rather than 138 requiring the authenticator to be updated to support each new 139 authentication method, EAP permits the use of a backend 140 authentication server which may implement some or all authentication 141 methods, with the authenticator acting as a pass-through for some or 142 all methods and peers. 144 Within this document, authenticator requirements apply regardless of 145 whether the authenticator is operating as a pass-through or not. 146 Where the requirement is meant to apply to either the authenticator 147 or backend authentication server, depending on where the EAP 148 authentication is terminated, the term "EAP server" will be used. 150 1.1 Specification of Requirements 152 In this document, several words are used to signify the requirements 153 of the specification. These words are often capitalized. The key 154 words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", 155 "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document 156 are to be interpreted as described in [RFC2119]. 158 1.2 Terminology 160 This document frequently uses the following terms: 162 authenticator 163 The end of the link initiating EAP authentication. The term 164 Authenticator is used in [IEEE-802.1X], and authenticator 165 has the same meaning in this document. 167 peer 168 The end of the link that responds to the authenticator. In 169 [IEEE-802.1X], this end is known as the Supplicant. 171 backend authentication server 172 A backend authentication server is an entity that provides 173 an authentication service to an authenticator. When used, 174 this server typically executes EAP methods for the 175 authenticator. This terminology is also used in 176 [IEEE-802.1X]. 178 AAA 179 Authentication, Authorization and Accounting. AAA protocols 180 with EAP support include RADIUS [RFC3579] and Diameter 181 [DIAM-EAP]. In this document, the terms "AAA server" and 182 "backend authentication server" are used interchangeably. 184 Displayable Message 185 This is interpreted to be a human readable string of 186 characters. The message encoding MUST follow the UTF-8 187 transformation format [RFC2279]. 189 EAP server 190 The entity that terminates the EAP authentication method 191 with the peer. In the case where no backend authentication 192 server is used, the EAP server is part of the 193 authenticator. In the case where the authenticator 194 operates in pass-through mode, the EAP server is located on 195 the backend authentication server. 197 Silently Discard 198 This means the implementation discards the packet without 199 further processing. The implementation SHOULD provide the 200 capability of logging the event, including the contents of 201 the silently discarded packet, and SHOULD record the event 202 in a statistics counter. 204 Successful authentication 205 In the context of this document, "successful 206 authentication" is an exchange of EAP messages, as a result 207 of which the authenticator decides to allow access by the 208 peer, and the peer decides to use this access. The 209 authenticator's decision typically involves both 210 authentication and authorization aspects; the peer may 211 successfully authenticate to the authenticator but access 212 may be denied by the authenticator due to policy reasons. 214 Message Integrity Check (MIC) 215 A keyed hash function used for authentication and integrity 216 protection of data. This is usually called a Message 217 Authentication Code (MAC), but IEEE 802 specifications (and 218 this document) use the acronym MIC to avoid confusion with 219 Medium Access Control. 221 Cryptographic separation 222 Two keys (x and y) are "cryptographically separate" if an 223 adversary that knows all messages exchanged in the protocol 224 cannot compute x from y or y from x without "breaking" some 225 cryptographic assumption. In particular, this definition 226 allows that the adversary has the knowledge of all nonces 227 sent in cleartext as well as all predictable counter values 228 used in the protocol. Breaking a cryptographic assumption 229 would typically require inverting a one-way function or 230 predicting the outcome of a cryptographic pseudo-random 231 number generator without knowledge of the secret state. In 232 other words, if the keys are cryptographically separate, 233 there is no shortcut to compute x from y or y from x, but 234 the work an adversary must do to perform this computation 235 is equivalent to performing exhaustive search for the 236 secret state value. 238 Master Session Key (MSK) 239 Keying material that is derived between the EAP peer and 240 server and exported by the EAP method. The MSK is at least 241 64 octets in length. In existing implementations a AAA 242 server acting as an EAP server transports the MSK to the 243 authenticator. 245 Extended Master Session Key (EMSK) 246 Additional keying material derived between the EAP client 247 and server that is exported by the EAP method. The EMSK is 248 at least 64 octets in length. The EMSK is reserved for 249 future uses that are not defined yet and is not provided to 250 a third party. 252 1.3 Applicability 254 EAP is an authentication framework primarily for use in situations 255 such as network access, in which IP layer connectivity may not be 256 available. 258 Since the goal of EAP is to support authentication without requiring 259 IP connectivity, it provides just enough support for the reliable 260 transport of authentication protocols, and no more. EAP is a 261 lock-step protocol and does not support an efficient reliable 262 transport service as in TCP [RFC793] or SCTP [RFC2960]. While EAP 263 provides support for retransmission, it assumes ordering guarantees 264 provided by the lower layer, so that out of order reception is not 265 supported. 267 As noted in Section 3.1, EAP does not support fragmentation and 268 reassembly as in IP, although EAP methods may provide support for 269 this. As a result, authentication protocols generating payloads 270 larger than the EAP MTU will need to be modified in order to provide 271 fragmentation support. 273 EAP authentication is initiated by the authenticator, whereas many 274 authentication protocols are initiated by the client (peer). As a 275 result, it may be necessary for an algorithm to add 0.5 - 1 276 additional roundtrips between the client and authenticator in order 277 to run over EAP. 279 As a result, an authentication algorithm will typically require more 280 round-trips when run over EAP than when run directly over IP. 281 Additionally, certificate-based authentication algorithms using long 282 certificate chains can result in many round-trips due to 283 fragmentation. 285 Where EAP runs over a lower layer in which significant packet loss is 286 experienced, or where the connection between the authenticator and 287 authentication server experiences significant packet loss, EAP 288 methods requiring many round-trips may experience difficulties. In 289 these situations, use of EAP methods with fewer round trips is 290 advisable. 292 Where transport efficiency is a consideration, and IP transport is 293 available, it may be preferable to expose an artificially high EAP 294 MTU to EAP and allow fragmentation to take place in IP. 295 Alternatively, it is possible to choose other security mechanisms 296 such as TLS [RFC2246] or IKE [RFC2409] or an alternative 297 authentication framework such as SASL [RFC2222] or GSS-API [RFC2743]. 299 2. Extensible Authentication Protocol (EAP) 301 The EAP authentication exchange proceeds as follows: 303 [1] The authenticator sends a Request to authenticate the peer. The 304 Request has a Type field to indicate what is being requested. 305 Examples of Request Types include Identity, MD5-challenge, etc. 307 The MD5-challenge Type corresponds closely to the CHAP 308 authentication protocol [RFC1994]. Typically, the authenticator 309 will send an initial Identity Request; however, an initial 310 Identity Request is not required, and MAY be bypassed. For 311 example, the identity may not be required where it is determined 312 by the port to which the peer has connected (leased lines, 313 dedicated switch or dial-up ports); or where the identity is 314 obtained in another fashion (via calling station identity or MAC 315 address, in the Name field of the MD5-Challenge Response, etc.). 317 [2] The peer sends a Response packet in reply to a valid Request. As 318 with the Request packet the Response packet contains a Type 319 field, which corresponds to the Type field of the Request. 321 [3] The authenticator sends an additional Request packet, and the 322 peer replies with a Response. The sequence of Requests and 323 Responses continues as long as needed. EAP is a 'lock step' 324 protocol, so that other than the initial Request, a new Request 325 cannot be sent prior to receiving a valid Response. The 326 authenticator is responsible for retransmitting requests as 327 described in Section 4.1. After a suitable number of 328 retransmissions, the authenticator SHOULD end the EAP 329 conversation. The authenticator MUST NOT send a Success or 330 Failure packet when retransmitting or when it fails to get a 331 response from the peer. 333 [4] The conversation continues until the authenticator cannot 334 authenticate the peer (unacceptable Responses to one or more 335 Requests), in which case the authenticator implementation MUST 336 transmit an EAP Failure (Code 4). Alternatively, the 337 authentication conversation can continue until the authenticator 338 determines that successful authentication has occurred, in which 339 case the authenticator MUST transmit an EAP Success (Code 3). 341 Advantages: 343 o The EAP protocol can support multiple authentication mechanisms 344 without having to pre-negotiate a particular one. 346 o Network Access Server (NAS) devices (e.g., a switch or access 347 point) do not have to understand each authentication method and 348 MAY act as a pass-through agent for a backend authentication 349 server. Support for pass-through is optional. An authenticator 350 MAY authenticate local peers while at the same time acting as a 351 pass-through for non-local peers and authentication methods it 352 does not implement locally. 354 o Separation of the authenticator from the backend authentication 355 server simplifies credentials management and policy decision 356 making. 358 Disadvantages: 360 o For use in PPP, EAP does require the addition of a new 361 authentication Type to PPP LCP and thus PPP implementations will 362 need to be modified to use it. It also strays from the previous 363 PPP authentication model of negotiating a specific authentication 364 mechanism during LCP. Similarly, switch or access point 365 implementations need to support [IEEE-802.1X] in order to use EAP. 367 o Where the authenticator is separate from the backend 368 authentication server, this complicates the security analysis and, 369 if needed, key distribution. 371 2.1 Support for sequences 373 An EAP conversation MAY utilize a sequence of methods. A common 374 example of this is an Identity request followed by a single EAP 375 authentication method such as an MD5-Challenge. However the peer and 376 authenticator MUST utilize only one authentication method (Type 4 or 377 greater) within an EAP conversation, after which the authenticator 378 MUST send a Success or Failure packet. 380 Once a peer has sent a Response of the same Type as the initial 381 Request, an authenticator MUST NOT send a Request of a different Type 382 prior to completion of the final round of a given method (with the 383 exception of a Notification-Request) and MUST NOT send a Request for 384 an additional method of any Type after completion of the initial 385 authentication method; a peer receiving such Requests MUST treat them 386 as invalid, and silently discard them. As a result, Identity Requery 387 is not supported. 389 A peer MUST NOT send a Nak (legacy or expanded) in reply to a 390 Request, after an initial non-Nak Response has been sent. Since 391 spoofed EAP Request packets may be sent by an attacker, an 392 authenticator receiving an unexpected Nak SHOULD discard it and log 393 the event. 395 Multiple authentication methods within an EAP conversation are not 396 supported due to their vulnerability to man-in-the-middle attacks 397 (see Section 7.4) and incompatibility with existing implementations. 399 Where a single EAP authentication method is utilized, but other 400 methods are run within it (a "tunneled" method) the prohibition 401 against multiple authentication methods does not apply. Such 402 "tunneled" methods appear as a single authentication method to EAP. 403 Backward compatibility can be provided, since a peer not supporting a 404 "tunneled" method can reply to the initial EAP-Request with a Nak 405 (legacy or expanded). To address security vulnerabilities, 406 "tunneled" methods MUST support protection against man-in-the-middle 407 attacks. 409 2.2 EAP multiplexing model 411 Conceptually, EAP implementations consist of the following 412 components: 414 [a] Lower layer. The lower layer is responsible for transmitting and 415 receiving EAP frames between the peer and authenticator. EAP has 416 been run over a variety of lower layers including PPP; wired IEEE 417 802 LANs [IEEE-802.1X]; IEEE 802.11 wireless LANs [IEEE-802.11]; 418 UDP (L2TP [RFC2661] and IKEv2 [IKEv2]); and TCP [PIC]. Lower 419 layer behavior is discussed in Section 3. 421 [b] EAP layer. The EAP layer receives and transmits EAP packets via 422 the lower layer, implements duplicate detection and 423 retransmission, and delivers and receives EAP messages to and 424 from EAP methods. 426 [c] EAP method. EAP methods implement the authentication algorithms 427 and receive and transmit EAP messages via the EAP layer. Since 428 fragmentation support is not provided by EAP itself, this is the 429 responsibility of EAP methods, which are discussed in Section 5. 431 The EAP multiplexing model is illustrated in Figure 1 below. Note 432 that there is no requirement that an implementation conform to this 433 model, as long as the on-the-wire behavior is consistent with it. 435 +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ 436 | | | | | | 437 | EAP method| EAP method| | EAP method| EAP method| 438 | Type = X | Type = Y | | Type = X | Type = Y | 439 | V | | | ^ | | 440 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 441 | ! | | ! | 442 | EAP ! layer | | EAP ! layer | 443 | ! | | ! | 444 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 445 | ! | | ! | 446 | Lower ! layer | | Lower ! layer | 447 | ! | | ! | 448 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 449 ! ! 450 ! Peer ! Authenticator 451 +------------>-------------+ 453 Figure 1: EAP Multiplexing Model 455 Within EAP, the Type field functions much like a port number in UDP 456 or TCP. It is assumed that the EAP layer multiplexes incoming EAP 457 packets according to their Type, and delivers them only to the EAP 458 method corresponding to that Type code. 460 Since EAP authentication methods may wish to access the Identity, 461 implementations SHOULD make the Identity Request and Response 462 accessible to authentication methods (Types 4 or greater) in addition 463 to the Identity method. The Identity Type is discussed in Section 464 5.1. 466 A Notification Response is only used as confirmation that the peer 467 received the Notification Request, not that it has processed it, or 468 displayed the message to the user. It cannot be assumed that the 469 contents of the Notification Request or Response is available to 470 another method. The Notification Type is discussed in Section 5.2. 472 Nak (Type 3) or Expanded Nak (Type 254) are utilized for the purposes 473 of method negotiation. Peers respond to an initial EAP Request for 474 an unacceptable Type with a Nak Response (Type 3) or Expanded Nak 475 Response (Type 254). It cannot be assumed that the contents of the 476 Nak Response(s) are available to another method. The Nak Type(s) are 477 discussed in Section 5.3. 479 EAP packets with codes of Success or Failure do not include a Type, 480 and are not delivered to an EAP method. Success and Failure are 481 discussed in Section 4.2. 483 Given these considerations, the Success, Failure, Nak Response(s) and 484 Notification Request/Response messages MUST NOT be used to carry data 485 destined for delivery to other EAP methods. 487 2.3 Pass-through behavior 489 Where an authenticator operates as a pass-through, it forwards 490 packets back and forth between the peer and a backend authentication 491 server, based on the EAP layer header fields (Code, Identifier, 492 Length). This includes performing validity checks on the Code, 493 Identifier and Length fields, as described in Section 4.1. 495 Since pass-through authenticators rely on a backend authenticator 496 server to implement methods, the EAP method layer header fields 497 (Type, Type-Data) are not examined as part of the forwarding 498 decision. The forwarding model is illustrated in Figure 2. Compliant 499 pass-through authenticator implementations MUST by default be capable 500 of forwarding packets from any EAP method. The use of the RADIUS 501 protocol for encapsulation of EAP in pass-through operation is 502 described in [RFC3579]. 504 Peer Pass-through Authenticator Authentication 505 Server 507 +-+-+-+-+-+-+ +-+-+-+-+-+-+ 508 | | | | 509 |EAP method | |EAP method | 510 | V | | ^ | 511 +-+-+-!-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-!-+-+-+ 512 | ! | | | | | ! | 513 |EAP !layer| | EAP layer | EAP layer | |EAP !layer| 514 | ! | | +-----+-----+ | | ! | 515 | ! | | ! | ! | | ! | 516 +-+-+-!-+-+-+ +-+-+-!-+-+-+-+-+-!-+-+-+ +-+-+-!-+-+-+ 517 | ! | | ! | ! | | ! | 518 |Lower!layer| |Lower!layer| AAA ! /IP | | AAA ! /IP | 519 | ! | | ! | ! | | ! | 520 +-+-+-!-+-+-+ +-+-+-!-+-+-+-+-+-!-+-+-+ +-+-+-!-+-+-+ 521 ! ! ! ! 522 ! ! ! ! 523 +-------->-----+ +------->------+ 525 Figure 2: Pass-through Authenticator 527 For sessions in which the authenticator acts as a pass-through, it 528 MUST determine the outcome of the authentication solely based on the 529 Accept/Reject indication sent by the backend authentication server; 530 the outcome MUST NOT be determined by the contents of an EAP packet 531 sent along with the Accept/Reject indication, or the absence of such 532 an encapsulated EAP packet. 534 2.4 Peer-to-Peer Operation 536 Since EAP is a peer-to-peer protocol, an independent and simultaneous 537 authentication may take place in the reverse direction (depending on 538 the capabilities of the lower layer). Both peers may act as 539 authenticators and authenticatees at the same time. 541 Although EAP supports peer-to-peer operation, selected EAP methods, 542 AAA protocols and link layers may not support this. For example, 543 EAP-TLS [RFC2716] is a client-server protocol requiring a different 544 certificate profile for the client and server. This implies that a 545 host supporting both the EAP-TLS peer and authenticator roles would 546 need to be provisioned with two distinct certificates, one 547 appropriate for each role. 549 Some EAP methods may support asymmetric authentication, with one type 550 of credential being required for the peer and another type for the 551 authenticator. Hosts supporting peer-to-peer operation with such a 552 method would need to be provisioned with both types of credentials. 554 AAA protocols such as RADIUS/EAP [RFC3579] and Diameter EAP 555 [DIAM-EAP] only support "passthrough" operation on behalf of an 556 authenticator, not a peer. For example, as noted in [RFC3579] Section 557 2.6.2, a RADIUS server responds to an Access-Request encapsulating an 558 EAP-Request with an Access-Reject. 560 Link layers such as IEEE 802.11 may only support uni-directional 561 derivation and transport of transient session keys. For example, the 562 group-key handshake defined in [IEEE-802.11i] is uni-directional, 563 since in IEEE 802.11 only the Access Point (AP) sends multicast 564 traffic. This means that in ad-hoc operation where either peer may 565 send multicast traffic, two uni-directional group-key exchanges are 566 required. Due to constraints imposed by the 4-way unicast key 567 handshake state machine, this also implies two 4-way handshake and 568 EAP method exchanges. 570 Link layers such as IEEE 802.11 adhoc also do not support "tie 571 breaking" wherein two hosts initiating authentication with each other 572 will only go forward with a single authentication. This implies that 573 even if 802.11 were to support a bi-directional group-key handshake, 574 then two authentications, one in each direction, might still occur. 576 3. Lower layer behavior 578 3.1 Lower layer requirements 580 EAP makes the following assumptions about lower layers: 582 [1] Unreliable transport. In EAP, the authenticator retransmits 583 Requests that have not yet received Responses, so that EAP does 584 not assume that lower layers are reliable. Since EAP defines its 585 own retransmission behavior, it is possible (though undesirable) 586 for retransmission to occur both in the lower layer and the EAP 587 layer when EAP is run over a reliable lower layer. 589 Note that EAP Success and Failure packets are not retransmitted. 590 Without a reliable lower layer, and a non-negligible error rate, 591 these packets can be lost, resulting in timeouts. It is therefore 592 desirable for implementations to improve their resilience to loss 593 of EAP Success or Failure packets, as described in Section 4.2. 595 [2] Lower layer error detection. While EAP does not assume that the 596 lower layer is reliable, it does rely on lower layer error 597 detection (e.g., CRC, Checksum, MIC, etc.). EAP methods may not 598 include a MIC, or if they do, it may not be computed over all the 599 fields in the EAP packet, such as the Code, Identifier, Length or 600 Type fields. As a result, without lower layer error detection, 601 undetected errors could creep into the EAP layer or EAP method 602 layer header fields, resulting in authentication failures. 604 For example, EAP TLS [RFC2716], which computes its MIC over the 605 Type-Data field only, regards MIC validation failures as a fatal 606 error. Without lower layer error detection, this method and 607 others like it will not perform reliably. 609 [3] Lower layer security. EAP assumes that lower layers either 610 provide physical security (e.g., wired PPP or IEEE 802 links) or 611 support per-packet authentication, integrity and replay 612 protection. EAP SHOULD NOT be used on physically insecure links 613 (e.g., wireless or the Internet) where subsequent data is not 614 protected by per-packet authentication, integrity and replay 615 protection. 617 [4] Minimum MTU. EAP is capable of functioning on lower layers that 618 provide an EAP MTU size of 1020 octets or greater. 620 EAP does not support path MTU discovery, and fragmentation and 621 reassembly is not supported by EAP, nor by the methods defined in 622 this specification: the Identity (1), Notification (2), Nak 623 Response (3), MD5-Challenge (4), One Time Password (5), Generic 624 Token Card (6) and expanded Nak Response (254) Types. 626 Typically, the EAP peer obtains information on the EAP MTU from 627 the lower layers and sets the EAP frame size to an appropriate 628 value. Where the authenticator operates in pass-through mode, 629 the authentication server does not have a direct way of 630 determining the EAP MTU, and therefore relies on the 631 authenticator to provide it with this information, such as via 632 the Framed-MTU attribute, as described in [RFC3579], Section 2.4. 634 While methods such as EAP-TLS [RFC2716] support fragmentation and 635 reassembly, EAP methods originally designed for use within PPP 636 where a 1500 octet MTU is guaranteed for control frames (see 637 [RFC1661], Section 6.1) may lack fragmentation and reassembly 638 features. 640 EAP methods can assume a minimum EAP MTU of 1020 octets, in the 641 absence of other information. EAP methods SHOULD include support 642 for fragmentation and reassembly if their payloads can be larger 643 than this minimum EAP MTU. 645 EAP is a lock-step protocol, which implies a certain inefficiency 646 when handling fragmentation and reassembly. Therefore if the 647 lower layer supports fragmentation and reassembly (such as where 648 EAP is transported over IP), it may be preferable for 649 fragmentation and reassembly to occur in the lower layer rather 650 than in EAP. This can be accomplished by providing an 651 artificially large EAP MTU to EAP, causing fragmentation and 652 reassembly to be handled within the lower layer. 654 [5] Possible duplication. Where the lower layer is reliable, it will 655 provide the EAP layer with a non-duplicated stream of packets. 656 However, while it is desirable that lower layers provide for 657 non-duplication, this is not a requirement. The Identifier field 658 provides both the peer and authenticator with the ability to 659 detect duplicates. 661 [6] Ordering guarantees. EAP does not require the Identifier to be 662 monotonically increasing, and so is reliant on lower layer 663 ordering guarantees for correct operation. EAP was originally 664 defined to run on PPP, and [RFC1661] Section 1 has an ordering 665 requirement: 667 "The Point-to-Point Protocol is designed for simple links 668 which transport packets between two peers. These links 669 provide full-duplex simultaneous bi-directional operation, and 670 are assumed to deliver packets in order." 672 Lower layer transports for EAP MUST preserve ordering between a 673 source and destination, at a given priority level (the ordering 674 guarantee provided by [IEEE-802]). 676 3.2 EAP usage within PPP 678 In order to establish communications over a point-to-point link, each 679 end of the PPP link must first send LCP packets to configure the data 680 link during Link Establishment phase. After the link has been 681 established, PPP provides for an optional Authentication phase before 682 proceeding to the Network-Layer Protocol phase. 684 By default, authentication is not mandatory. If authentication of 685 the link is desired, an implementation MUST specify the 686 Authentication Protocol Configuration Option during Link 687 Establishment phase. 689 If the identity of the peer has been established in the 690 Authentication phase, the server can use that identity in the 691 selection of options for the following network layer negotiations. 693 When implemented within PPP, EAP does not select a specific 694 authentication mechanism at PPP Link Control Phase, but rather 695 postpones this until the Authentication Phase. This allows the 696 authenticator to request more information before determining the 697 specific authentication mechanism. This also permits the use of a 698 "backend" server which actually implements the various mechanisms 699 while the PPP authenticator merely passes through the authentication 700 exchange. The PPP Link Establishment and Authentication phases, and 701 the Authentication Protocol Configuration Option, are defined in The 702 Point-to-Point Protocol (PPP) [RFC1661]. 704 3.2.1 PPP Configuration Option Format 706 A summary of the PPP Authentication Protocol Configuration Option 707 format to negotiate EAP is shown below. The fields are transmitted 708 from left to right. 710 Exactly one EAP packet is encapsulated in the Information field of a 711 PPP Data Link Layer frame where the protocol field indicates type hex 712 C227 (PPP EAP). 714 0 1 2 3 715 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 716 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 717 | Type | Length | Authentication Protocol | 718 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 720 Type 722 3 724 Length 726 4 728 Authentication Protocol 730 C227 (Hex) for Extensible Authentication Protocol (EAP) 732 3.3 EAP usage within IEEE 802 734 The encapsulation of EAP over IEEE 802 is defined in [IEEE-802.1X]. 735 The IEEE 802 encapsulation of EAP does not involve PPP, and IEEE 736 802.1X does not include support for link or network layer 737 negotiations. As a result, within IEEE 802.1X it is not possible to 738 negotiate non-EAP authentication mechanisms, such as PAP or CHAP 739 [RFC1994]. 741 3.4 Lower layer indications 743 The reliability and security of lower layer indications is dependent 744 on the lower layer. Since EAP is media independent, the presence or 745 absence of lower layer security is not taken into account in the 746 processing of EAP messages. 748 To improve reliability, if a peer receives a lower layer success 749 indication as defined in Section 7.2, it MAY conclude that a Success 750 packet has been lost, and behave as if it had actually received a 751 Success packet. This includes choosing to ignore the Success in some 752 circumstances as described in Section 4.2. 754 A discussion of some reliability and security issues with lower layer 755 indications in PPP, IEEE 802 wired networks and IEEE 802.11 wireless 756 LANs can be found in the Security Considerations, Section 7.12. 758 After EAP authentication is complete, the peer will typically 759 transmit data to the network via the authenticator. In order to 760 provide assurance that the peer transmitting data is the same entity 761 that successfully completed EAP authentication, the lower layer needs 762 to bind per-packet integrity, authentication and replay protection to 763 the original EAP authentication, using keys derived during EAP 764 authentication. Alternatively, the lower layer needs to be 765 physically secure. Otherwise it is possible for subsequent data 766 traffic to be hijacked or replayed. 768 As a result of these considerations, EAP SHOULD be used only when 769 lower layers provide physical security for data (e.g., wired PPP or 770 IEEE 802 links), or for insecure links, where per-packet 771 authentication, integrity and replay protection is provided. 773 Where keying material for the lower layer ciphersuite is itself 774 provided by EAP, ciphersuite negotiation and key activation is 775 controlled by the lower layer. In PPP, ciphersuites are negotiated 776 within ECP so that it is not possible to use keys derived from EAP 777 authentication until the completion of ECP. Therefore an initial EAP 778 exchange cannot protected by a PPP ciphersuite, although EAP 779 re-authentication can be protected. 781 In IEEE 802 media, initial key activation also typically occurs after 782 completion of EAP authentication. Therefore an initial EAP exchange 783 typically cannot be protected by the lower layer ciphersuite, 784 although an EAP re-authentication or pre-authentication exchange can 785 be protected. 787 4. EAP Packet format 788 A summary of the EAP packet format is shown below. The fields are 789 transmitted from left to right. 791 0 1 2 3 792 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 793 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 794 | Code | Identifier | Length | 795 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 796 | Data ... 797 +-+-+-+-+ 799 Code 801 The Code field is one octet and identifies the Type of EAP packet. 802 EAP Codes are assigned as follows: 804 1 Request 805 2 Response 806 3 Success 807 4 Failure 809 Since EAP only defines Codes 1-4, EAP packets with other codes 810 MUST be silently discarded by both authenticators and peers. 812 Identifier 814 The Identifier field is one octet and aids in matching Responses 815 with Requests. 817 Length 819 The Length field is two octets and indicates the length of the EAP 820 packet including the Code, Identifier, Length and Data fields. 821 Octets outside the range of the Length field should be treated as 822 Data Link Layer padding and MUST be ignored on reception. A 823 message with the Length field set to a value larger than the 824 number of received octets MUST be silently discarded. 826 Data 828 The Data field is zero or more octets. The format of the Data 829 field is determined by the Code field. 831 4.1 Request and Response 832 Description 834 The Request packet (Code field set to 1) is sent by the 835 authenticator to the peer. Each Request has a Type field which 836 serves to indicate what is being requested. Additional Request 837 packets MUST be sent until a valid Response packet is received, or 838 an optional retry counter expires. 840 Retransmitted Requests MUST be sent with the same Identifier value 841 in order to distinguish them from new Requests. The content of the 842 data field is dependent on the Request Type. The peer MUST send a 843 Response packet in reply to a valid Request packet. Responses 844 MUST only be sent in reply to a valid Request and never 845 retransmitted on a timer. 847 If a peer receives a valid duplicate Request for which it has 848 already sent a Response, it MUST resend its original Response 849 without reprocessing the Request. Requests MUST be processed in 850 the order that they are received, and MUST be processed to their 851 completion before inspecting the next Request. 853 A summary of the Request and Response packet format is shown below. 854 The fields are transmitted from left to right. 856 0 1 2 3 857 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 858 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 859 | Code | Identifier | Length | 860 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 861 | Type | Type-Data ... 862 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 864 Code 866 1 for Request 867 2 for Response 869 Identifier 871 The Identifier field is one octet. The Identifier field MUST be 872 the same if a Request packet is retransmitted due to a timeout 873 while waiting for a Response. Any new (non-retransmission) 874 Requests MUST modify the Identifier field. 876 The Identifier field of the Response MUST match that of the 877 currently outstanding Request. An authenticator receiving a 878 Response whose Identifier value does not match that of the 879 currently outstanding Request MUST silently discard the Response. 881 In order to avoid confusion between new Requests and 882 retransmissions, the Identifier value chosen for each new Request 883 need only be different from the previous Request, but need not be 884 unique within the conversation. One way to achieve this is to 885 start the Identifier at an initial value and increment it for each 886 new Request. Initializing the first Identifier with a random 887 number rather than starting from zero is recommended, since it 888 makes sequence attacks somewhat harder. 890 Since the Identifier space is unique to each session, 891 authenticators are not restricted to only 256 simultaneous 892 authentication conversations. Similarly, with re-authentication, 893 an EAP conversation might continue over a long period of time, and 894 is not limited to only 256 roundtrips. 896 Implementation Note: The authenticator is responsible for 897 retransmitting Request messages. If the Request message is 898 obtained from elsewhere (such as from a backend authentication 899 server), then the authenticator will need to save a copy of the 900 Request in order to accomplish this. The peer is responsible 901 for detecting and handling duplicate Request messages before 902 processing them in any way, including passing them on to an 903 outside party. The authenticator is also responsible for 904 discarding Response messages with a non-matching Identifier 905 value before acting on them in any way, including passing them 906 on to the backend authentication server for verification. 907 Since the authenticator can retransmit before receiving a 908 Response from the peer, the authenticator can receive multiple 909 Responses, each with a matching Identifier. Until a new Request 910 is received by the authenticator, the Identifier value is not 911 updated, so that the authenticator forwards Responses to the 912 backend authentication server, one at a time. 914 Length 916 The Length field is two octets and indicates the length of the EAP 917 packet including the Code, Identifier, Length, Type, and Type-Data 918 fields. Octets outside the range of the Length field should be 919 treated as Data Link Layer padding and MUST be ignored on 920 reception. A message with the Length field set to a value larger 921 than the number of received octets MUST be silently discarded. 923 Type 925 The Type field is one octet. This field indicates the Type of 926 Request or Response. A single Type MUST be specified for each EAP 927 Request or Response. An initial specification of Types follows in 928 Section 5 of this document. 930 The Type field of a Response MUST either match that of the 931 Request, or correspond to a legacy or Expanded Nak (see Section 932 5.3) indicating that a Request Type is unacceptable to the peer. 933 A peer MUST NOT send a Nak (legacy or expanded) in response to a 934 Request, after an initial non-Nak Response has been sent. An EAP 935 server receiving a Response not meeting these requirements MUST 936 silently discard it. 938 Type-Data 940 The Type-Data field varies with the Type of Request and the 941 associated Response. 943 4.2 Success and Failure 945 The Success packet is sent by the authenticator to the peer after 946 completion of an EAP authentication method (Type 4 or greater), to 947 indicate that the peer has authenticated successfully to the 948 authenticator. The authenticator MUST transmit an EAP packet with 949 the Code field set to 3 (Success). If the authenticator cannot 950 authenticate the peer (unacceptable Responses to one or more 951 Requests) then after unsuccessful completion of the EAP method in 952 progress, the implementation MUST transmit an EAP packet with the 953 Code field set to 4 (Failure). An authenticator MAY wish to issue 954 multiple Requests before sending a Failure response in order to allow 955 for human typing mistakes. Success and Failure packets MUST NOT 956 contain additional data. 958 Success and Failure packets MUST NOT be sent by an EAP authenticator 959 if the specification of the given method does not explicitly permit 960 the method to finish at that point. A peer EAP implementation 961 receiving a Success or Failure packet where sending one is not 962 explicitly permitted MUST silently discard it. By default, an EAP 963 peer MUST silently discard a "canned" Success packet (a Success 964 packet sent immediately upon connection). This ensures that a rogue 965 authenticator will not be able to bypass mutual authentication by 966 sending a Success packet prior to conclusion of the EAP method 967 conversation. 969 Implementation Note: Because the Success and Failure packets are 970 not acknowledged, they are not retransmitted by the authenticator, 971 and may be potentially lost. A peer MUST allow for this 972 circumstance as described in this note. See also Section 3.4 for 973 guidance on the processing of lower layer success and failure 974 indications. 976 As described in Section 2.1, only a single EAP authentication 977 method is allowed within an EAP conversation. EAP methods MAY 978 implement acknowledged result indications. After the authenticator 979 sends a method-specific failure indication to the peer, regardless 980 of the response from the peer, it MUST subsequently send a Failure 981 packet. After the authenticator sends a method-specific success 982 indication to the peer, and receives a method-specific success 983 indication from the peer, it MUST subsequently send a Success 984 packet. 986 On the peer, once the method completes unsuccessfully (that is, 987 either the authenticator sends a method-specific failure 988 indication, or the peer decides that it does want to continue the 989 conversation, possibly after sending a method-specific failure 990 indication), the peer MUST terminate the conversation and indicate 991 failure to the lower layer. The peer MUST silently discard 992 Success packets and MAY silently discard Failure packets. As a 993 result, loss of a Failure packet need not result in a timeout. 995 On the peer, after acknowledged successful result indications have 996 been exchanged by both sides, a Failure packet MUST be silently 997 discarded. The peer MAY, in the event that an EAP Success is not 998 received, conclude that the EAP Success packet was lost and that 999 authentication concluded successfully. 1001 A mutually authenticating method (such as EAP-TLS [RFC2716]) that 1002 provides authorization error messages provides acknowledged result 1003 indications for the purpose of this specification. Within 1004 EAP-TLS, the peer always authenticates the authenticator, and may 1005 send a TLS-alert message in the event of an authentication 1006 failure. An authenticator may use the "access denied" TLS alert 1007 after successfully authenticating the peer to indicate that a 1008 valid certificate was received from the peer, but when access 1009 control was applied, the authenticator decided not to proceed. If 1010 a method provides authorization error messages, the authenticator 1011 SHOULD use them so as to ensure consistency with the final access 1012 decision and avoid lengthy timeouts. 1014 If the authenticator has not sent a method-specific result 1015 indication, and the peer is willing to continue the conversation, 1016 once the method completes the peer waits for a Success or Failure 1017 packet and MUST NOT silently discard either of them. In the event 1018 that neither a Success nor Failure packet is received, the peer 1019 SHOULD terminate the conversation to avoid lengthy timeouts in 1020 case the lost packet was an EAP Failure. 1022 If the peer attempts to authenticate to the authenticator and 1023 fails to do so, the authenticator MUST send a Failure packet and 1024 MUST NOT grant access by sending a Success packet. However, an 1025 authenticator MAY omit having the peer authenticate to it in 1026 situations where limited access is offered (e.g., guest access). 1027 In this case the authenticator MUST send a Success packet. 1029 Where the peer authenticates successfully to the authenticator, 1030 but the authenticator does not send a method-specific result 1031 indication the authenticator MAY deny access by sending a Failure 1032 packet where the peer is not currently authorized for network 1033 access. 1035 A summary of the Success and Failure packet format is shown below. 1036 The fields are transmitted from left to right. 1038 0 1 2 3 1039 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1040 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1041 | Code | Identifier | Length | 1042 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1044 Code 1046 3 for Success 1047 4 for Failure 1049 Identifier 1051 The Identifier field is one octet and aids in matching replies to 1052 Responses. The Identifier field MUST match the Identifier field 1053 of the Response packet that it is sent in response to. 1055 Length 1057 4 1059 4.3 Retransmission Behavior 1061 Because the authentication process will often involve user input, 1062 some care must be taken when deciding upon retransmission strategies 1063 and authentication timeouts. By default, where EAP is run over an 1064 unreliable lower layer, the EAP retransmission timer SHOULD be 1065 dynamically estimated. A maximum of 3-5 retransmissions is 1066 suggested. 1068 When run over a reliable lower layer (e.g., EAP over ISAKMP/TCP, as 1069 within [PIC]), the authenticator retransmission timer SHOULD be set 1070 to an infinite value, so that retransmissions do not occur at the EAP 1071 layer. The peer may still maintain a timeout value so as to avoid 1072 waiting indefinitely for a Request. 1074 Where the authentication process requires user input, the measured 1075 round trip times may be determined by user responsiveness rather than 1076 network characteristics, so that dynamic RTO estimation may not be 1077 helpful. Instead, the retransmission timer SHOULD be set so as to 1078 provide sufficient time for the user to respond, with longer timeouts 1079 required in certain cases, such as where Token Cards (see Section 1080 5.6) are involved. 1082 In order to provide the EAP authenticator with guidance as to the 1083 appropriate timeout value, a hint can be communicated to the 1084 authenticator by the backend authentication server (such as via the 1085 RADIUS Session-Timeout attribute). 1087 In order to dynamically estimate the EAP retransmission timer, the 1088 algorithms for estimation of SRTT, RTTVAR and RTO described in 1089 [RFC2988] are RECOMMENDED, including use of Karn's algorithm, with 1090 the following potential modifications: 1092 [a] In order to avoid synchronization behaviors that can occur with 1093 fixed timers among distributed systems, the retransmission timer 1094 is calculated with a jitter by using the RTO value and randomly 1095 adding a value drawn between -RTOmin/2 and RTOmin/2. Alternative 1096 calculations to create jitter MAY be used. These MUST be 1097 pseudo-random, generated by a PRNG seeded as per [RFC1750]. 1099 [b] When EAP is transported over a single link (as opposed to over 1100 the Internet), smaller values of RTOinitial, RTOmin and RTOmax 1101 MAY be used. Recommended values are RTOinitial=1 second, 1102 RTOmin=200ms, RTOmax=20 seconds. 1104 [c] When EAP is transported over a single link (as opposed to over 1105 the Internet), estimates MAY be done on a per-authenticator 1106 basis, rather than a per-session basis. This enables the 1107 retransmission estimate to make the most use of information on 1108 link-layer behavior. 1110 [d] An EAP implementation MAY clear SRTT and RTTVAR after backing off 1111 the timer multiple times as it is likely that the current SRTT 1112 and RTTVAR are bogus in this situation. Once SRTT and RTTVAR are 1113 cleared they should be initialized with the next RTT sample taken 1114 as described in [RFC2988] equation 2.2. 1116 5. Initial EAP Request/Response Types 1118 This section defines the initial set of EAP Types used in Request/ 1119 Response exchanges. More Types may be defined in follow-on 1120 documents. The Type field is one octet and identifies the structure 1121 of an EAP Request or Response packet. The first 3 Types are 1122 considered special case Types. 1124 The remaining Types define authentication exchanges. Nak (Type 3) or 1125 Expanded Nak (Type 254) are valid only for Response packets, they 1126 MUST NOT be sent in a Request. 1128 All EAP implementations MUST support Types 1-4, which are defined in 1129 this document, and SHOULD support Type 254. Implementations MAY 1130 support other Types defined here or in future RFCs. 1132 1 Identity 1133 2 Notification 1134 3 Nak (Response only) 1135 4 MD5-Challenge 1136 5 One Time Password (OTP) 1137 6 Generic Token Card (GTC) 1138 254 Expanded Types 1139 255 Experimental use 1141 EAP methods MAY support authentication based on shared secrets. If 1142 the shared secret is a passphrase entered by the user, 1143 implementations MAY support entering passphrases with non-ASCII 1144 characters. In this case, the input should be processed using an 1145 appropriate stringprep [RFC3454] profile, and encoded in octets using 1146 UTF-8 encoding [RFC2279]. A preliminary version of a possible 1147 stringprep profile is described in [SASLPREP]. 1149 5.1 Identity 1151 Description 1153 The Identity Type is used to query the identity of the peer. 1154 Generally, the authenticator will issue this as the initial 1155 Request. An optional displayable message MAY be included to 1156 prompt the peer in the case where there is an expectation of 1157 interaction with a user. A Response of Type 1 (Identity) SHOULD 1158 be sent in Response to a Request with a Type of 1 (Identity). 1160 Some EAP implementations piggy-back various options into the 1161 Identity Request after a NUL-character. By default an EAP 1162 implementation SHOULD NOT assume that an Identity Request or 1163 Response can be larger than 1020 octets. 1165 Since Identity Requests and Responses are not protected, from a 1166 privacy perspective, it may be preferable for protected 1167 method-specific Identity exchanges to be used instead. Where the 1168 peer is configured to only accept authentication methods 1169 supporting protected identity exchanges, the peer MAY provide an 1170 abbreviated Identity Response (such as omitting the peer-name 1171 portion of the NAI [RFC2486]). For further discussion of identity 1172 protection, see Section 7.3. 1174 Implementation Note: The peer MAY obtain the Identity via user 1175 input. It is suggested that the authenticator retry the 1176 Identity Request in the case of an invalid Identity or 1177 authentication failure to allow for potential typos on the part 1178 of the user. It is suggested that the Identity Request be 1179 retried a minimum of 3 times before terminating the 1180 authentication. The Notification Request MAY be used to 1181 indicate an invalid authentication attempt prior to 1182 transmitting a new Identity Request (optionally, the failure 1183 MAY be indicated within the message of the new Identity Request 1184 itself). 1186 Type 1188 1 1190 Type-Data 1192 This field MAY contain a displayable message in the Request, 1193 containing UTF-8 encoded ISO 10646 characters [RFC2279]. Where 1194 the Request contains a null, only the portion of the field prior 1195 to the null is displayed. If the Identity is unknown, the 1196 Identity Response field should be zero bytes in length. The 1197 Identity Response field MUST NOT be null terminated. In all 1198 cases, the length of the Type-Data field is derived from the 1199 Length field of the Request/Response packet. 1201 Security Claims (see Section 7.2): 1203 Intended use: Physically secure lower layers; 1204 vulnerable to attack when used with 1205 wireless or over the Internet. 1206 Auth. mechanism: None 1207 Ciphersuite negotiation: No 1208 Mutual authentication: No 1209 Integrity protection: No 1210 Replay protection: No 1211 Confidentiality: No 1212 Key derivation: No 1213 Key strength: N/A 1214 Dictionary attack prot: N/A 1215 Fast reconnect: No 1216 Crypt. binding: N/A 1217 Acknowledged S/F: No 1218 Session independence: N/A 1219 Fragmentation: No 1221 5.2 Notification 1223 Description 1225 The Notification Type is optionally used to convey a displayable 1226 message from the authenticator to the peer. An authenticator MAY 1227 send a Notification Request to the peer at any time when there is 1228 no outstanding Request, prior to completion of an EAP 1229 authentication method. The peer MUST respond to a Notification 1230 Request with a Notification Response unless the EAP authentication 1231 method specification prohibits the use of Notification message. 1232 In any case, a Nak Response MUST NOT be sent in response to a 1233 Notification Request. Note that the default maximum length of a 1234 Notification Request is 1020 octets. By default, this leaves at 1235 most 1015 octets for the human readable message. 1237 An EAP method MAY indicate within its specification that 1238 Notification messages must not be sent during that method. In this 1239 case, the peer MUST silently discard Notification Requests from 1240 the point where an initial Request for that Type is answered with 1241 a Response of the same Type. 1243 The peer SHOULD display this message to the user or log it if it 1244 cannot be displayed. The Notification Type is intended to provide 1245 an acknowledged notification of some imperative nature, but it is 1246 not an error indication, and therefore does not change the state 1247 of the peer. Examples include a password with an expiration time 1248 that is about to expire, an OTP sequence integer which is nearing 1249 0, an authentication failure warning, etc. In most circumstances, 1250 Notification should not be required. 1252 Type 1254 2 1256 Type-Data 1258 The Type-Data field in the Request contains a displayable message 1259 greater than zero octets in length, containing UTF-8 encoded ISO 1260 10646 characters [RFC2279]. The length of the message is 1261 determined by Length field of the Request packet. The message 1262 MUST NOT be null terminated. A Response MUST be sent in reply to 1263 the Request with a Type field of 2 (Notification). The Type-Data 1264 field of the Response is zero octets in length. The Response 1265 should be sent immediately (independent of how the message is 1266 displayed or logged). 1268 Security Claims (see Section 7.2): 1270 Intended use: Physically secure lower layers; 1271 vulnerable to attack when used with 1272 wireless or over the Internet. 1273 Auth. mechanism: None 1274 Ciphersuite negotiation: No 1275 Mutual authentication: No 1276 Integrity protection: No 1277 Replay protection: No 1278 Confidentiality: No 1279 Key derivation: No 1280 Key strength: N/A 1281 Dictionary attack prot: N/A 1282 Fast reconnect: No 1283 Crypt. binding: N/A 1284 Acknowledged S/F: No 1285 Session independence: N/A 1286 Fragmentation: No 1288 5.3 Nak 1290 5.3.1 Legacy Nak 1291 Description 1293 The legacy Nak Type is valid only in Response messages. It is 1294 sent in reply to a Request where the desired authentication Type 1295 is unacceptable. Authentication Types are numbered 4 and above. 1296 The Response contains one or more authentication Types desired by 1297 the Peer. Type zero (0) is used to indicate that the sender has 1298 no viable alternatives, and therefore the authenticator SHOULD NOT 1299 send another Request after receiving a Nak Response containing a 1300 zero value. 1302 Since the legacy Nak Type is valid only in Responses and has very 1303 limited functionality, it MUST NOT be used as a general purpose 1304 error indication, such as for communication of error messages, or 1305 negotiation of parameters specific to a particular EAP method. 1307 Code 1309 2 for Response. 1311 Identifier 1313 The Identifier field is one octet and aids in matching Responses 1314 with Requests. The Identifier field of a legacy Nak Response MUST 1315 match the Identifier field of the Request packet that it is sent 1316 in response to. 1318 Length 1320 >=6 1322 Type 1324 3 1326 Type-Data 1328 Where a peer receives a Request for an unacceptable authentication 1329 Type (4-253,255), or a peer lacking support for Expanded Types 1330 receives a Request for Type 254, a Nak Response (Type 3) MUST be 1331 sent. The Type-Data field of the Nak Response (Type 3) MUST 1332 contain one or more octets indicating the desired authentication 1333 Type(s), one octet per Type, or the value zero (0) to indicate no 1334 proposed alternative. A peer supporting Expanded Types that 1335 receives a Request for an unacceptable authentication Type (4-253, 1336 255) MAY include the value 254 in the Nak Response (Type 3) in 1337 order to indicate the desire for an Expanded authentication Type. 1338 If the authenticator can accommodate this preference, it will 1339 respond with an Expanded Type Request (Type 254). 1341 Security Claims (see Section 7.2): 1343 Intended use: Physically secure lower layers; 1344 vulnerable to attack when used with 1345 wireless or over the Internet. 1346 Auth. mechanism: None 1347 Ciphersuite negotiation: No 1348 Mutual authentication: No 1349 Integrity protection: No 1350 Replay protection: No 1351 Confidentiality: No 1352 Key derivation: No 1353 Key strength: N/A 1354 Dictionary attack prot: N/A 1355 Fast reconnect: No 1356 Crypt. binding: N/A 1357 Acknowledged S/F: No 1358 Session independence: N/A 1359 Fragmentation: No 1361 5.3.2 Expanded Nak 1363 Description 1365 The Expanded Nak Type is valid only in Response messages. It MUST 1366 be sent only in reply to a Request of Type 254 (Expanded Type) 1367 where the authentication Type is unacceptable. The Expanded Nak 1368 Type uses the Expanded Type format itself, and the Response 1369 contains one or more authentication Types desired by the peer, all 1370 in Expanded Type format. Type zero (0) is used to indicate that 1371 the sender has no viable alternatives. The general format of the 1372 Expanded Type is described in Section 5.7. 1374 Since the Expanded Nak Type is valid only in Responses and has 1375 very limited functionality, it MUST NOT be used as a general 1376 purpose error indication, such as for communication of error 1377 messages, or negotiation of parameters specific to a particular 1378 EAP method. 1380 Code 1382 2 for Response. 1384 Identifier 1386 The Identifier field is one octet and aids in matching Responses 1387 with Requests. The Identifier field of an Expanded Nak Response 1388 MUST match the Identifier field of the Request packet that it is 1389 sent in response to. 1391 Length 1393 >=20 1395 Type 1397 254 1399 Vendor-Id 1401 0 (IETF) 1403 Vendor-Type 1405 3 (Nak) 1407 Vendor-Data 1409 The Expanded Nak Type is only sent when the Request contains an 1410 Expanded Type (254) as defined in Section 5.7. The Vendor-Data 1411 field of the Nak Response MUST contain one or more authentication 1412 Types (4 or greater), all in expanded format, 8 octets per Type, 1413 or the value zero (0), also in Expanded Type format, to indicate 1414 no proposed alternative. The desired authentication Types may 1415 include a mixture of Vendor-Specific and IETF Types. For example, 1416 an Expanded Nak Response indicating a preference for OTP (Type 5), 1417 and an MIT (Vendor-Id=20) Expanded Type of 6 would appear as 1418 follows: 1420 0 1 2 3 1421 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1422 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1423 | 2 | Identifier | Length=28 | 1424 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1425 | Type=254 | 0 (IETF) | 1426 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1427 | 3 (Nak) | 1428 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1429 | Type=254 | 0 (IETF) | 1430 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1431 | 5 (OTP) | 1432 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1433 | Type=254 | 20 (MIT) | 1434 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1435 | 6 | 1436 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1438 An Expanded Nak Response indicating a no desired alternative would 1439 appear as follows: 1441 0 1 2 3 1442 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1443 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1444 | 2 | Identifier | Length=20 | 1445 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1446 | Type=254 | 0 (IETF) | 1447 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1448 | 3 (Nak) | 1449 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1450 | Type=254 | 0 (IETF) | 1451 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1452 | 0 (No alternative) | 1453 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1455 Security Claims (see Section 7.2): 1457 Intended use: Physically secure lower layers; 1458 vulnerable to attack when used with 1459 wireless or over the Internet. 1460 Auth. mechanism: None 1461 Ciphersuite negotiation: No 1462 Mutual authentication: No 1463 Integrity protection: No 1464 Replay protection: No 1465 Confidentiality: No 1466 Key derivation: No 1467 Key strength: N/A 1468 Dictionary attack prot: N/A 1469 Fast reconnect: No 1470 Crypt. binding: N/A 1471 Acknowledged S/F: No 1472 Session independence: N/A 1473 Fragmentation: No 1475 5.4 MD5-Challenge 1477 Description 1479 The MD5-Challenge Type is analogous to the PPP CHAP protocol 1480 [RFC1994] (with MD5 as the specified algorithm). The Request 1481 contains a "challenge" message to the peer. A Response MUST be 1482 sent in reply to the Request. The Response MAY be either of Type 1483 4 (MD5-Challenge), Nak (Type 3) or Expanded Nak (Type 254). The 1484 Nak reply indicates the peer's desired authentication Type(s). 1485 EAP peer and EAP server implementations MUST support the 1486 MD5-Challenge mechanism. An authenticator that supports only 1487 pass-through MUST allow communication with a backend 1488 authentication server that is capable of supporting MD5-Challenge, 1489 although the EAP authenticator implementation need not support 1490 MD5-Challenge itself. However, if the EAP authenticator can be 1491 configured to authenticate peers locally (e.g., not operate in 1492 pass-through), then the requirement for support of the 1493 MD5-Challenge mechanism applies. 1495 Note that the use of the Identifier field in the MD5-Challenge 1496 Type is different from that described in [RFC1994]. EAP allows 1497 for retransmission of MD5-Challenge Request packets while 1498 [RFC1994] states that both the Identifier and Challenge fields 1499 MUST change each time a Challenge (the CHAP equivalent of the 1500 MD5-Challenge Request packet) is sent. 1502 Note: [RFC1994] treats the shared secret as an octet string, and 1503 does not specify how it is entered into the system (or if it is 1504 handled by the user at all). EAP MD5-Challenge implementations MAY 1505 support entering passphrases with non-ASCII characters. See 1506 Section 5 for instructions how the input should be processed and 1507 encoded into octets. 1509 Type 1511 4 1513 Type-Data 1515 The contents of the Type-Data field is summarized below. For 1516 reference on the use of these fields see the PPP Challenge 1517 Handshake Authentication Protocol [RFC1994]. 1519 0 1 2 3 1520 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1521 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1522 | Value-Size | Value ... 1523 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1524 | Name ... 1525 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1527 Security Claims (see Section 7.2): 1529 Intended use: Wired networks, including PPP, PPPOE, and 1530 IEEE 802 wired media. Use over the 1531 Internet or with wireless media only when 1532 protected. 1533 Auth. mechanism: Password or pre-shared key. 1534 Ciphersuite negotiation: No 1535 Mutual authentication: No 1536 Integrity protection: No 1537 Replay protection: No 1538 Confidentiality: No 1539 Key derivation: No 1540 Key strength: N/A 1541 Dictionary attack prot: No 1542 Fast reconnect: No 1543 Crypt. binding: N/A 1544 Acknowledged S/F: No 1545 Session independence: N/A 1546 Fragmentation: No 1548 5.5 One-Time Password (OTP) 1550 Description 1552 The One-Time Password system is defined in "A One-Time Password 1553 System" [RFC2289] and "OTP Extended Responses" [RFC2243]. The 1554 Request contains an OTP challenge in the format described in 1555 [RFC2289]. A Response MUST be sent in reply to the Request. The 1556 Response MUST be of Type 5 (OTP), Nak (Type 3) or Expanded Nak 1557 (Type 254). The Nak Response indicates the peer's desired 1558 authentication Type(s). The EAP OTP method is intended for use 1559 with the One-Time Password system only, and MUST NOT be used to 1560 provide support for cleartext passwords. 1562 Type 1564 5 1566 Type-Data 1568 The Type-Data field contains the OTP "challenge" as a displayable 1569 message in the Request. In the Response, this field is used for 1570 the 6 words from the OTP dictionary [RFC2289]. The messages MUST 1571 NOT be null terminated. The length of the field is derived from 1572 the Length field of the Request/Reply packet. 1574 Note: [RFC2289] does not specify how the secret pass-phrase is 1575 entered by the user, or how the pass-phrase is converted into 1576 octets. EAP OTP implementations MAY support entering passphrases 1577 with non-ASCII characters. See Section 5 for instructions how the 1578 input should be processed and encoded into octets. 1580 Security Claims (see Section 7.2): 1582 Intended use: Wired networks, including PPP, PPPOE, and 1583 IEEE 802 wired media. Use over the 1584 Internet or with wireless media only when 1585 protected. 1586 Auth. mechanism: One-Time Password 1587 Ciphersuite negotiation: No 1588 Mutual authentication: No 1589 Integrity protection: No 1590 Replay protection: Yes 1591 Confidentiality: No 1592 Key derivation: No 1593 Key strength: N/A 1594 Dictionary attack prot: No 1595 Fast reconnect: No 1596 Crypt. binding: N/A 1597 Acknowledged S/F: No 1598 Session independence: N/A 1599 Fragmentation: No 1601 5.6 Generic Token Card (GTC) 1603 Description 1605 The Generic Token Card Type is defined for use with various Token 1606 Card implementations which require user input. The Request 1607 contains a displayable message and the Response contains the Token 1608 Card information necessary for authentication. Typically, this 1609 would be information read by a user from the Token card device and 1610 entered as ASCII text. A Response MUST be sent in reply to the 1611 Request. The Response MUST be of Type 6 (GTC), Nak (Type 3) or 1612 Expanded Nak (Type 254). The Nak Response indicates the peer's 1613 desired authentication Type(s). The EAP GTC method is intended 1614 for use with the Token Cards supporting challenge/response 1615 authentication and MUST NOT be used to provide support for 1616 cleartext passwords in the absence of a protected tunnel with 1617 server authentication. 1619 Type 1621 6 1623 Type-Data 1625 The Type-Data field in the Request contains a displayable message 1626 greater than zero octets in length. The length of the message is 1627 determined by the Length field of the Request packet. The message 1628 MUST NOT be null terminated. A Response MUST be sent in reply to 1629 the Request with a Type field of 6 (Generic Token Card). The 1630 Response contains data from the Token Card required for 1631 authentication. The length of the data is determined by the 1632 Length field of the Response packet. 1634 EAP GTC implementations MAY support entering a response with 1635 non-ASCII characters. See Section 5 for instructions how the 1636 input should be processed and encoded into octets. 1638 Security Claims (see Section 7.2): 1640 Intended use: Wired networks, including PPP, PPPOE, and 1641 IEEE 802 wired media. Use over the 1642 Internet or with wireless media only when 1643 protected. 1644 Auth. mechanism: Hardware token. 1645 Ciphersuite negotiation: No 1646 Mutual authentication: No 1647 Integrity protection: No 1648 Replay protection: No 1649 Confidentiality: No 1650 Key derivation: No 1651 Key strength: N/A 1652 Dictionary attack prot: No 1653 Fast reconnect: No 1654 Crypt. binding: N/A 1655 Acknowledged S/F: No 1656 Session independence: N/A 1657 Fragmentation: No 1659 5.7 Expanded Types 1661 Description 1663 Since many of the existing uses of EAP are vendor-specific, the 1664 Expanded method Type is available to allow vendors to support 1665 their own Expanded Types not suitable for general usage. 1667 The Expanded Type is also used to expand the global Method Type 1668 space beyond the original 255 values. A Vendor-Id of 0 maps the 1669 original 255 possible Types onto a space of 2^32-1 possible Types. 1670 (Type 0 is only used in a Nak Response, to indicate no acceptable 1671 alternative) 1673 An implementation that supports the Expanded attribute MUST treat 1674 EAP Types that are less than 256 equivalently whether they appear 1675 as a single octet or as the 32-bit Vendor-Type within a Expanded 1676 Type where Vendor-Id is 0. Peers not equipped to interpret the 1677 Expanded Type MUST send a Nak as described in Section 5.3.1, and 1678 negotiate a more suitable authentication method. 1680 A summary of the Expanded Type format is shown below. The fields 1681 are transmitted from left to right. 1683 0 1 2 3 1684 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1685 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1686 | Type | Vendor-Id | 1687 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1688 | Vendor-Type | 1689 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1690 | Vendor data... 1691 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1693 Type 1695 254 for Expanded Type 1697 Vendor-Id 1699 The Vendor-Id is 3 octets and represents the SMI Network 1700 Management Private Enterprise Code of the Vendor in network byte 1701 order, as allocated by IANA. A Vendor-Id of zero is reserved for 1702 use by the IETF in providing an expanded global EAP Type space. 1704 Vendor-Type 1706 The Vendor-Type field is four octets and represents the 1707 vendor-specific method Type. 1709 If the Vendor-Id is zero, the Vendor-Type field is an extension 1710 and superset of the existing namespace for EAP Types. The first 1711 256 Types are reserved for compatibility with single-octet EAP 1712 Types that have already been assigned or may be assigned in the 1713 future. Thus, EAP Types from 0 through 255 are semantically 1714 identical whether they appear as single octet EAP Types or as 1715 Vendor-Types when Vendor-Id is zero. There is one exception to 1716 this rule: Expanded Nak and Legacy Nak packets share the same 1717 code, but must be treated differently because they have a 1718 different format. 1720 Vendor-Data 1722 The Vendor-Data field is defined by the vendor. Where a Vendor-Id 1723 of zero is present, the Vendor-Data field will be used for 1724 transporting the contents of EAP methods of Types defined by the 1725 IETF. 1727 5.8 Experimental 1729 Description 1731 The Experimental Type has no fixed format or content. It is 1732 intended for use when experimenting with new EAP Types. This Type 1733 is intended for experimental and testing purposes. No guarantee 1734 is made for interoperability between peers using this Type, as 1735 outlined in [IANA-EXP]. 1737 Type 1739 255 1741 Type-Data 1743 Undefined 1745 6. IANA Considerations 1747 This section provides guidance to the Internet Assigned Numbers 1748 Authority (IANA) regarding registration of values related to the EAP 1749 protocol, in accordance with BCP 26, [RFC2434]. 1751 There are two name spaces in EAP that require registration: Packet 1752 Codes and method Types. 1754 EAP is not intended as a general-purpose protocol, and allocations 1755 SHOULD NOT be made for purposes unrelated to authentication. 1757 The following terms are used here with the meanings defined in BCP 1758 26: "name space", "assigned value", "registration". 1760 The following policies are used here with the meanings defined in BCP 1761 26: "Private Use", "First Come First Served", "Expert Review", 1762 "Specification Required", "IETF Consensus", "Standards Action". 1764 For registration requests where a Designated Expert should be 1765 consulted, the responsible IESG area director should appoint the 1766 Designated Expert. The intention is that any allocation will be 1767 accompanied by a published RFC. But in order to allow for the 1768 allocation of values prior to the RFC being approved for publication, 1769 the Designated Expert can approve allocations once it seems clear 1770 that an RFC will be published. The Designated expert will post a 1771 request to the EAP WG mailing list (or a successor designated by the 1772 Area Director) for comment and review, including an Internet-Draft. 1773 Before a period of 30 days has passed, the Designated Expert will 1774 either approve or deny the registration request and publish a notice 1775 of the decision to the EAP WG mailing list or its successor, as well 1776 as informing IANA. A denial notice must be justified by an 1777 explanation and, in the cases where it is possible, concrete 1778 suggestions on how the request can be modified so as to become 1779 acceptable. 1781 6.1 Packet Codes 1783 Packet Codes have a range from 1 to 255, of which 1-4 have been 1784 allocated. Because a new Packet Code has considerable impact on 1785 interoperability, a new Packet Code requires Standards Action, and 1786 should be allocated starting at 5. 1788 6.2 Method Types 1790 The original EAP method Type space has a range from 1 to 255, and is 1791 the scarcest resource in EAP, and thus must be allocated with care. 1792 Method Types 1-41 have been allocated, with 20 available for re-use. 1793 Method Types 42-191 may be allocated on the advice of a Designated 1794 Expert, with Specification Required. 1796 Allocation of blocks of method Types (more than one for a given 1797 purpose) should require IETF Consensus. EAP Type Values 192-253 are 1798 reserved and allocation requires Standards Action. 1800 Method Type 254 is allocated for the Expanded Type. Where the 1801 Vendor-Id field is non-zero, the Expanded Type is used for functions 1802 specific only to one vendor's implementation of EAP, where no 1803 interoperability is deemed useful. When used with a Vendor-Id of 1804 zero, method Type 254 can also be used to provide for an expanded 1805 IETF method Type space. Method Type values 256-4294967295 may be 1806 allocated after Type values 1-191 have been allocated. 1808 Method Type 255 is allocated for Experimental use, such as testing of 1809 new EAP methods before a permanent Type code is allocated. 1811 7. Security Considerations 1813 EAP was designed for use with dialup PPP [RFC1661] and was later 1814 adapted for use in wired IEEE 802 networks [IEEE-802] in 1815 [IEEE-802.1X]. On these networks, an attacker would need to gain 1816 physical access to the telephone or switch infrastructure in order to 1817 mount an attack. While such attacks have been documented, such as in 1819 [DECEPTION], they are assumed to be rare. 1821 However, subsequently EAP has been proposed for use on wireless 1822 networks, and over the Internet, where physical security cannot be 1823 assumed. On such networks, the security vulnerabilities are greater, 1824 as are the requirements for EAP security. 1826 This section defines the threat model and security terms and 1827 describes the security claims section required in EAP method 1828 specifications. We then discuss threat mitigation. 1830 7.1 Threat model 1832 On physically insecure networks, it is possible for an attacker to 1833 gain access to the physical medium. This enables a range of attacks, 1834 including the following: 1836 [1] An attacker may try to discover user identities by snooping 1837 authentication traffic. 1839 [2] An attacker may try to modify or spoof EAP packets. 1841 [3] An attacker may launch denial of service attacks by spoofing 1842 lower layer indications or Success/Failure packets; by replaying 1843 EAP packets; or by generating packets with overlapping 1844 Identifiers. 1846 [4] An attacker may attempt to recover the pass-phrase by mounting an 1847 offline dictionary attack. 1849 [5] An attacker may attempt to convince the peer to connect to an 1850 untrusted network, by mounting a man-in-the-middle attack. 1852 [6] An attacker may attempt to disrupt the EAP negotiation in order 1853 cause a weak authentication method to be selected. 1855 [7] An attacker may attempt to recover keys by taking advantage of 1856 weak key derivation techniques used within EAP methods. 1858 [8] An attacker may attempt to take advantage of weak ciphersuites 1859 subsequently used after the EAP conversation is complete. 1861 [9] An attacker may attempt to perform downgrading attacks on lower 1862 layer ciphersuite negotiation in order to ensure that a weaker 1863 ciphersuite is used subsequently to EAP authentication. 1865 Where EAP is used over wired networks, an attacker typically requires 1866 access to the physical infrastructure in order to carry out these 1867 attacks. However, where EAP is used over wireless networks, EAP 1868 packets may be forwarded by authenticators (e.g., pre-authentication) 1869 so that the attacker need not be within the coverage area of an 1870 authenticator in order to carry out an attack on it or its peers. 1871 Where EAP is used over the Internet, attacks may be carried out at an 1872 even greater distance. 1874 7.2 Security claims 1876 In order to clearly articulate the security provided by an EAP 1877 method, EAP method specifications MUST include a Security Claims 1878 section including the following declarations: 1880 [a] Intended use. This includes a statement of whether the method is 1881 intended for use over a physically secure or insecure network, as 1882 well as a statement of the applicable lower layers. 1884 [b] Mechanism. This is a statement of the authentication technology: 1885 certificates, pre-shared keys, passwords, token cards, etc. 1887 [c] Security claims. This is a statement of the claimed security 1888 properties of the method, using terms defined in Section 1.2: 1889 mutual authentication, integrity protection, replay protection, 1890 confidentiality, key derivation, dictionary attack resistance, 1891 fast reconnect, cryptographic binding, acknowledged result 1892 indications. The Security Claims section of an EAP method 1893 specification SHOULD provide justification for the claims that 1894 are made. This can be accomplished by including a proof in an 1895 Appendix, or including a reference to a proof. 1897 [d] Key strength. If the method derives keys, then the effective key 1898 strength MUST be estimated. This estimate is meant for potential 1899 users of the method to determine if the keys produced are strong 1900 enough for the intended application. 1902 The effective key strength SHOULD be stated as number of bits, 1903 defined as follows: If the effective key strength is N bits, the 1904 best currently known methods to recover the key (with 1905 non-negligible probability) require an effort comparable to 2^N 1906 operations of a typical block cipher. The statement SHOULD be 1907 accompanied by a short rationale, explaining how this number was 1908 arrived at. This explanation SHOULD include the parameters 1909 required to achieve the stated key strength based on current 1910 knowledge of the algorithms. 1912 (Note: Although it is difficult to define what "comparable 1913 effort" and "typical block cipher" exactly mean, reasonable 1914 approximations are sufficient here. Refer to e.g. [SILVERMAN] 1915 for more discussion.) 1917 The key strength depends on the methods used to derive the keys. 1918 For instance, if keys are derived from a shared secret (such as a 1919 password or a long-term secret), and possibly some public 1920 information such as nonces, the effective key strength is limited 1921 by the strength of the long-term secret (assuming that the 1922 derivation procedure is computationally simple). To take another 1923 example, when using public key algorithms, the strength of the 1924 symmetric key depends on the strength of the public keys used. 1926 [e] Description of key hierarchy. EAP methods deriving keys MUST 1927 either provide a reference to a key hierarchy specification, or 1928 describe how Master Session Keys (MSKs) and Extended Master 1929 Session Keys (EMSKs) are to be derived. 1931 [f] Indication of vulnerabilities. In addition to the security 1932 claims that are made, the specification MUST indicate which of 1933 the security claims detailed in Section 7.2.1 are NOT being made. 1935 7.2.1 Security claims terminology for EAP methods 1937 These terms are used to described the security properties of EAP 1938 methods: 1940 Protected ciphersuite negotiation 1941 This refers to the ability of an EAP method to negotiate 1942 the ciphersuite used to protect the EAP conversation, as 1943 well as to integrity protect the negotiation. It does not 1944 refer to the ability to negotiate the ciphersuite used to 1945 protect data. 1947 Mutual authentication 1948 This refers to an EAP method in which, within an 1949 interlocked exchange, the authenticator authenticates the 1950 peer and the peer authenticates the authenticator. Two 1951 independent one-way methods, running in opposite directions 1952 do not provide mutual authentication as defined here. 1954 Integrity protection 1955 This refers to providing data origin authentication and 1956 protection against unauthorized modification of information 1957 for EAP packets (including EAP Requests and Responses). 1958 When making this claim, a method specification MUST 1959 describe the EAP packets and fields within the EAP packet 1960 that are protected. 1962 Replay protection 1963 This refers to protection against replay of an EAP method 1964 or its messages, including method-specific success and 1965 failure indications. 1967 Confidentiality 1968 This refers to encryption of EAP messages, including EAP 1969 Requests and Responses, and method-specific success and 1970 failure indications. A method making this claim MUST 1971 support identity protection (see Section 7.3). 1973 Key derivation 1974 This refers to the ability of the EAP method to derive 1975 exportable keying material such as the Master Session Key 1976 (MSK), and Extended Master Session Key (EMSK). The MSK is 1977 used only for further key derivation, not directly for 1978 protection of the EAP conversation or subsequent data. Use 1979 of the EMSK is reserved. 1981 Key strength 1982 If the effective key strength is N bits, the best currently 1983 known methods to recover the key (with non-negligible 1984 probability) require an effort comparable to 2^N operations 1985 of a typical block cipher. 1987 Dictionary attack resistance 1988 Where password authentication is used, passwords are 1989 commonly selected from a small set (as compared to a set of 1990 N-bit keys), which raises a concern about dictionary 1991 attacks. A method may be said to provide protection 1992 against dictionary attacks if, when it uses a password as a 1993 secret, the method does not allow an offline attack that 1994 has a work factor based on the number of passwords in an 1995 attacker's dictionary. 1997 Fast reconnect 1998 The ability, in the case where a security association has 1999 been previously established, to create a new or refreshed 2000 security association in a smaller number of round-trips. 2002 Cryptographic binding 2003 The demonstration of the EAP peer to the EAP server that a 2004 single entity has acted as the EAP peer for all methods 2005 executed within a tunnel method. Binding MAY also imply 2006 that the EAP server demonstrates to the peer that a single 2007 entity has acted as the EAP server for all methods executed 2008 within a tunnel method. If executed correctly, binding 2009 serves to mitigate man-in-the-middle vulnerabilities. 2011 Acknowledged result indications 2012 The ability within a method for the authenticator to 2013 indicate to the peer whether it has successfully 2014 authenticated to it, and for the peer to acknowledge 2015 receipt of that indication as well as indicating to the 2016 authenticator whether it has successfully authenticated to 2017 the peer. Since EAP Success and Failure packets are neither 2018 acknowledged nor integrity protected, this claim requires 2019 implementation of a method-specific result exchange that is 2020 authenticated, integrity and replay protected on a 2021 per-packet basis. 2023 Session independence 2024 The demonstration that passive attacks (such as capture of 2025 the EAP conversation) or active attacks (including 2026 compromise of the MSK or EMSK) does not enable compromise 2027 of subsequent or prior MSKs or EMSKs. 2029 Fragmentation 2030 This refers to whether an EAP method supports fragmentation 2031 and reassembly. As noted in Section 3.1, EAP methods should 2032 support fragmentation and reassembly if EAP packets can 2033 exceed the minimum MTU of 1020 octets. 2035 7.3 Identity protection 2037 An Identity exchange is optional within the EAP conversation. 2038 Therefore, it is possible to omit the Identity exchange entirely, or 2039 to use a method-specific identity exchange once a protected channel 2040 has been established. 2042 However, where roaming is supported as described in [RFC2607], it may 2043 be necessary to locate the appropriate backend authentication server 2044 before the authentication conversation can proceed. The realm 2045 portion of the Network Access Identifier (NAI) [RFC2486] is typically 2046 included within the EAP-Response/Identity in order to enable the 2047 authentication exchange to be routed to the appropriate backend 2048 authentication server. Therefore while the peer-name portion of the 2049 NAI may be omitted in the EAP-Response/Identity, where proxies or 2050 relays are present, the realm portion may be required. 2052 It is possible for the identity in the identity response to be 2053 different from the identity authenticated by the EAP method. This may 2054 be intentional in the case of identity privacy. An EAP method SHOULD 2055 use the authenticated identity when making access control decisions. 2057 7.4 Man-in-the-middle attacks 2059 Where EAP is tunneled within another protocol that omits peer 2060 authentication, there exists a potential vulnerability to 2061 man-in-the-middle attack. 2063 As noted in Section 2.1, EAP does not permit untunnelled sequences of 2064 authentication methods. Were a sequence of EAP authentication 2065 methods to be permitted, the peer might not have proof that a single 2066 entity has acted as the authenticator for all EAP methods within the 2067 sequence. For example, an authenticator might terminate one EAP 2068 method, then forward the next method in the sequence to another party 2069 without the peer's knowledge or consent. Similarly, the 2070 authenticator might not have proof that a single entity has acted as 2071 the peer for all EAP methods within the sequence. 2073 Tunnelling EAP within another protocol enables an attack by a rogue 2074 EAP authenticator tunneling EAP to a legitimate server. Where the 2075 tunneling protocol is used for key establishment but does not require 2076 peer authentication, an attacker convincing a legitimate peer to 2077 connect to it will be able to tunnel EAP packets to a legitimate 2078 server, successfully authenticating and obtaining the key. This 2079 allows the attacker to successfully establish itself as a 2080 man-in-the-middle, gaining access to the network, as well as the 2081 ability to decrypt data traffic between the legitimate peer and 2082 server. 2084 This attack may be mitigated by the following measures: 2086 [a] Requiring mutual authentication within EAP tunneling mechanisms. 2088 [b] Requiring cryptographic binding between the EAP tunneling 2089 protocol and the tunneled EAP methods. Where cryptographic 2090 binding is supported, a mechanism is also needed to protect 2091 against downgrade attacks that would bypass it. 2093 [c] Limiting the EAP methods authorized for use without protection, 2094 based on peer and authenticator policy. 2096 [d] Avoiding the use of tunnels when a single, strong method is 2097 available. 2099 7.5 Packet modification attacks 2101 While EAP methods may support per-packet data origin authentication, 2102 integrity and replay protection, support is not provided within the 2103 EAP layer. 2105 Since the Identifier is only a single octet, it is easy to guess, 2106 allowing an attacker to successfully inject or replay EAP packets. An 2107 attacker may also modify EAP headers (Code, Identifier, Length, Type) 2108 within EAP packets where the header is unprotected. This could cause 2109 packets to be inappropriately discarded or misinterpreted. 2111 In the case of PPP and IEEE 802 wired links, it is assumed that such 2112 attacks are restricted to attackers who can gain access to the 2113 physical link. However, where EAP is run over physically insecure 2114 lower layers such as wireless (802.11 or cellular) or the Internet 2115 (such as within protocols supporting PPP, EAP or Ethernet Tunneling), 2116 this assumption is no longer valid and the vulnerability to attack is 2117 greater. 2119 To protect EAP messages sent over physically insecure lower layers, 2120 methods providing mutual authentication and key derivation, as well 2121 as per-packet origin authentication, integrity and replay protection 2122 SHOULD be used. 2124 Method-specific MICs may be used to provide protection. If a 2125 per-packet MIC is employed within an EAP method, then peers, 2126 authentication servers, and authenticators not operating in 2127 pass-through mode MUST validate the MIC. MIC validation failures 2128 SHOULD be logged. Whether a MIC validation failure is considered a 2129 fatal error or not is determined by the EAP method specification. 2131 Since EAP messages of Types Identity, Notification, and Nak do not 2132 include their own MIC, it may be desirable for the EAP method MIC to 2133 cover information contained within these messages, as well as the 2134 header of each EAP message. 2136 To provide protection, EAP also may be encapsulated within a 2137 protected channel created by protocols such as ISAKMP [RFC2408] as is 2138 done in [IKEv2] or within TLS [RFC2246]. However, as noted in Section 2139 7.4, EAP tunneling may result in a man-in-the-middle vulnerability. 2141 Existing EAP methods define message integrity checks (MICs) that 2142 cover more than one EAP packet. For example, EAP-TLS [RFC2716] 2143 defines a MIC over a TLS record that could be split into multiple 2144 fragments; within the FINISHED message, the MIC is computed over 2145 previous messages. Where the MIC covers more than one EAP packet, a 2146 MIC validation failure is typically considered a fatal error. 2148 Within EAP-TLS [RFC2716] a MIC validation failure is treated as a 2149 fatal error, since that is what is specified in TLS [RFC2246]. 2150 However, it is also possible to develop EAP methods that support 2151 per-packet MICs, and respond to verification failures by silently 2152 discarding the offending packet. 2154 In this document, descriptions of EAP message handling assume that 2155 per-packet MIC validation, where it occurs, is effectively performed 2156 as though it occurs before sending any responses or changing the 2157 state of the host which received the packet. 2159 7.6 Dictionary attacks 2161 Password authentication algorithms such as EAP-MD5, MS-CHAPv1 2162 [RFC2433] and Kerberos V [RFC1510] are known to be vulnerable to 2163 dictionary attacks. MS-CHAPv1 vulnerabilities are documented in 2164 [PPTPv1]; Kerberos vulnerabilities are described in [KRBATTACK], 2165 [KRBLIM], and [KERB4WEAK]. 2167 In order to protect against dictionary attacks, an authentication 2168 algorithm resistant to dictionary attack (as defined in Section 7.2) 2169 SHOULD be used where EAP runs over lower layers which are not 2170 physically secure. 2172 If an authentication algorithm is used that is known to be vulnerable 2173 to dictionary attack, then the conversation may be tunneled within a 2174 protected channel in order to provide additional protection. However, 2175 as noted in Section 7.4, EAP tunneling may result in a 2176 man-in-the-middle vulnerability, and therefore dictionary attack 2177 resistant methods are preferred. 2179 7.7 Connection to an untrusted network 2181 With EAP methods supporting one-way authentication, such as EAP-MD5, 2182 the peer does not authenticate the authenticator. Where the lower 2183 layer is not physically secure (such as where EAP runs over wireless 2184 media or the Internet), the peer is vulnerable to a rogue 2185 authenticator. As a result, where the lower layer is not physically 2186 secure, a method supporting mutual authentication is RECOMMENDED. 2188 In EAP there is no requirement that authentication be full duplex or 2189 that the same protocol be used in both directions. It is perfectly 2190 acceptable for different protocols to be used in each direction. This 2191 will, of course, depend on the specific protocols negotiated. 2192 However, in general, completing a single unitary mutual 2193 authentication is preferable to two one-way authentications, one in 2194 each direction. This is because separate authentications that are 2195 not bound cryptographically so as to demonstrate they are part of the 2196 same session are subject to man-in-the-middle attacks, as discussed 2197 in Section 7.4. 2199 7.8 Negotiation attacks 2201 In a negotiation attack, the attacker attempts to convince the peer 2202 and authenticator to negotiate a less secure EAP method. EAP does 2203 not provide protection for Nak Response packets, although it is 2204 possible for a method to include coverage of Nak Responses within a 2205 method-specific MIC. 2207 Within or associated with each authenticator, it is not anticipated 2208 that a particular named peer will support a choice of methods. This 2209 would make the peer vulnerable to attacks that negotiate the least 2210 secure method from among a set. Instead, for each named peer there 2211 SHOULD be an indication of exactly one method used to authenticate 2212 that peer name. If a peer needs to make use of different 2213 authentication methods under different circumstances, then distinct 2214 identities SHOULD be employed, each of which identifies exactly one 2215 authentication method. 2217 7.9 Implementation idiosyncrasies 2219 The interaction of EAP with lower layers such as PPP and IEEE 802 are 2220 highly implementation dependent. 2222 For example, upon failure of authentication, some PPP implementations 2223 do not terminate the link, instead limiting traffic in Network-Layer 2224 Protocols to a filtered subset, which in turn allows the peer the 2225 opportunity to update secrets or send mail to the network 2226 administrator indicating a problem. Similarly, while in 2227 [IEEE-802.1X] an authentication failure will result in denied access 2228 to the controlled port, limited traffic may be permitted on the 2229 uncontrolled port. 2231 In EAP there is no provision for retries of failed authentication. 2232 However, in PPP the LCP state machine can renegotiate the 2233 authentication protocol at any time, thus allowing a new attempt. 2234 Similarly, in IEEE 802.1X the Supplicant or Authenticator can 2235 re-authenticate at any time. It is recommended that any counters 2236 used for authentication failure not be reset until after successful 2237 authentication, or subsequent termination of the failed link. 2239 7.10 Key derivation 2241 It is possible for the peer and EAP server to mutually authenticate 2242 and derive keys. In order to provide keying material for use in a 2243 subsequently negotiated ciphersuite, an EAP method supporting key 2244 derivation MUST export a Master Session Key (MSK) of at least 64 2245 octets, and an Extended Master Session Key (EMSK) of at least 64 2246 octets. EAP Methods deriving keys MUST provide for mutual 2247 authentication between the EAP peer and the EAP Server. 2249 The MSK and EMSK MUST NOT be used directly to protect data; however, 2250 they are of sufficient size to enable derivation of a AAA-Key 2251 subsequently used to derive Transient Session Keys (TSKs) for use 2252 with the selected ciphersuite. Each ciphersuite is responsible for 2253 specifying how to derive the TSKs from the AAA-Key. 2255 The AAA-Key is derived from the keying material exported by the EAP 2256 method (MSK and EMSK). This derivation occurs on the AAA server. In 2257 many existing protocols that use EAP, the AAA-Key and MSK are 2258 equivalent, but more complicated mechanisms are possible (see 2259 [KEYFRAME] for details). 2261 EAP methods SHOULD ensure the freshness of the MSK and EMSK even in 2262 cases where one party may not have a high quality random number 2263 generator. A RECOMMENDED method is for each party to provide a nonce 2264 of at least 128 bits, used in the derivation of the MSK and EMSK. 2266 EAP methods export the MSK and EMSK and not Transient Session Keys so 2267 as to allow EAP methods to be ciphersuite and media independent. 2268 Keying material exported by EAP methods MUST be independent of the 2269 ciphersuite negotiated to protect data. 2271 Depending on the lower layer, EAP methods may run before or after 2272 ciphersuite negotiation, so that the selected ciphersuite may not be 2273 known to the EAP method. By providing keying material usable with 2274 any ciphersuite, EAP methods can used with a wide range of 2275 ciphersuites and media. 2277 It is RECOMMENDED that methods providing integrity protection of EAP 2278 packets include coverage of all the EAP header fields, including the 2279 Code, Identifier, Length, Type and Type-Data fields. 2281 In order to preserve algorithm independence, EAP methods deriving 2282 keys SHOULD support (and document) the protected negotiation of the 2283 ciphersuite used to protect the EAP conversation between the peer and 2284 server. This is distinct from the ciphersuite negotiated between the 2285 peer and authenticator, used to protect data. 2287 The strength of Transient Session Keys (TSKs) used to protect data is 2288 ultimately dependent on the strength of keys generated by the EAP 2289 method. If an EAP method cannot produce keying material of sufficient 2290 strength, then the TSKs may be subject to brute force attack. In 2291 order to enable deployments requiring strong keys, EAP methods 2292 supporting key derivation SHOULD be capable of generating an MSK and 2293 EMSK, each with an effective key strength of at least 128 bits. 2295 Methods supporting key derivation MUST demonstrate cryptographic 2296 separation between the MSK and EMSK branches of the EAP key 2297 hierarchy. Without violating a fundamental cryptographic assumption 2298 (such as the non-invertibility of a one-way function) an attacker 2299 recovering the MSK or EMSK MUST NOT be able to recover the other 2300 quantity with a level of effort less than brute force. 2302 Non-overlapping substrings of the MSK MUST be cryptographically 2303 separate from each other, as defined in Section 7.2.1. That is, 2304 knowledge of one substring MUST NOT help in recovering some other 2305 substring without breaking some hard cryptographic assumption. This 2306 is required because some existing ciphersuites form TSKs by simply 2307 splitting the AAA-Key to pieces of appropriate length. Likewise, 2308 non-overlapping substrings of the EMSK MUST be cryptographically 2309 separate from each other, and from substrings of the MSK. 2311 The EMSK is reserved for future use and MUST remain on the EAP peer 2312 and EAP server where it is derived; it MUST NOT be transported to, or 2313 shared with, additional parties, or used to derive any other keys. 2314 (This restriction will be relaxed in a future document that specifies 2315 how the EMSK can be used.) 2317 Since EAP does not provide for explicit key lifetime negotiation, EAP 2318 peers, authenticators and authentication servers MUST be prepared for 2319 situations in which one of the parties discards key state which 2320 remains valid on another party. 2322 This specification does not provide detailed guidance on how EAP 2323 methods derive the MSK and EMSK; how the AAA-Key is derived from the 2324 MSK and/or EMSK; or how the TSKs are derived from the AAA-Key. 2326 The development and validation of key derivation algorithms is 2327 difficult, and as a result EAP methods SHOULD reuse well established 2328 and analyzed mechanisms for key derivation (such as those specified 2329 in IKE [RFC2409] or TLS [RFC2246]), rather than inventing new ones. 2330 EAP methods SHOULD also utilize well established and analyzed 2331 mechanisms for MSK and EMSK derivation. Further details on EAP Key 2332 Derivation are provided within [KEYFRAME]. 2334 7.11 Weak ciphersuites 2336 If after the initial EAP authentication, data packets are sent 2337 without per-packet authentication, integrity and replay protection, 2338 an attacker with access to the media can inject packets, "flip bits" 2339 within existing packets, replay packets, or even hijack the session 2340 completely. Without per-packet confidentiality, it is possible to 2341 snoop data packets. 2343 As a result, as noted in Section 3.1, where EAP is used over a 2344 physically insecure lower layer, per-packet authentication, integrity 2345 and replay protection SHOULD be used, and per-packet confidentiality 2346 is also recommended. 2348 Additionally, if the lower layer performs ciphersuite negotiation, it 2349 should be understood that EAP does not provide by itself integrity 2350 protection of that negotiation. Therefore, in order to avoid 2351 downgrading attacks which would lead to weaker ciphersuites being 2352 used, clients implementing lower layer ciphersuite negotiation SHOULD 2353 protect against negotiation downgrading. 2355 This can be done by enabling users to configure which are the 2356 acceptable ciphersuites as a matter of security policy; or, the 2357 ciphersuite negotiation MAY be authenticated using keying material 2358 derived from the EAP authentication and a MIC algorithm agreed upon 2359 in advance by lower-layer peers. 2361 7.12 Link layer 2363 There exists a number of reliability and security issues with link 2364 layer indications in PPP, IEEE 802 wired networks and IEEE 802.11 2365 wireless LANs: 2367 [a] PPP. In PPP, link layer indications such as LCP-Terminate (a 2368 link failure indication) and NCP (a link success indication) are 2369 not authenticated or integrity protected. They can therefore be 2370 spoofed by an attacker with access to the physical medium. 2372 [b] IEEE 802 wired networks. On wired networks, IEEE 802.1X messages 2373 are sent to a non-forwardable multicast MAC address. As a 2374 result, while the IEEE 802.1X EAPOL-Start and EAPOL-Logoff frames 2375 are not authenticated or integrity protected, only an attacker 2376 with access to the physical link can spoof these messages. 2378 [c] IEEE 802.11 wireless LANs. In IEEE 802.11, link layer 2379 indications include Disassociate and Deauthenticate frames (link 2380 failure indications), and the first message of the 4-way 2381 handshake (link success indication). These messages are not 2382 authenticated or integrity protected, and although they are not 2383 forwardable, they are spoofable by an attacker within range. 2385 In IEEE 802.11, IEEE 802.1X data frames may be sent as Class 3 2386 unicast data frames, and are therefore forwardable. This implies 2387 that while EAPOL-Start and EAPOL-Logoff messages may be 2388 authenticated and integrity protected, they can be spoofed by an 2389 authenticated attacker far from the target when 2390 "pre-authentication" is enabled. 2392 In IEEE 802.11 a "link down" indication is an unreliable 2393 indication of link failure, since wireless signal strength can 2394 come and go and may be influenced by radio frequency interference 2395 generated by an attacker. To avoid unnecessary resets, it is 2396 advisable to damp these indications, rather than passing them 2397 directly to the EAP. Since EAP supports retransmission, it is 2398 robust against transient connectivity losses. 2400 7.13 Separation of authenticator and backend authentication server 2402 It is possible for the EAP peer and EAP server to mutually 2403 authenticate and derive a AAA-Key for a ciphersuite used to protect 2404 subsequent data traffic. This does not present an issue on the peer, 2405 since the peer and EAP client reside on the same machine; all that is 2406 required is for the client to derive the AAA-Key from the MSK and 2407 EMSK exported by the EAP method, and to subsequently pass a Transient 2408 Session Key (TSK) to the ciphersuite module. 2410 However, in the case where the authenticator and authentication 2411 server reside on different machines, there are several implications 2412 for security. 2414 [a] Authentication will occur between the peer and the authentication 2415 server, not between the peer and the authenticator. This means 2416 that it is not possible for the peer to validate the identity of 2417 the authenticator that it is speaking to, using EAP alone. 2419 [b] As discussed in [RFC3579], the authenticator is dependent on the 2420 AAA protocol in order to know the outcome of an authentication 2421 conversation, and does not look at the encapsulated EAP packet 2422 (if one is present) to determine the outcome. In practice this 2423 implies that the AAA protocol spoken between the authenticator 2424 and authentication server MUST support per-packet authentication, 2425 integrity and replay protection. 2427 [c] Where EAP is used over lower layers which are not physically 2428 secure, after completion of the EAP conversation, a secure 2429 association protocol SHOULD be run between the peer and 2430 authenticator in order to provide mutual authentication; 2431 guarantee liveness of the TSKs; provide protected ciphersuite and 2432 capabilities negotiation; synchronize key usage. 2434 [d] A AAA-Key derived from the MSK and/or EMSK negotiated between the 2435 peer and authentication server MAY be transmitted to the 2436 authenticator. Therefore a mechanism needs to be provided to 2437 transmit the AAA-Key from the authentication server to the 2438 authenticator that needs it. The specification of the AAA-key 2439 derivation, transport and wrapping mechanisms is outside the 2440 scope of this document. Further details on AAA-Key Derivation are 2441 provided within [KEYFRAME]. 2443 7.14 Cleartext Passwords 2445 EAP does not support cleartext password authentication. This 2446 omission is intentional. Where EAP is carried over physically 2447 insecure lower layers, including wireless LANs [IEEE-802.11] or the 2448 Internet, use of cleartext passwords would allow the password to be 2449 captured by an attacker with access to the lower layer. 2451 Since protocols encapsulating EAP, such as RADIUS [RFC3579], may not 2452 provide confidentiality, even where the lower layer is physically 2453 secure, EAP frames may be subsequently encapsulated for transport 2454 over the Internet where they may be captured by an attacker. 2456 As a result, cleartext passwords cannot be securely used within EAP, 2457 except where encapsulated within a protected tunnel with server 2458 authentication. Some of the same risks apply to EAP methods without 2459 dictionary attack resistance, as defined in Section 7.2.1. For 2460 details, see Section 7.6. 2462 8. Acknowledgments 2464 This protocol derives much of its inspiration from Dave Carrel's AHA 2465 draft as well as the PPP CHAP protocol [RFC1994]. Valuable feedback 2466 was provided by Yoshihiro Ohba of Toshiba America Research, Jari 2467 Arkko of Ericsson, Sachin Seth of Microsoft, Glen Zorn of Cisco 2468 Systems, Jesse Walker of Intel, Bill Arbaugh, Nick Petroni and Bryan 2469 Payne of the University of Maryland, Steve Bellovin of AT&T Research, 2470 Paul Funk of Funk Software, Pasi Eronen of Nokia, Joseph Salowey of 2471 Cisco and Paul Congdon of HP and members of the EAP working group. 2473 Normative References 2475 [RFC1661] Simpson, W., "The Point-to-Point Protocol (PPP)", STD 51, 2476 RFC 1661, July 1994. 2478 [RFC1750] Eastlake, D., Crocker, S. and J. Schiller, "Randomness 2479 Recommendations for Security", RFC 1750, December 1994. 2481 [RFC1994] Simpson, W., "PPP Challenge Handshake Authentication 2482 Protocol (CHAP)", RFC 1994, August 1996. 2484 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 2485 Requirement Levels", BCP 14, RFC 2119, March 1997. 2487 [RFC2243] Metz, C., "OTP Extended Responses", RFC 2243, November 2488 1997. 2490 [RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO 2491 10646", RFC 2279, January 1998. 2493 [RFC2289] Haller, N., Metz, C., Nesser, P. and M. Straw, "A One-Time 2494 Password System", RFC 2289, February 1998. 2496 [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an 2497 IANA Considerations Section in RFCs", BCP 26, RFC 2434, 2498 October 1998. 2500 [RFC2988] Paxson, V. and M. Allman, "Computing TCP's Retransmission 2501 Timer", RFC 2988, November 2000. 2503 [IEEE-802] 2504 Institute of Electrical and Electronics Engineers, "Local 2505 and Metropolitan Area Networks: Overview and 2506 Architecture", IEEE Standard 802, 1990. 2508 [IEEE-802.1X] 2509 Institute of Electrical and Electronics Engineers, "Local 2510 and Metropolitan Area Networks: Port-Based Network Access 2511 Control", IEEE Standard 802.1X, September 2001. 2513 Informative References 2515 [RFC793] Postel, J., "Transmission Control Protocol", STD 7, RFC 2516 793, September 1981. 2518 [RFC1510] Kohl, J. and B. Neuman, "The Kerberos Network 2519 Authentication Service (V5)", RFC 1510, September 1993. 2521 [RFC2222] Myers, J., "Simple Authentication and Security Layer 2522 (SASL)", RFC 2222, October 1997. 2524 [RFC2246] Dierks, T., Allen, C., Treese, W., Karlton, P., Freier, A. 2525 and P. Kocher, "The TLS Protocol Version 1.0", RFC 2246, 2526 January 1999. 2528 [RFC2284] Blunk, L. and J. Vollbrecht, "PPP Extensible 2529 Authentication Protocol (EAP)", RFC 2284, March 1998. 2531 [RFC2486] Aboba, B. and M. Beadles, "The Network Access Identifier", 2532 RFC 2486, January 1999. 2534 [RFC2401] Kent, S. and R. Atkinson, "Security Architecture for the 2535 Internet Protocol", RFC 2401, November 1998. 2537 [RFC2408] Maughan, D., Schneider, M. and M. Schertler, "Internet 2538 Security Association and Key Management Protocol 2539 (ISAKMP)", RFC 2408, November 1998. 2541 [RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange 2542 (IKE)", RFC 2409, November 1998. 2544 [RFC2433] Zorn, G. and S. Cobb, "Microsoft PPP CHAP Extensions", RFC 2545 2433, October 1998. 2547 [RFC2607] Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy 2548 Implementation in Roaming", RFC 2607, June 1999. 2550 [RFC2661] Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, G. 2551 and B. Palter, "Layer Two Tunneling Protocol "L2TP"", RFC 2552 2661, August 1999. 2554 [RFC2716] Aboba, B. and D. Simon, "PPP EAP TLS Authentication 2555 Protocol", RFC 2716, October 1999. 2557 [RFC2743] Linn, J., "Generic Security Service Application Program 2558 Interface Version 2, Update 1", RFC 2743, January 2000. 2560 [RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C., 2561 Schwarzbauer, H., Taylor, T., Rytina, I., Kalla, M., 2562 Zhang, L. and V. Paxson, "Stream Control Transmission 2563 Protocol", RFC 2960, October 2000. 2565 [RFC3454] Hoffman, P. and M. Blanchet, "Preparation of 2566 Internationalized Strings ("stringprep")", RFC 3454, 2567 December 2002. 2569 [DECEPTION] 2570 Slatalla, M. and J. Quittner, "Masters of Deception", 2571 Harper-Collins , New York, 1995. 2573 [RFC3579] Aboba, B. and P. Calhoun, "RADIUS Support For Extensible 2574 Authentication Protocol (EAP)", RFC 3579, May 2003. 2576 [KRBATTACK] 2577 Wu, T., "A Real-World Analysis of Kerberos Password 2578 Security", Proceedings of the 1999 ISOC Network and 2579 Distributed System Security Symposium, http:// 2580 www.isoc.org/isoc/conferences/ndss/99/proceedings/papers/ 2581 wu.pdf. 2583 [KRBLIM] Bellovin, S. and M. Merrit, "Limitations of the Kerberos 2584 authentication system", Proceedings of the 1991 Winter 2585 USENIX Conference, pp. 253-267, 1991. 2587 [KERB4WEAK] 2588 Dole, B., Lodin, S. and E. Spafford, "Misplaced trust: 2589 Kerberos 4 session keys", Proceedings of the Internet 2590 Society Network and Distributed System Security Symposium, 2591 pp. 60-70, March 1997. 2593 [PIC] Aboba, B., Krawczyk, H. and Y. Sheffer, "PIC, A Pre-IKE 2594 Credential Provisioning Protocol", draft-ietf-ipsra-pic-06 2595 (work in progress), October 2002. 2597 [IKEv2] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", 2598 draft-ietf-ipsec-ikev2-10 (work in progress), May 2003. 2600 [PPTPv1] Schneier, B. and Mudge, "Cryptanalysis of Microsoft's 2601 Point-to- Point Tunneling Protocol", Proceedings of the 2602 5th ACM Conference on Communications and Computer 2603 Security, ACM Press, November 1998. 2605 [IEEE-802.3] 2606 Institute of Electrical and Electronics Engineers, 2607 "Information technology - Telecommunications and 2608 Information Exchange between Systems - Local and 2609 Metropolitan Area Networks - Specific requirements - Part 2610 3: Carrier sense multiple access with collision detection 2611 (CSMA/CD) Access Method and Physical Layer 2612 Specifications", IEEE Standard 802.3, September 1998. 2614 [IEEE-802.11] 2615 Institute of Electrical and Electronics Engineers, 2616 "Information Technology - Telecommunications and 2617 Information Exchange between Systems - Local and 2618 Metropolitan Area Network - Specific Requirements - Part 2619 11: Wireless LAN Medium Access Control (MAC) and Physical 2620 Layer (PHY) Specifications", IEEE Standard 802.11, 1999. 2622 [SILVERMAN] 2623 Silverman, Robert D., "A Cost-Based Security Analysis of 2624 Symmetric and Asymmetric Key Lengths", RSA Laboratories 2625 Bulletin 13, April 2000 (Revised November 2001), http:// 2626 www.rsasecurity.com/rsalabs/bulletins/bulletin13.html. 2628 [IANA-EXP] 2629 Narten, T., "Assigning Experimental and Testing Numbers 2630 Considered Useful", 2631 draft-narten-iana-experimental-allocations-03 (work in 2632 progress), December 2002. 2634 [KEYFRAME] 2635 Aboba, B. and D. Simon, "EAP Keying Framework", 2636 draft-aboba-pppext-key-problem-07 (work in progress), 2637 March 2003. 2639 [SASLPREP] 2640 Zeilenga, K., "SASLprep: Stringprep profile for user names 2641 and passwords", draft-ietf-sasl-saslprep-03 (work in 2642 progress), May 2003. 2644 [IEEE-802.11i] 2645 Institute of Electrical and Electronics Engineers, 2646 "Unapproved Draft Supplement to Standard for 2647 Telecommunications and Information Exchange Between 2648 Systems - LAN/MAN Specific Requirements - Part 11: 2649 Wireless LAN Medium Access Control (MAC) and Physical 2650 Layer (PHY) Specifications: Specification for Enhanced 2651 Security", IEEE Draft 802.11i (work in progress), 2003. 2653 [DIAM-EAP] 2654 Eronen, P., Hiller, T. and G. Zorn, "Diameter Extensible 2655 Authentication Protocol (EAP) Application", 2656 draft-ietf-aaa-eap-02 (work in progress), June 2003. 2658 Authors' Addresses 2660 Larry J. Blunk 2661 Merit Network, Inc 2662 4251 Plymouth Rd., Suite 2000 2663 Ann Arbor, MI 48105-2785 2664 USA 2666 Phone: +1 734-647-9563 2667 Fax: +1 734-647-3185 2668 EMail: ljb@merit.edu 2670 John R. Vollbrecht 2671 Vollbrecht Consulting LLC 2672 9682 Alice Hill Drive 2673 Dexter, MI 48130 2674 USA 2676 Phone: 2677 EMail: jrv@umich.edu 2678 Bernard Aboba 2679 Microsoft Corporation 2680 One Microsoft Way 2681 Redmond, WA 98052 2682 USA 2684 Phone: +1 425 706 6605 2685 Fax: +1 425 936 6605 2686 EMail: bernarda@microsoft.com 2688 James Carlson 2689 Sun Microsystems, Inc 2690 1 Network Drive 2691 Burlington, MA 01803-2757 2692 USA 2694 Phone: +1 781 442 2084 2695 Fax: +1 781 442 1677 2696 EMail: james.d.carlson@sun.com 2698 Henrik Levkowetz 2699 ipUnplugged AB 2700 Arenavagen 33 2701 Stockholm S-121 28 2702 SWEDEN 2704 Phone: +46 708 32 16 08 2705 EMail: henrik@levkowetz.com 2707 Appendix A. Changes from RFC 2284 2709 This section lists the major changes between [RFC2284] and this 2710 document. Minor changes, including style, grammar, spelling and 2711 editorial changes are not mentioned here. 2713 o The Terminology section (Section 1.2) has been expanded, defining 2714 more concepts and giving more exact definitions. 2716 o The two concepts Mutual authentication and Key derivation are 2717 introduced, and discussed throughout the document where 2718 appropriate. 2720 o In Section 2, it is explicitly specified that more than one 2721 exchange of Request and Response packets may occur as part of the 2722 EAP authentication exchange. How this may and may not be used is 2723 specified in detail in Section 2.1. 2725 o Also in Section 2, some requirements on the authenticator when 2726 acting in pass-through mode has been made explicit. 2728 o An EAP multiplexing model (Section 2.2) has been added, to 2729 illustrate a typical implementation of EAP. There is no 2730 requirement that an implementation conforms to this model, as long 2731 as the on-the-wire behavior is consistent with it. 2733 o As EAP is now in use with a variety of lower layers, not just PPP 2734 for which it was first designed, Section 3 on lower layer behavior 2735 has been added. 2737 o In the description of the EAP Request and Response interaction 2738 (Section 4.1), it has been more exactly specified when packets 2739 should be silently discarded, and also the behavior on receiving 2740 duplicate requests. The implementation notes in this section has 2741 been substantially expanded. 2743 o In Section 4.2, it has been clarified that Success and Failure 2744 packets must not contain additional data, and the implementation 2745 note has been expanded. A subsection giving requirements on 2746 processing of success and failure packets has been added. 2748 o Section 5 on EAP Request/Response Types lists two new Type values: 2749 the Expanded Type (Section 5.7), which is used to expand the Type 2750 value number space, and the Experimental Type. In the Expanded 2751 Type number space, the new Expanded Nak (Section 5.3.2) Type has 2752 been added. Clarifications have been made in the description of 2753 most of the existing Types. Security claims summaries have been 2754 added for authentication methods. 2756 o In Section 5, Section 5.1 and Section 5.2, requirements has been 2757 added that fields with displayable messages should contain UTF-8 2758 encoded ISO 10646 characters. 2760 o In Section 5.5, support for OTP Extended Responses [RFC2243] has 2761 been added to EAP OTP. 2763 o An IANA Considerations section (Section 6) has been added, giving 2764 registration policies for the numbering spaces defined for EAP. 2766 o The Security Considerations (Section 7) have been greatly 2767 expanded, aiming at giving a much more comprehensive coverage of 2768 possible threats and other security considerations. 2770 o In Section 7.5, text has been added on method-specific behavior, 2771 providing guidance on how EAP method-specific integrity checks 2772 should be processed. Where possible, it is desirable for a 2773 method-specific MIC to be computed over the entire EAP packet, 2774 including the EAP layer header (Code, Identifier, Length) and EAP 2775 method layer header (Type, Type-Data). 2777 Appendix B. Open issues 2779 (This section should be removed by the RFC editor before publication) 2781 Open issues relating to this specification are tracked on the 2782 following web site: 2784 http://www.drizzle.com/~aboba/EAP/eapissues.html 2786 The current working documents for this draft are available at this 2787 web site: 2789 http://www.levkowetz.com/pub/ietf/drafts/eap/ 2791 Intellectual Property Statement 2793 The IETF takes no position regarding the validity or scope of any 2794 intellectual property or other rights that might be claimed to 2795 pertain to the implementation or use of the technology described in 2796 this document or the extent to which any license under such rights 2797 might or might not be available; neither does it represent that it 2798 has made any effort to identify any such rights. Information on the 2799 IETF's procedures with respect to rights in standards-track and 2800 standards-related documentation can be found in BCP-11. Copies of 2801 claims of rights made available for publication and any assurances of 2802 licenses to be made available, or the result of an attempt made to 2803 obtain a general license or permission for the use of such 2804 proprietary rights by implementors or users of this specification can 2805 be obtained from the IETF Secretariat. 2807 The IETF invites any interested party to bring to its attention any 2808 copyrights, patents or patent applications, or other proprietary 2809 rights which may cover technology that may be required to practice 2810 this standard. Please address the information to the IETF Executive 2811 Director. 2813 Full Copyright Statement 2815 Copyright (C) The Internet Society (2003). All Rights Reserved. 2817 This document and translations of it may be copied and furnished to 2818 others, and derivative works that comment on or otherwise explain it 2819 or assist in its implementation may be prepared, copied, published 2820 and distributed, in whole or in part, without restriction of any 2821 kind, provided that the above copyright notice and this paragraph are 2822 included on all such copies and derivative works. However, this 2823 document itself may not be modified in any way, such as by removing 2824 the copyright notice or references to the Internet Society or other 2825 Internet organizations, except as needed for the purpose of 2826 developing Internet standards in which case the procedures for 2827 copyrights defined in the Internet Standards process must be 2828 followed, or as required to translate it into languages other than 2829 English. 2831 The limited permissions granted above are perpetual and will not be 2832 revoked by the Internet Society or its successors or assignees. 2834 This document and the information contained herein is provided on an 2835 "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING 2836 TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 2837 BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION 2838 HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF 2839 MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 2841 Acknowledgement 2843 Funding for the RFC Editor function is currently provided by the 2844 Internet Society.