idnits 2.17.1 draft-ietf-eap-rfc2284bis-07.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Looks like you're using RFC 2026 boilerplate. This must be updated to follow RFC 3978/3979, as updated by RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- == No 'Intended status' indicated for this document; assuming Proposed Standard Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** There is 1 instance of too long lines in the document, the longest one being 19 characters in excess of 72. ** There are 11 instances of lines with control characters in the document. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year == Line 724 has weird spacing: '...methods origi...' == Line 1528 has weird spacing: '...ed Type of 6 ...' == Line 1627 has weird spacing: '...pe-Data field...' == Line 1957 has weird spacing: '...; or by gener...' == The document seems to use 'NOT RECOMMENDED' as an RFC 2119 keyword, but does not include the phrase in its RFC 2119 key words list. -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (November 27, 2003) is 7457 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) -- Looks like a reference, but probably isn't: '1' on line 1950 -- Looks like a reference, but probably isn't: '2' on line 1953 -- Looks like a reference, but probably isn't: '3' on line 1955 -- Looks like a reference, but probably isn't: '4' on line 1960 -- Looks like a reference, but probably isn't: '5' on line 1963 -- Looks like a reference, but probably isn't: '6' on line 1966 -- Looks like a reference, but probably isn't: '7' on line 1969 -- Looks like a reference, but probably isn't: '8' on line 1972 -- Looks like a reference, but probably isn't: '9' on line 1975 -- Looks like a reference, but probably isn't: '10' on line 1979 == Unused Reference: 'RFC2401' is defined on line 2711, but no explicit reference was found in the text == Unused Reference: 'IEEE-802.3' is defined on line 2795, but no explicit reference was found in the text ** Obsolete normative reference: RFC 1750 (Obsoleted by RFC 4086) ** Obsolete normative reference: RFC 2279 (Obsoleted by RFC 3629) ** Obsolete normative reference: RFC 2434 (Obsoleted by RFC 5226) ** Obsolete normative reference: RFC 2988 (Obsoleted by RFC 6298) -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE-802' -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE-802.1X' -- Obsolete informational reference (is this intentional?): RFC 793 (Obsoleted by RFC 9293) -- Obsolete informational reference (is this intentional?): RFC 1510 (Obsoleted by RFC 4120, RFC 6649) -- Obsolete informational reference (is this intentional?): RFC 2222 (Obsoleted by RFC 4422, RFC 4752) -- Obsolete informational reference (is this intentional?): RFC 2246 (Obsoleted by RFC 4346) -- Obsolete informational reference (is this intentional?): RFC 2284 (Obsoleted by RFC 3748) -- Obsolete informational reference (is this intentional?): RFC 2486 (Obsoleted by RFC 4282) -- Obsolete informational reference (is this intentional?): RFC 2401 (Obsoleted by RFC 4301) -- Obsolete informational reference (is this intentional?): RFC 2408 (Obsoleted by RFC 4306) -- Obsolete informational reference (is this intentional?): RFC 2409 (Obsoleted by RFC 4306) -- Obsolete informational reference (is this intentional?): RFC 2716 (Obsoleted by RFC 5216) -- Obsolete informational reference (is this intentional?): RFC 2960 (Obsoleted by RFC 4960) -- Obsolete informational reference (is this intentional?): RFC 3454 (Obsoleted by RFC 7564) == Outdated reference: A later version (-07) exists of draft-ietf-ipsra-pic-06 == Outdated reference: A later version (-17) exists of draft-ietf-ipsec-ikev2-11 == Outdated reference: A later version (-22) exists of draft-ietf-eap-keying-01 == Outdated reference: A later version (-10) exists of draft-ietf-sasl-saslprep-04 == Outdated reference: A later version (-10) exists of draft-ietf-aaa-eap-03 Summary: 7 errors (**), 0 flaws (~~), 14 warnings (==), 26 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 EAP Working Group L. Blunk 3 Internet-Draft Merit Network, Inc 4 Obsoletes: 2284 (if approved) J. Vollbrecht 5 Expires: May 27, 2004 Vollbrecht Consulting LLC 6 B. Aboba 7 Microsoft 8 J. Carlson 9 Sun 10 H. Levkowetz, Ed. 11 ipUnplugged 12 November 27, 2003 14 Extensible Authentication Protocol (EAP) 15 17 Status of this Memo 19 This document is an Internet-Draft and is in full conformance with 20 all provisions of Section 10 of RFC2026. 22 Internet-Drafts are working documents of the Internet Engineering 23 Task Force (IETF), its areas, and its working groups. Note that other 24 groups may also distribute working documents as Internet-Drafts. 26 Internet-Drafts are draft documents valid for a maximum of six months 27 and may be updated, replaced, or obsoleted by other documents at any 28 time. It is inappropriate to use Internet-Drafts as reference 29 material or to cite them other than as "work in progress". 31 The list of current Internet-Drafts can be accessed at http:// 32 www.ietf.org/ietf/1id-abstracts.txt 34 The list of Internet-Draft Shadow Directories can be accessed at 35 http://www.ietf.org/shadow.html 37 This Internet-Draft will expire on May 27, 2004. 39 Copyright Notice 41 Copyright (C) The Internet Society (2003). All Rights Reserved. 43 Abstract 45 This document defines the Extensible Authentication Protocol (EAP), 46 an authentication framework which supports multiple authentication 47 methods. EAP typically runs directly over data link layers such as 48 PPP or IEEE 802, without requiring IP. EAP provides its own support 49 for duplicate elimination and retransmission, but is reliant on lower 50 layer ordering guarantees. Fragmentation is not supported within EAP 51 itself; however, individual EAP methods may support this. 53 This document obsoletes RFC 2284. A summary of the changes between 54 this document and RFC 2284 is available in Appendix A. 56 Table of Contents 58 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4 59 1.1 Specification of Requirements . . . . . . . . . . . . 4 60 1.2 Terminology . . . . . . . . . . . . . . . . . . . . . 4 61 1.3 Applicability . . . . . . . . . . . . . . . . . . . . 6 62 2. Extensible Authentication Protocol (EAP) . . . . . . . . . . 7 63 2.1 Support for sequences . . . . . . . . . . . . . . . . 9 64 2.2 EAP multiplexing model . . . . . . . . . . . . . . . . 10 65 2.3 Pass-through behavior . . . . . . . . . . . . . . . . 12 66 2.4 Peer-to-Peer Operation . . . . . . . . . . . . . . . . 14 67 3. Lower layer behavior . . . . . . . . . . . . . . . . . . . . 15 68 3.1 Lower layer requirements . . . . . . . . . . . . . . . 15 69 3.2 EAP usage within PPP . . . . . . . . . . . . . . . . . 17 70 3.2.1 PPP Configuration Option Format . . . . . . . . 18 71 3.3 EAP usage within IEEE 802 . . . . . . . . . . . . . . 19 72 3.4 Lower layer indications . . . . . . . . . . . . . . . 19 73 4. EAP Packet format . . . . . . . . . . . . . . . . . . . . . 20 74 4.1 Request and Response . . . . . . . . . . . . . . . . . 21 75 4.2 Success and Failure . . . . . . . . . . . . . . . . . 23 76 4.3 Retransmission Behavior . . . . . . . . . . . . . . . 26 77 5. Initial EAP Request/Response Types . . . . . . . . . . . . . 27 78 5.1 Identity . . . . . . . . . . . . . . . . . . . . . . . 28 79 5.2 Notification . . . . . . . . . . . . . . . . . . . . . 29 80 5.3 Nak . . . . . . . . . . . . . . . . . . . . . . . . . 31 81 5.3.1 Legacy Nak . . . . . . . . . . . . . . . . . . . 31 82 5.3.2 Expanded Nak . . . . . . . . . . . . . . . . . . 32 83 5.4 MD5-Challenge . . . . . . . . . . . . . . . . . . . . 35 84 5.5 One-Time Password (OTP) . . . . . . . . . . . . . . . 37 85 5.6 Generic Token Card (GTC) . . . . . . . . . . . . . . . 38 86 5.7 Expanded Types . . . . . . . . . . . . . . . . . . . . 39 87 5.8 Experimental . . . . . . . . . . . . . . . . . . . . . 40 88 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . 41 89 6.1 Packet Codes . . . . . . . . . . . . . . . . . . . . . 42 90 6.2 Method Types . . . . . . . . . . . . . . . . . . . . . 42 91 7. Security Considerations . . . . . . . . . . . . . . . . . . 42 92 7.1 Threat model . . . . . . . . . . . . . . . . . . . . . 43 93 7.2 Security claims . . . . . . . . . . . . . . . . . . . 44 94 7.2.1 Security claims terminology for EAP methods . . 45 95 7.3 Identity protection . . . . . . . . . . . . . . . . . 47 96 7.4 Man-in-the-middle attacks . . . . . . . . . . . . . . 48 97 7.5 Packet modification attacks . . . . . . . . . . . . . 49 98 7.6 Dictionary attacks . . . . . . . . . . . . . . . . . . 50 99 7.7 Connection to an untrusted network . . . . . . . . . . 50 100 7.8 Negotiation attacks . . . . . . . . . . . . . . . . . 51 101 7.9 Implementation idiosyncrasies . . . . . . . . . . . . 51 102 7.10 Key derivation . . . . . . . . . . . . . . . . . . . . 51 103 7.11 Weak ciphersuites . . . . . . . . . . . . . . . . . . 53 104 7.12 Link layer . . . . . . . . . . . . . . . . . . . . . . 54 105 7.13 Separation of authenticator and backend authentication 106 server . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 107 7.14 Cleartext Passwords . . . . . . . . . . . . . . . . . 56 108 7.15 Channel binding . . . . . . . . . . . . . . . . . . . 56 109 8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . 57 110 Normative References . . . . . . . . . . . . . . . . . . . . 57 111 Informative References . . . . . . . . . . . . . . . . . . . 58 112 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 62 113 A. Changes from RFC 2284 . . . . . . . . . . . . . . . . . . . 63 114 B. Open issues . . . . . . . . . . . . . . . . . . . . . . . . 64 115 Intellectual Property and Copyright Statements . . . . . . . 66 117 1. Introduction 119 This document defines the Extensible Authentication Protocol (EAP), 120 an authentication framework which supports multiple authentication 121 methods. EAP typically runs directly over data link layers such as 122 PPP or IEEE 802, without requiring IP. EAP provides its own support 123 for duplicate elimination and retransmission, but is reliant on lower 124 layer ordering guarantees. Fragmentation is not supported within EAP 125 itself; however, individual EAP methods may support this. 127 EAP may be used on dedicated links as well as switched circuits, and 128 wired as well as wireless links. To date, EAP has been implemented 129 with hosts and routers that connect via switched circuits or dial-up 130 lines using PPP [RFC1661]. It has also been implemented with 131 switches and access points using IEEE 802 [IEEE-802]. EAP 132 encapsulation on IEEE 802 wired media is described in [IEEE-802.1X], 133 and encapsulation on IEEE wireless LANs in [IEEE-802.11i]. 135 One of the advantages of the EAP architecture is its flexibility. EAP 136 is used to select a specific authentication mechanism, typically 137 after the authenticator requests more information in order to 138 determine the specific authentication method to be used. Rather than 139 requiring the authenticator to be updated to support each new 140 authentication method, EAP permits the use of a backend 141 authentication server which may implement some or all authentication 142 methods, with the authenticator acting as a pass-through for some or 143 all methods and peers. 145 Within this document, authenticator requirements apply regardless of 146 whether the authenticator is operating as a pass-through or not. 147 Where the requirement is meant to apply to either the authenticator 148 or backend authentication server, depending on where the EAP 149 authentication is terminated, the term "EAP server" will be used. 151 1.1 Specification of Requirements 153 In this document, several words are used to signify the requirements 154 of the specification. These words are often capitalized. The key 155 words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", 156 "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document 157 are to be interpreted as described in [RFC2119]. 159 1.2 Terminology 161 This document frequently uses the following terms: 163 authenticator 164 The end of the link initiating EAP authentication. The term 165 Authenticator is used in [IEEE-802.1X], and authenticator 166 has the same meaning in this document. 168 peer 169 The end of the link that responds to the authenticator. In 170 [IEEE-802.1X], this end is known as the Supplicant. 172 backend authentication server 173 A backend authentication server is an entity that provides 174 an authentication service to an authenticator. When used, 175 this server typically executes EAP methods for the 176 authenticator. This terminology is also used in 177 [IEEE-802.1X]. 179 AAA 180 Authentication, Authorization and Accounting. AAA 181 protocols with EAP support include RADIUS [RFC3579] and 182 Diameter [DIAM-EAP]. In this document, the terms "AAA 183 server" and "backend authentication server" are used 184 interchangeably. 186 Displayable Message 187 This is interpreted to be a human readable string of 188 characters. The message encoding MUST follow the UTF-8 189 transformation format [RFC2279]. 191 EAP server 192 The entity that terminates the EAP authentication method 193 with the peer. In the case where no backend authentication 194 server is used, the EAP server is part of the 195 authenticator. In the case where the authenticator 196 operates in pass-through mode, the EAP server is located on 197 the backend authentication server. 199 Silently Discard 200 This means the implementation discards the packet without 201 further processing. The implementation SHOULD provide the 202 capability of logging the event, including the contents of 203 the silently discarded packet, and SHOULD record the event 204 in a statistics counter. 206 Successful authentication 207 In the context of this document, "successful 208 authentication" is an exchange of EAP messages, as a result 209 of which the authenticator decides to allow access by the 210 peer, and the peer decides to use this access. The 211 authenticator's decision typically involves both 212 authentication and authorization aspects; the peer may 213 successfully authenticate to the authenticator but access 214 may be denied by the authenticator due to policy reasons. 216 Message Integrity Check (MIC) 217 A keyed hash function used for authentication and integrity 218 protection of data. This is usually called a Message 219 Authentication Code (MAC), but IEEE 802 specifications (and 220 this document) use the acronym MIC to avoid confusion with 221 Medium Access Control. 223 Cryptographic separation 224 Two keys (x and y) are "cryptographically separate" if an 225 adversary that knows all messages exchanged in the protocol 226 cannot compute x from y or y from x without "breaking" some 227 cryptographic assumption. In particular, this definition 228 allows that the adversary has the knowledge of all nonces 229 sent in cleartext as well as all predictable counter values 230 used in the protocol. Breaking a cryptographic assumption 231 would typically require inverting a one-way function or 232 predicting the outcome of a cryptographic pseudo-random 233 number generator without knowledge of the secret state. In 234 other words, if the keys are cryptographically separate, 235 there is no shortcut to compute x from y or y from x, but 236 the work an adversary must do to perform this computation 237 is equivalent to performing exhaustive search for the 238 secret state value. 240 Master Session Key (MSK) 241 Keying material that is derived between the EAP peer and 242 server and exported by the EAP method. The MSK is at least 243 64 octets in length. In existing implementations a AAA 244 server acting as an EAP server transports the MSK to the 245 authenticator. 247 Extended Master Session Key (EMSK) 248 Additional keying material derived between the EAP client 249 and server that is exported by the EAP method. The EMSK is 250 at least 64 octets in length. The EMSK is reserved for 251 future uses that are not defined yet and is not provided to 252 a third party. 254 1.3 Applicability 256 EAP is an authentication framework primarily for use in situations 257 such as network access, in which IP layer connectivity may not be 258 available. 260 Since the goal of EAP is to support authentication without requiring 261 IP connectivity, it provides just enough support for the reliable 262 transport of authentication protocols, and no more. EAP is a 263 lock-step protocol and does not support an efficient reliable 264 transport service as in TCP [RFC793] or SCTP [RFC2960]. While EAP 265 provides support for retransmission, it assumes ordering guarantees 266 provided by the lower layer, so that out of order reception is not 267 supported. 269 As noted in Section 3.1, EAP does not support fragmentation and 270 reassembly as in IP, although EAP methods may provide support for 271 this. As a result, authentication protocols generating payloads 272 larger than the EAP MTU will need to be modified in order to provide 273 fragmentation support. 275 EAP authentication is initiated by the authenticator, whereas many 276 authentication protocols are initiated by the client (peer). As a 277 result, it may be necessary for an algorithm to add 0.5 - 1 278 additional roundtrips between the client and authenticator in order 279 to run over EAP. 281 As a result, an authentication algorithm will typically require more 282 round-trips when run over EAP than when run directly over IP. 283 Additionally, certificate-based authentication algorithms using long 284 certificate chains can result in many round-trips due to 285 fragmentation. 287 Where EAP runs over a lower layer in which significant packet loss is 288 experienced, or where the connection between the authenticator and 289 authentication server experiences significant packet loss, EAP 290 methods requiring many round-trips may experience difficulties. In 291 these situations, use of EAP methods with fewer round trips is 292 advisable. 294 Where transport efficiency is a consideration, and IP transport is 295 available, it may be preferable to expose an artificially high EAP 296 MTU to EAP and allow fragmentation to take place in IP. 297 Alternatively, it is possible to choose other security mechanisms 298 such as TLS [RFC2246] or IKE [RFC2409] or an alternative 299 authentication framework such as SASL [RFC2222] or GSS-API [RFC2743]. 301 2. Extensible Authentication Protocol (EAP) 303 The EAP authentication exchange proceeds as follows: 305 [1] The authenticator sends a Request to authenticate the peer. The 306 Request has a Type field to indicate what is being requested. 307 Examples of Request Types include Identity, MD5-challenge, etc. 308 The MD5-challenge Type corresponds closely to the CHAP 309 authentication protocol [RFC1994]. Typically, the authenticator 310 will send an initial Identity Request; however, an initial 311 Identity Request is not required, and MAY be bypassed. For 312 example, the identity may not be required where it is determined 313 by the port to which the peer has connected (leased lines, 314 dedicated switch or dial-up ports); or where the identity is 315 obtained in another fashion (via calling station identity or MAC 316 address, in the Name field of the MD5-Challenge Response, etc.). 318 [2] The peer sends a Response packet in reply to a valid Request. As 319 with the Request packet the Response packet contains a Type 320 field, which corresponds to the Type field of the Request. 322 [3] The authenticator sends an additional Request packet, and the 323 peer replies with a Response. The sequence of Requests and 324 Responses continues as long as needed. EAP is a 'lock step' 325 protocol, so that other than the initial Request, a new Request 326 cannot be sent prior to receiving a valid Response. The 327 authenticator is responsible for retransmitting requests as 328 described in Section 4.1. After a suitable number of 329 retransmissions, the authenticator SHOULD end the EAP 330 conversation. The authenticator MUST NOT send a Success or 331 Failure packet when retransmitting or when it fails to get a 332 response from the peer. 334 [4] The conversation continues until the authenticator cannot 335 authenticate the peer (unacceptable Responses to one or more 336 Requests), in which case the authenticator implementation MUST 337 transmit an EAP Failure (Code 4). Alternatively, the 338 authentication conversation can continue until the authenticator 339 determines that successful authentication has occurred, in which 340 case the authenticator MUST transmit an EAP Success (Code 3). 342 Advantages: 344 o The EAP protocol can support multiple authentication mechanisms 345 without having to pre-negotiate a particular one. 347 o Network Access Server (NAS) devices (e.g., a switch or access 348 point) do not have to understand each authentication method and 349 MAY act as a pass-through agent for a backend authentication 350 server. Support for pass-through is optional. An authenticator 351 MAY authenticate local peers while at the same time acting as a 352 pass-through for non-local peers and authentication methods it 353 does not implement locally. 355 o Separation of the authenticator from the backend authentication 356 server simplifies credentials management and policy decision 357 making. 359 Disadvantages: 361 o For use in PPP, EAP does require the addition of a new 362 authentication Type to PPP LCP and thus PPP implementations will 363 need to be modified to use it. It also strays from the previous 364 PPP authentication model of negotiating a specific authentication 365 mechanism during LCP. Similarly, switch or access point 366 implementations need to support [IEEE-802.1X] in order to use EAP. 368 o Where the authenticator is separate from the backend 369 authentication server, this complicates the security analysis and, 370 if needed, key distribution. 372 2.1 Support for sequences 374 An EAP conversation MAY utilize a sequence of methods. A common 375 example of this is an Identity request followed by a single EAP 376 authentication method such as an MD5-Challenge. However the peer and 377 authenticator MUST utilize only one authentication method (Type 4 or 378 greater) within an EAP conversation, after which the authenticator 379 MUST send a Success or Failure packet. 381 Once a peer has sent a Response of the same Type as the initial 382 Request, an authenticator MUST NOT send a Request of a different Type 383 prior to completion of the final round of a given method (with the 384 exception of a Notification-Request) and MUST NOT send a Request for 385 an additional method of any Type after completion of the initial 386 authentication method; a peer receiving such Requests MUST treat them 387 as invalid, and silently discard them. As a result, Identity Requery 388 is not supported. 390 A peer MUST NOT send a Nak (legacy or expanded) in reply to a 391 Request, after an initial non-Nak Response has been sent. Since 392 spoofed EAP Request packets may be sent by an attacker, an 393 authenticator receiving an unexpected Nak SHOULD discard it and log 394 the event. 396 Multiple authentication methods within an EAP conversation are not 397 supported due to their vulnerability to man-in-the-middle attacks 398 (see Section 7.4) and incompatibility with existing implementations. 400 Where a single EAP authentication method is utilized, but other 401 methods are run within it (a "tunneled" method) the prohibition 402 against multiple authentication methods does not apply. Such 403 "tunneled" methods appear as a single authentication method to EAP. 404 Backward compatibility can be provided, since a peer not supporting a 405 "tunneled" method can reply to the initial EAP-Request with a Nak 406 (legacy or expanded). To address security vulnerabilities, 407 "tunneled" methods MUST support protection against man-in-the-middle 408 attacks. 410 2.2 EAP multiplexing model 412 Conceptually, EAP implementations consist of the following 413 components: 415 [a] Lower layer. The lower layer is responsible for transmitting and 416 receiving EAP frames between the peer and authenticator. EAP has 417 been run over a variety of lower layers including PPP; wired IEEE 418 802 LANs [IEEE-802.1X] ; IEEE 802.11 wireless LANs [IEEE-802.11]; 419 UDP ( L2TP [RFC2661] and IKEv2 [IKEv2]); and TCP [PIC]. Lower 420 layer behavior is discussed in Section 3. 422 [b] EAP layer. The EAP layer receives and transmits EAP packets via 423 the lower layer, implements duplicate detection and 424 retransmission, and delivers and receives EAP messages to and 425 from the EAP peer and authenticator layers. 427 [c] EAP peer and authenticator layers. Based on the Code field, the 428 EAP layer demultiplexes incoming EAP packets to the EAP peer and 429 authenticator layers. Typically an EAP implementation on a given 430 host will support either peer or authenticator functionality, but 431 it is possible for a host to act as both an EAP peer and 432 authenticator. In such an implementation both EAP peer and 433 authenticator layers will be present. 435 [d] EAP method layers. EAP methods implement the authentication 436 algorithms and receive and transmit EAP messages via the EAP peer 437 and authenticator layers. Since fragmentation support is not 438 provided by EAP itself, this is the responsibility of EAP 439 methods, which are discussed in Section 5. 441 The EAP multiplexing model is illustrated in Figure 1 below. Note 442 that there is no requirement that an implementation conform to this 443 model, as long as the on-the-wire behavior is consistent with it. 445 +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ 446 | | | | | | 447 | EAP method| EAP method| | EAP method| EAP method| 448 | Type = X | Type = Y | | Type = X | Type = Y | 449 | V | | | ^ | | 450 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 451 | ! | | ! | 452 | EAP ! Peer layer | | EAP ! Auth. layer | 453 | ! | | ! | 454 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 455 | ! | | ! | 456 | EAP ! layer | | EAP ! layer | 457 | ! | | ! | 458 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 459 | ! | | ! | 460 | Lower ! layer | | Lower ! layer | 461 | ! | | ! | 462 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 463 ! ! 464 ! Peer ! Authenticator 465 +------------>-------------+ 467 Figure 1: EAP Multiplexing Model 469 Within EAP, the Code field functions much like a protocol number in 470 IP. It is assumed that the EAP layer demultiplexes incoming EAP 471 packets according to the Code field. Received EAP packets with 472 Code=1 (Request), 3 (Success) and 4 (Failure) are delivered by the 473 EAP layer to the EAP peer layer, if implemented. EAP packets with 474 Code=2 (Response) are delivered to the EAP authenticator layer, if 475 implemented. 477 Within EAP, the Type field functions much like a port number in UDP 478 or TCP. It is assumed that the EAP peer and authenticator layers 479 demultiplex incoming EAP packets according to their Type, and deliver 480 them only to the EAP method corresponding to that Type. An EAP 481 method implementation on a host may register to receive packets from 482 the peer or authenticator layers, or both, depending on which role(s) 483 it supports. 485 Since EAP authentication methods may wish to access the Identity, 486 implementations SHOULD make the Identity Request and Response 487 accessible to authentication methods (Types 4 or greater) in addition 488 to the Identity method. The Identity Type is discussed in Section 489 5.1. 491 A Notification Response is only used as confirmation that the peer 492 received the Notification Request, not that it has processed it, or 493 displayed the message to the user. It cannot be assumed that the 494 contents of the Notification Request or Response is available to 495 another method. The Notification Type is discussed in Section 5.2. 497 Nak (Type 3) or Expanded Nak (Type 254) are utilized for the purposes 498 of method negotiation. Peers respond to an initial EAP Request for 499 an unacceptable Type with a Nak Response (Type 3) or Expanded Nak 500 Response (Type 254). It cannot be assumed that the contents of the 501 Nak Response(s) are available to another method. The Nak Type(s) are 502 discussed in Section 5.3. 504 EAP packets with Codes of Success or Failure do not include a Type 505 field, and are not delivered to an EAP method. Success and Failure 506 are discussed in Section 4.2. 508 Given these considerations, the Success, Failure, Nak Response(s) and 509 Notification Request/Response messages MUST NOT be used to carry data 510 destined for delivery to other EAP methods. 512 2.3 Pass-through behavior 514 When operating as a "pass-through authenticator", an authenticator 515 performs checks on the Code, Identifier and Length fields as 516 described in Section 4.1. It forwards EAP packets received from the 517 peer and destined to its authenticator layer to the backend 518 authentication server; packets received from the backend 519 authentication server destined to the peer are forwarded to it. 521 A host receiving an EAP packet may only do one of three things with 522 it: act on it, drop it, or forward it. The forwarding decision is 523 typically based only on examination of the Code, Identifier and 524 Length fields. A pass-through authenticator implementation MUST be 525 capable of forwarding to the backend authentication server EAP 526 packets received from the peer with Code=2 (Response). It also MUST 527 be capable of receiving EAP packets from the backend authentication 528 server and forwarding EAP packets of Code=1 (Request), Code=3 529 (Success), and Code=4 (Failure) to the peer. 531 Unless the authenticator implements one or more authentication 532 methods locally which support the authenticator role, the EAP method 533 layer header fields (Type, Type-Data) are not examined as part of the 534 forwarding decision. Where the authenticator supports local 535 authentication methods, it MAY examine the Type field to determine 536 whether to act on the packet itself or forward it. Compliant 537 pass-through authenticator implementations MUST by default forward 538 EAP packets of any Type. 540 EAP packets received with Code=1 (Request), Code=3 (Success), and 541 Code=4 (Failure) are demultiplexed by the EAP layer and delivered to 542 the peer layer. Therefore unless a host implements an EAP peer layer, 543 these packets will be silently discarded. Similarly, EAP packets 544 received with Code=2 (Response) are demultiplexed by the EAP layer 545 and delivered to the authenticator layer. Therefore unless a host 546 implements an EAP authenticator layer, these packets will be silently 547 discarded. The behavior of a "pass-through peer" is undefined within 548 this specification, and is unsupported by AAA protocols such as 549 RADIUS [RFC3579] and Diameter [DIAM-EAP]. 551 The forwarding model is illustrated in Figure 2. 553 Peer Pass-through Authenticator Authentication 554 Server 556 +-+-+-+-+-+-+ +-+-+-+-+-+-+ 557 | | | | 558 |EAP method | |EAP method | 559 | V | | ^ | 560 +-+-+-!-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-!-+-+-+ 561 | ! | |EAP | EAP | | | ! | 562 | ! | |Peer | Auth.| EAP Auth. | | ! | 563 |EAP ! peer| | | +-----------+ | |EAP !Auth.| 564 | ! | | | ! | ! | | ! | 565 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+ 566 | ! | | ! | ! | | ! | 567 |EAP !layer| | EAP !layer| EAP !layer | |EAP !layer| 568 | ! | | ! | ! | | ! | 569 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+ 570 | ! | | ! | ! | | ! | 571 |Lower!layer| | Lower!layer| AAA ! /IP | | AAA ! /IP | 572 | ! | | ! | ! | | ! | 573 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+ 574 ! ! ! ! 575 ! ! ! ! 576 +-------->--------+ +--------->-------+ 578 Figure 2: Pass-through Authenticator 580 For sessions in which the authenticator acts as a pass-through, it 581 MUST determine the outcome of the authentication solely based on the 582 Accept/Reject indication sent by the backend authentication server; 583 the outcome MUST NOT be determined by the contents of an EAP packet 584 sent along with the Accept/Reject indication, or the absence of such 585 an encapsulated EAP packet. 587 2.4 Peer-to-Peer Operation 589 Since EAP is a peer-to-peer protocol, an independent and simultaneous 590 authentication may take place in the reverse direction (depending on 591 the capabilities of the lower layer). Both peers may act as 592 authenticators and authenticatees at the same time, in which case it 593 is necessary for both peers to implement EAP authenticator and peer 594 layers. In addition, the EAP method implementations on both peers 595 must support both authenticator and peer functionality. 597 Although EAP supports peer-to-peer operation, some EAP 598 implementations, methods, AAA protocols and link layers may not 599 support this. Some EAP methods may support asymmetric 600 authentication, with one type of credential being required for the 601 peer and another type for the authenticator. Hosts supporting 602 peer-to-peer operation with such a method would need to be 603 provisioned with both types of credentials. 605 For example, EAP-TLS [RFC2716] is a client-server protocol with a 606 different certificate profile for the client and server. This 607 implies that a host supporting peer-to-peer authentication with 608 EAP-TLS would need to implement both the EAP peer and authenticator 609 layers; support both peer and authenticator roles in the EAP-TLS 610 implementation; and provision two distinct certificates, one 611 appropriate for each role. 613 AAA protocols such as RADIUS/EAP [RFC3579] and Diameter EAP 614 [DIAM-EAP] only support "passthrough authenticator" operation. As 615 noted in [RFC3579] Section 2.6.2, a RADIUS server responds to an 616 Access-Request encapsulating an EAP-Request, Success or Failure 617 packet with an Access-Reject. There is therefore no support for 618 "passthrough peer" operation. 620 Even where a method is used which supports mutual authentication and 621 protected result indications, several considerations may dictate that 622 two EAP authentications, (one in each direction) are required. These 623 include: 625 [1] Support for bi-directional session key derivation in the lower 626 layer. Lower layers such as IEEE 802.11 may only support 627 uni-directional derivation and transport of transient session 628 keys. For example, the group-key handshake defined in 629 [IEEE-802.11i] is uni-directional, since in IEEE 802.11 630 infrastructure mode only the Access Point (AP) sends multicast/ 631 broadcast traffic. In IEEE 802.11 ad-hoc mode where either peer 632 may send multicast/broadcast traffic, two uni-directional 633 group-key exchanges are required. Due to limitations of the 634 design, this also implies the need for unicast key derivations 635 and EAP method exchanges to occur in each direction. 637 [2] Support for tie-breaking in the lower layer. Lower layers such 638 as IEEE 802.11 adhoc do not support "tie breaking" wherein two 639 hosts initiating authentication with each other will only go 640 forward with a single authentication. This implies that even if 641 802.11 were to support a bi-directional group-key handshake, then 642 two authentications, one in each direction, might still occur. 644 [3] Peer policy satisfaction. EAP methods may support protected 645 result indications, enabling the peer to indicate to the EAP 646 server that it successfully authenticated the EAP server. 647 However, a pass-through authenticator will not be aware that the 648 peer has accepted the credentials offered by the EAP server, 649 unless this information is provided to the authenticator via the 650 AAA protocol. As a result, two authentications, one in each 651 direction, may still be needed. 653 It is also possible that the EAP peer's access policy was not 654 satisfied during the EAP method exchange. For example, the 655 authenticator may not have successfully authenticated to the 656 peer, or may not have demonstrated authorization to act in both 657 peer and server roles. For example, in EAP-TLS [RFC2716], the 658 authenticator may have authenticated using a valid TLS server 659 certificate, but not using a valid TLS client certificate. As a 660 result, the peer may require an additional authentication in the 661 reverse direction, even if the peer provided a protected result 662 indication to the EAP server indicating that the server had 663 successfully authenticated to it. 665 3. Lower layer behavior 667 3.1 Lower layer requirements 669 EAP makes the following assumptions about lower layers: 671 [1] Unreliable transport. In EAP, the authenticator retransmits 672 Requests that have not yet received Responses, so that EAP does 673 not assume that lower layers are reliable. Since EAP defines its 674 own retransmission behavior, it is possible (though undesirable) 675 for retransmission to occur both in the lower layer and the EAP 676 layer when EAP is run over a reliable lower layer. 678 Note that EAP Success and Failure packets are not retransmitted. 679 Without a reliable lower layer, and a non-negligible error rate, 680 these packets can be lost, resulting in timeouts. It is therefore 681 desirable for implementations to improve their resilience to loss 682 of EAP Success or Failure packets, as described in Section 4.2. 684 [2] Lower layer error detection. While EAP does not assume that the 685 lower layer is reliable, it does rely on lower layer error 686 detection (e.g., CRC, Checksum, MIC, etc.). EAP methods may not 687 include a MIC, or if they do, it may not be computed over all the 688 fields in the EAP packet, such as the Code, Identifier, Length or 689 Type fields. As a result, without lower layer error detection, 690 undetected errors could creep into the EAP layer or EAP method 691 layer header fields, resulting in authentication failures. 693 For example, EAP TLS [RFC2716], which computes its MIC over the 694 Type-Data field only, regards MIC validation failures as a fatal 695 error. Without lower layer error detection, this method and 696 others like it will not perform reliably. 698 [3] Lower layer security. EAP assumes that lower layers either 699 provide physical security (e.g., wired PPP or IEEE 802 links) or 700 support per-packet authentication, integrity and replay 701 protection. EAP SHOULD NOT be used on physically insecure links 702 (e.g., wireless or the Internet) where subsequent data is not 703 protected by per-packet authentication, integrity and replay 704 protection. 706 [4] Minimum MTU. EAP is capable of functioning on lower layers that 707 provide an EAP MTU size of 1020 octets or greater. 709 EAP does not support path MTU discovery, and fragmentation and 710 reassembly is not supported by EAP, nor by the methods defined in 711 this specification: the Identity (1), Notification (2), Nak 712 Response (3), MD5-Challenge (4), One Time Password (5), Generic 713 Token Card (6) and expanded Nak Response (254) Types. 715 Typically, the EAP peer obtains information on the EAP MTU from 716 the lower layers and sets the EAP frame size to an appropriate 717 value. Where the authenticator operates in pass-through mode, 718 the authentication server does not have a direct way of 719 determining the EAP MTU, and therefore relies on the 720 authenticator to provide it with this information, such as via 721 the Framed-MTU attribute, as described in [RFC3579], Section 2.4. 723 While methods such as EAP-TLS [RFC2716] support fragmentation and 724 reassembly, EAP methods originally designed for use within PPP 725 where a 1500 octet MTU is guaranteed for control frames (see 726 [RFC1661], Section 6.1) may lack fragmentation and reassembly 727 features. 729 EAP methods can assume a minimum EAP MTU of 1020 octets, in the 730 absence of other information. EAP methods SHOULD include support 731 for fragmentation and reassembly if their payloads can be larger 732 than this minimum EAP MTU. 734 EAP is a lock-step protocol, which implies a certain inefficiency 735 when handling fragmentation and reassembly. Therefore if the 736 lower layer supports fragmentation and reassembly (such as where 737 EAP is transported over IP), it may be preferable for 738 fragmentation and reassembly to occur in the lower layer rather 739 than in EAP. This can be accomplished by providing an 740 artificially large EAP MTU to EAP, causing fragmentation and 741 reassembly to be handled within the lower layer. 743 [5] Possible duplication. Where the lower layer is reliable, it will 744 provide the EAP layer with a non-duplicated stream of packets. 745 However, while it is desirable that lower layers provide for 746 non-duplication, this is not a requirement. The Identifier field 747 provides both the peer and authenticator with the ability to 748 detect duplicates. 750 [6] Ordering guarantees. EAP does not require the Identifier to be 751 monotonically increasing, and so is reliant on lower layer 752 ordering guarantees for correct operation. EAP was originally 753 defined to run on PPP, and [RFC1661] Section 1 has an ordering 754 requirement: 756 "The Point-to-Point Protocol is designed for simple links 757 which transport packets between two peers. These links 758 provide full-duplex simultaneous bi-directional operation, and 759 are assumed to deliver packets in order." 761 Lower layer transports for EAP MUST preserve ordering between a 762 source and destination, at a given priority level (the ordering 763 guarantee provided by [IEEE-802]). 765 Reordering, if it occurs, will typically result in an EAP 766 authentication failure, causing EAP authentication to be rerun. 767 In an environment in which reordering is likely, it is therefore 768 expected that EAP authentication failures will be common. It is 769 RECOMMENDED that EAP only be run over lower layers that provide 770 ordering guarantees; running EAP over raw IP or UDP transport is 771 NOT RECOMMENDED. Encapsulation of EAP within RADIUS [RFC3579] 772 satisfies ordering requirements, since RADIUS is a "lockstep" 773 protocol that delivers packets in order. 775 3.2 EAP usage within PPP 777 In order to establish communications over a point-to-point link, each 778 end of the PPP link must first send LCP packets to configure the data 779 link during Link Establishment phase. After the link has been 780 established, PPP provides for an optional Authentication phase before 781 proceeding to the Network-Layer Protocol phase. 783 By default, authentication is not mandatory. If authentication of 784 the link is desired, an implementation MUST specify the 785 Authentication Protocol Configuration Option during Link 786 Establishment phase. 788 If the identity of the peer has been established in the 789 Authentication phase, the server can use that identity in the 790 selection of options for the following network layer negotiations. 792 When implemented within PPP, EAP does not select a specific 793 authentication mechanism at PPP Link Control Phase, but rather 794 postpones this until the Authentication Phase. This allows the 795 authenticator to request more information before determining the 796 specific authentication mechanism. This also permits the use of a 797 "backend" server which actually implements the various mechanisms 798 while the PPP authenticator merely passes through the authentication 799 exchange. The PPP Link Establishment and Authentication phases, and 800 the Authentication Protocol Configuration Option, are defined in The 801 Point-to-Point Protocol (PPP) [RFC1661]. 803 3.2.1 PPP Configuration Option Format 805 A summary of the PPP Authentication Protocol Configuration Option 806 format to negotiate EAP is shown below. The fields are transmitted 807 from left to right. 809 Exactly one EAP packet is encapsulated in the Information field of a 810 PPP Data Link Layer frame where the protocol field indicates type hex 811 C227 (PPP EAP). 813 0 1 2 3 814 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 815 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 816 | Type | Length | Authentication Protocol | 817 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 818 Type 820 3 822 Length 824 4 826 Authentication Protocol 828 C227 (Hex) for Extensible Authentication Protocol (EAP) 830 3.3 EAP usage within IEEE 802 832 The encapsulation of EAP over IEEE 802 is defined in [IEEE-802.1X]. 833 The IEEE 802 encapsulation of EAP does not involve PPP, and IEEE 834 802.1X does not include support for link or network layer 835 negotiations. As a result, within IEEE 802.1X it is not possible to 836 negotiate non-EAP authentication mechanisms, such as PAP or CHAP 837 [RFC1994]. 839 3.4 Lower layer indications 841 The reliability and security of lower layer indications is dependent 842 on the lower layer. Since EAP is media independent, the presence or 843 absence of lower layer security is not taken into account in the 844 processing of EAP messages. 846 To improve reliability, if a peer receives a lower layer success 847 indication as defined in Section 7.2, it MAY conclude that a Success 848 packet has been lost, and behave as if it had actually received a 849 Success packet. This includes choosing to ignore the Success in some 850 circumstances as described in Section 4.2. 852 A discussion of some reliability and security issues with lower layer 853 indications in PPP, IEEE 802 wired networks and IEEE 802.11 wireless 854 LANs can be found in the Security Considerations, Section 7.12. 856 After EAP authentication is complete, the peer will typically 857 transmit data to the network via the authenticator. In order to 858 provide assurance that the peer transmitting data is the same entity 859 that successfully completed EAP authentication, the lower layer needs 860 to bind per-packet integrity, authentication and replay protection to 861 the original EAP authentication, using keys derived during EAP 862 authentication. Alternatively, the lower layer needs to be 863 physically secure. Otherwise it is possible for subsequent data 864 traffic to be hijacked or replayed. 866 As a result of these considerations, EAP SHOULD be used only when 867 lower layers provide physical security for data (e.g., wired PPP or 868 IEEE 802 links), or for insecure links, where per-packet 869 authentication, integrity and replay protection is provided. 871 Where keying material for the lower layer ciphersuite is itself 872 provided by EAP, ciphersuite negotiation and key activation is 873 controlled by the lower layer. In PPP, ciphersuites are negotiated 874 within ECP so that it is not possible to use keys derived from EAP 875 authentication until the completion of ECP. Therefore an initial EAP 876 exchange cannot protected by a PPP ciphersuite, although EAP 877 re-authentication can be protected. 879 In IEEE 802 media, initial key activation also typically occurs after 880 completion of EAP authentication. Therefore an initial EAP exchange 881 typically cannot be protected by the lower layer ciphersuite, 882 although an EAP re-authentication or pre-authentication exchange can 883 be protected. 885 4. EAP Packet format 887 A summary of the EAP packet format is shown below. The fields are 888 transmitted from left to right. 890 0 1 2 3 891 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 892 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 893 | Code | Identifier | Length | 894 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 895 | Data ... 896 +-+-+-+-+ 898 Code 900 The Code field is one octet and identifies the Type of EAP packet. 901 EAP Codes are assigned as follows: 903 1 Request 904 2 Response 905 3 Success 906 4 Failure 908 Since EAP only defines Codes 1-4, EAP packets with other codes 909 MUST be silently discarded by both authenticators and peers. 911 Identifier 913 The Identifier field is one octet and aids in matching Responses 914 with Requests. 916 Length 918 The Length field is two octets and indicates the length of the EAP 919 packet including the Code, Identifier, Length and Data fields. 920 Octets outside the range of the Length field should be treated as 921 Data Link Layer padding and MUST be ignored on reception. A 922 message with the Length field set to a value larger than the 923 number of received octets MUST be silently discarded. 925 Data 927 The Data field is zero or more octets. The format of the Data 928 field is determined by the Code field. 930 4.1 Request and Response 932 Description 934 The Request packet (Code field set to 1) is sent by the 935 authenticator to the peer. Each Request has a Type field which 936 serves to indicate what is being requested. Additional Request 937 packets MUST be sent until a valid Response packet is received, or 938 an optional retry counter expires. 940 Retransmitted Requests MUST be sent with the same Identifier value 941 in order to distinguish them from new Requests. The content of the 942 data field is dependent on the Request Type. The peer MUST send a 943 Response packet in reply to a valid Request packet. Responses 944 MUST only be sent in reply to a valid Request and never 945 retransmitted on a timer. 947 If a peer receives a valid duplicate Request for which it has 948 already sent a Response, it MUST resend its original Response 949 without reprocessing the Request. Requests MUST be processed in 950 the order that they are received, and MUST be processed to their 951 completion before inspecting the next Request. 953 A summary of the Request and Response packet format is shown below. 954 The fields are transmitted from left to right. 956 0 1 2 3 957 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 958 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 959 | Code | Identifier | Length | 960 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 961 | Type | Type-Data ... 962 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 964 Code 966 1 for Request 967 2 for Response 969 Identifier 971 The Identifier field is one octet. The Identifier field MUST be 972 the same if a Request packet is retransmitted due to a timeout 973 while waiting for a Response. Any new (non-retransmission) 974 Requests MUST modify the Identifier field. 976 The Identifier field of the Response MUST match that of the 977 currently outstanding Request. An authenticator receiving a 978 Response whose Identifier value does not match that of the 979 currently outstanding Request MUST silently discard the Response. 981 In order to avoid confusion between new Requests and 982 retransmissions, the Identifier value chosen for each new Request 983 need only be different from the previous Request, but need not be 984 unique within the conversation. One way to achieve this is to 985 start the Identifier at an initial value and increment it for each 986 new Request. Initializing the first Identifier with a random 987 number rather than starting from zero is recommended, since it 988 makes sequence attacks somewhat harder. 990 Since the Identifier space is unique to each session, 991 authenticators are not restricted to only 256 simultaneous 992 authentication conversations. Similarly, with re-authentication, 993 an EAP conversation might continue over a long period of time, and 994 is not limited to only 256 roundtrips. 996 Implementation Note: The authenticator is responsible for 997 retransmitting Request messages. If the Request message is 998 obtained from elsewhere (such as from a backend authentication 999 server), then the authenticator will need to save a copy of the 1000 Request in order to accomplish this. The peer is responsible 1001 for detecting and handling duplicate Request messages before 1002 processing them in any way, including passing them on to an 1003 outside party. The authenticator is also responsible for 1004 discarding Response messages with a non-matching Identifier 1005 value before acting on them in any way, including passing them 1006 on to the backend authentication server for verification. 1007 Since the authenticator can retransmit before receiving a 1008 Response from the peer, the authenticator can receive multiple 1009 Responses, each with a matching Identifier. Until a new Request 1010 is received by the authenticator, the Identifier value is not 1011 updated, so that the authenticator forwards Responses to the 1012 backend authentication server, one at a time. 1014 Length 1016 The Length field is two octets and indicates the length of the EAP 1017 packet including the Code, Identifier, Length, Type, and Type-Data 1018 fields. Octets outside the range of the Length field should be 1019 treated as Data Link Layer padding and MUST be ignored on 1020 reception. A message with the Length field set to a value larger 1021 than the number of received octets MUST be silently discarded. 1023 Type 1025 The Type field is one octet. This field indicates the Type of 1026 Request or Response. A single Type MUST be specified for each EAP 1027 Request or Response. An initial specification of Types follows in 1028 Section 5 of this document. 1030 The Type field of a Response MUST either match that of the 1031 Request, or correspond to a legacy or Expanded Nak (see Section 1032 5.3) indicating that a Request Type is unacceptable to the peer. 1033 A peer MUST NOT send a Nak (legacy or expanded) in response to a 1034 Request, after an initial non-Nak Response has been sent. An EAP 1035 server receiving a Response not meeting these requirements MUST 1036 silently discard it. 1038 Type-Data 1040 The Type-Data field varies with the Type of Request and the 1041 associated Response. 1043 4.2 Success and Failure 1045 The Success packet is sent by the authenticator to the peer after 1046 completion of an EAP authentication method (Type 4 or greater), to 1047 indicate that the peer has authenticated successfully to the 1048 authenticator. The authenticator MUST transmit an EAP packet with 1049 the Code field set to 3 (Success). If the authenticator cannot 1050 authenticate the peer (unacceptable Responses to one or more 1051 Requests) then after unsuccessful completion of the EAP method in 1052 progress, the implementation MUST transmit an EAP packet with the 1053 Code field set to 4 (Failure). An authenticator MAY wish to issue 1054 multiple Requests before sending a Failure response in order to allow 1055 for human typing mistakes. Success and Failure packets MUST NOT 1056 contain additional data. 1058 Success and Failure packets MUST NOT be sent by an EAP authenticator 1059 if the specification of the given method does not explicitly permit 1060 the method to finish at that point. A peer EAP implementation 1061 receiving a Success or Failure packet where sending one is not 1062 explicitly permitted MUST silently discard it. By default, an EAP 1063 peer MUST silently discard a "canned" Success packet (a Success 1064 packet sent immediately upon connection). This ensures that a rogue 1065 authenticator will not be able to bypass mutual authentication by 1066 sending a Success packet prior to conclusion of the EAP method 1067 conversation. 1069 Implementation Note: Because the Success and Failure packets are 1070 not acknowledged, they are not retransmitted by the authenticator, 1071 and may be potentially lost. A peer MUST allow for this 1072 circumstance as described in this note. See also Section 3.4 for 1073 guidance on the processing of lower layer success and failure 1074 indications. 1076 As described in Section 2.1, only a single EAP authentication 1077 method is allowed within an EAP conversation. EAP methods MAY 1078 implement protected result indications. After the authenticator 1079 sends a method-specific failure indication to the peer, regardless 1080 of the response from the peer, it MUST subsequently send a Failure 1081 packet. After the authenticator sends a method-specific success 1082 indication to the peer, and receives a method-specific success 1083 indication from the peer, it MUST subsequently send a Success 1084 packet. 1086 On the peer, once the method completes unsuccessfully (that is, 1087 either the authenticator sends a method-specific failure 1088 indication, or the peer decides that it does want to continue the 1089 conversation, possibly after sending a method-specific failure 1090 indication), the peer MUST terminate the conversation and indicate 1091 failure to the lower layer. The peer MUST silently discard 1092 Success packets and MAY silently discard Failure packets. As a 1093 result, loss of a Failure packet need not result in a timeout. 1095 On the peer, after protected successful result indications have 1096 been exchanged by both sides, a Failure packet MUST be silently 1097 discarded. The peer MAY, in the event that an EAP Success is not 1098 received, conclude that the EAP Success packet was lost and that 1099 authentication concluded successfully. 1101 A mutually authenticating method (such as EAP-TLS [RFC2716]) that 1102 provides authorization error messages provides protected result 1103 indications for the purpose of this specification. Within 1104 EAP-TLS, the peer always authenticates the authenticator, and may 1105 send a TLS-alert message in the event of an authentication 1106 failure. An authenticator may use the "access denied" TLS alert 1107 after successfully authenticating the peer to indicate that a 1108 valid certificate was received from the peer, but when access 1109 control was applied, the authenticator decided not to proceed. If 1110 a method provides authorization error messages, the authenticator 1111 SHOULD use them so as to ensure consistency with the final access 1112 decision and avoid lengthy timeouts. 1114 If the authenticator has not sent a method-specific result 1115 indication, and the peer is willing to continue the conversation, 1116 once the method completes the peer waits for a Success or Failure 1117 packet and MUST NOT silently discard either of them. In the event 1118 that neither a Success nor Failure packet is received, the peer 1119 SHOULD terminate the conversation to avoid lengthy timeouts in 1120 case the lost packet was an EAP Failure. 1122 If the peer attempts to authenticate to the authenticator and 1123 fails to do so, the authenticator MUST send a Failure packet and 1124 MUST NOT grant access by sending a Success packet. However, an 1125 authenticator MAY omit having the peer authenticate to it in 1126 situations where limited access is offered (e.g., guest access). 1127 In this case the authenticator MUST send a Success packet. 1129 Where the peer authenticates successfully to the authenticator, 1130 but the authenticator does not send a method-specific result 1131 indication the authenticator MAY deny access by sending a Failure 1132 packet where the peer is not currently authorized for network 1133 access. 1135 A summary of the Success and Failure packet format is shown below. 1136 The fields are transmitted from left to right. 1138 0 1 2 3 1139 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1140 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1141 | Code | Identifier | Length | 1142 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1144 Code 1146 3 for Success 1147 4 for Failure 1149 Identifier 1151 The Identifier field is one octet and aids in matching replies to 1152 Responses. The Identifier field MUST match the Identifier field 1153 of the Response packet that it is sent in response to. 1155 Length 1157 4 1159 4.3 Retransmission Behavior 1161 Because the authentication process will often involve user input, 1162 some care must be taken when deciding upon retransmission strategies 1163 and authentication timeouts. By default, where EAP is run over an 1164 unreliable lower layer, the EAP retransmission timer SHOULD be 1165 dynamically estimated. A maximum of 3-5 retransmissions is 1166 suggested. 1168 When run over a reliable lower layer (e.g., EAP over ISAKMP/TCP, as 1169 within [PIC]), the authenticator retransmission timer SHOULD be set 1170 to an infinite value, so that retransmissions do not occur at the EAP 1171 layer. The peer may still maintain a timeout value so as to avoid 1172 waiting indefinitely for a Request. 1174 Where the authentication process requires user input, the measured 1175 round trip times may be determined by user responsiveness rather than 1176 network characteristics, so that dynamic RTO estimation may not be 1177 helpful. Instead, the retransmission timer SHOULD be set so as to 1178 provide sufficient time for the user to respond, with longer timeouts 1179 required in certain cases, such as where Token Cards (see Section 1180 5.6) are involved. 1182 In order to provide the EAP authenticator with guidance as to the 1183 appropriate timeout value, a hint can be communicated to the 1184 authenticator by the backend authentication server (such as via the 1185 RADIUS Session-Timeout attribute). 1187 In order to dynamically estimate the EAP retransmission timer, the 1188 algorithms for estimation of SRTT, RTTVAR and RTO described in 1189 [RFC2988] are RECOMMENDED, including use of Karn's algorithm, with 1190 the following potential modifications: 1192 [a] In order to avoid synchronization behaviors that can occur with 1193 fixed timers among distributed systems, the retransmission timer 1194 is calculated with a jitter by using the RTO value and randomly 1195 adding a value drawn between -RTOmin/2 and RTOmin/2. Alternative 1196 calculations to create jitter MAY be used. These MUST be 1197 pseudo-random, generated by a PRNG seeded as per [RFC1750]. 1199 [b] When EAP is transported over a single link (as opposed to over 1200 the Internet), smaller values of RTOinitial, RTOmin and RTOmax 1201 MAY be used. Recommended values are RTOinitial=1 second, 1202 RTOmin=200ms, RTOmax=20 seconds. 1204 [c] When EAP is transported over a single link (as opposed to over 1205 the Internet), estimates MAY be done on a per-authenticator 1206 basis, rather than a per-session basis. This enables the 1207 retransmission estimate to make the most use of information on 1208 link-layer behavior. 1210 [d] An EAP implementation MAY clear SRTT and RTTVAR after backing off 1211 the timer multiple times as it is likely that the current SRTT 1212 and RTTVAR are bogus in this situation. Once SRTT and RTTVAR are 1213 cleared they should be initialized with the next RTT sample taken 1214 as described in [RFC2988] equation 2.2. 1216 5. Initial EAP Request/Response Types 1218 This section defines the initial set of EAP Types used in Request/ 1219 Response exchanges. More Types may be defined in follow-on 1220 documents. The Type field is one octet and identifies the structure 1221 of an EAP Request or Response packet. The first 3 Types are 1222 considered special case Types. 1224 The remaining Types define authentication exchanges. Nak (Type 3) or 1225 Expanded Nak (Type 254) are valid only for Response packets, they 1226 MUST NOT be sent in a Request. 1228 All EAP implementations MUST support Types 1-4, which are defined in 1229 this document, and SHOULD support Type 254. Implementations MAY 1230 support other Types defined here or in future RFCs. 1232 1 Identity 1233 2 Notification 1234 3 Nak (Response only) 1235 4 MD5-Challenge 1236 5 One Time Password (OTP) 1237 6 Generic Token Card (GTC) 1238 254 Expanded Types 1239 255 Experimental use 1241 EAP methods MAY support authentication based on shared secrets. If 1242 the shared secret is a passphrase entered by the user, 1243 implementations MAY support entering passphrases with non-ASCII 1244 characters. In this case, the input should be processed using an 1245 appropriate stringprep [RFC3454] profile, and encoded in octets using 1246 UTF-8 encoding [RFC2279]. A preliminary version of a possible 1247 stringprep profile is described in [SASLPREP]. 1249 5.1 Identity 1251 Description 1253 The Identity Type is used to query the identity of the peer. 1254 Generally, the authenticator will issue this as the initial 1255 Request. An optional displayable message MAY be included to 1256 prompt the peer in the case where there is an expectation of 1257 interaction with a user. A Response of Type 1 (Identity) SHOULD 1258 be sent in Response to a Request with a Type of 1 (Identity). 1260 Some EAP implementations piggy-back various options into the 1261 Identity Request after a NUL-character. By default an EAP 1262 implementation SHOULD NOT assume that an Identity Request or 1263 Response can be larger than 1020 octets. 1265 It is RECOMMENDED that the Identity Response be used primarily for 1266 routing purposes and selecting which EAP method to use. EAP 1267 Methods SHOULD include a method-specific mechanism for obtaining 1268 the identity, so that they do not have to rely on the Identity 1269 Response. Identity Requests and Responses are not protected, so 1270 from a privacy perspective it is preferable for an EAP method to 1271 include its own protected identity exchange. The Identity 1272 Response may not be the appropriate identity for the method; it 1273 may have been truncated or obfuscated so as to provide privacy; or 1274 it may have been decorated for routing purposes. Where the peer 1275 is configured to only accept authentication methods supporting 1276 protected identity exchanges, the peer MAY provide an abbreviated 1277 Identity Response (such as omitting the peer-name portion of the 1278 NAI [RFC2486]). For further discussion of identity protection, 1279 see Section 7.3. 1281 Implementation Note: The peer MAY obtain the Identity via user 1282 input. It is suggested that the authenticator retry the 1283 Identity Request in the case of an invalid Identity or 1284 authentication failure to allow for potential typos on the part 1285 of the user. It is suggested that the Identity Request be 1286 retried a minimum of 3 times before terminating the 1287 authentication. The Notification Request MAY be used to 1288 indicate an invalid authentication attempt prior to 1289 transmitting a new Identity Request (optionally, the failure 1290 MAY be indicated within the message of the new Identity Request 1291 itself). 1293 Type 1295 1 1297 Type-Data 1299 This field MAY contain a displayable message in the Request, 1300 containing UTF-8 encoded ISO 10646 characters [RFC2279]. Where 1301 the Request contains a null, only the portion of the field prior 1302 to the null is displayed. If the Identity is unknown, the 1303 Identity Response field should be zero bytes in length. The 1304 Identity Response field MUST NOT be null terminated. In all 1305 cases, the length of the Type-Data field is derived from the 1306 Length field of the Request/Response packet. 1308 Security Claims (see Section 7.2): 1310 Intended use: Physically secure lower layers; 1311 vulnerable to attack when used with 1312 wireless or over the Internet. 1313 Auth. mechanism: None 1314 Ciphersuite negotiation: No 1315 Mutual authentication: No 1316 Integrity protection: No 1317 Replay protection: No 1318 Confidentiality: No 1319 Key derivation: No 1320 Key strength: N/A 1321 Dictionary attack prot.: N/A 1322 Fast reconnect: No 1323 Crypt. binding: N/A 1324 Protected success/failure: No 1325 Session independence: N/A 1326 Fragmentation: No 1327 Channel binding: No 1329 5.2 Notification 1331 Description 1333 The Notification Type is optionally used to convey a displayable 1334 message from the authenticator to the peer. An authenticator MAY 1335 send a Notification Request to the peer at any time when there is 1336 no outstanding Request, prior to completion of an EAP 1337 authentication method. The peer MUST respond to a Notification 1338 Request with a Notification Response unless the EAP authentication 1339 method specification prohibits the use of Notification message. 1340 In any case, a Nak Response MUST NOT be sent in response to a 1341 Notification Request. Note that the default maximum length of a 1342 Notification Request is 1020 octets. By default, this leaves at 1343 most 1015 octets for the human readable message. 1345 An EAP method MAY indicate within its specification that 1346 Notification messages must not be sent during that method. In this 1347 case, the peer MUST silently discard Notification Requests from 1348 the point where an initial Request for that Type is answered with 1349 a Response of the same Type. 1351 The peer SHOULD display this message to the user or log it if it 1352 cannot be displayed. The Notification Type is intended to provide 1353 an acknowledged notification of some imperative nature, but it is 1354 not an error indication, and therefore does not change the state 1355 of the peer. Examples include a password with an expiration time 1356 that is about to expire, an OTP sequence integer which is nearing 1357 0, an authentication failure warning, etc. In most circumstances, 1358 Notification should not be required. 1360 Type 1362 2 1364 Type-Data 1366 The Type-Data field in the Request contains a displayable message 1367 greater than zero octets in length, containing UTF-8 encoded ISO 1368 10646 characters [RFC2279]. The length of the message is 1369 determined by Length field of the Request packet. The message 1370 MUST NOT be null terminated. A Response MUST be sent in reply to 1371 the Request with a Type field of 2 (Notification). The Type-Data 1372 field of the Response is zero octets in length. The Response 1373 should be sent immediately (independent of how the message is 1374 displayed or logged). 1376 Security Claims (see Section 7.2): 1378 Intended use: Physically secure lower layers; 1379 vulnerable to attack when used with 1380 wireless or over the Internet. 1381 Auth. mechanism: None 1382 Ciphersuite negotiation: No 1383 Mutual authentication: No 1384 Integrity protection: No 1385 Replay protection: No 1386 Confidentiality: No 1387 Key derivation: No 1388 Key strength: N/A 1389 Dictionary attack prot.: N/A 1390 Fast reconnect: No 1391 Crypt. binding: N/A 1392 Protected success/failure: No 1393 Session independence: N/A 1394 Fragmentation: No 1395 Channel binding: No 1397 5.3 Nak 1399 5.3.1 Legacy Nak 1401 Description 1403 The legacy Nak Type is valid only in Response messages. It is 1404 sent in reply to a Request where the desired authentication Type 1405 is unacceptable. Authentication Types are numbered 4 and above. 1406 The Response contains one or more authentication Types desired by 1407 the Peer. Type zero (0) is used to indicate that the sender has 1408 no viable alternatives, and therefore the authenticator SHOULD NOT 1409 send another Request after receiving a Nak Response containing a 1410 zero value. 1412 Since the legacy Nak Type is valid only in Responses and has very 1413 limited functionality, it MUST NOT be used as a general purpose 1414 error indication, such as for communication of error messages, or 1415 negotiation of parameters specific to a particular EAP method. 1417 Code 1419 2 for Response. 1421 Identifier 1423 The Identifier field is one octet and aids in matching Responses 1424 with Requests. The Identifier field of a legacy Nak Response MUST 1425 match the Identifier field of the Request packet that it is sent 1426 in response to. 1428 Length 1430 >=6 1432 Type 1434 3 1436 Type-Data 1438 Where a peer receives a Request for an unacceptable authentication 1439 Type (4-253,255), or a peer lacking support for Expanded Types 1440 receives a Request for Type 254, a Nak Response (Type 3) MUST be 1441 sent. The Type-Data field of the Nak Response (Type 3) MUST 1442 contain one or more octets indicating the desired authentication 1443 Type(s), one octet per Type, or the value zero (0) to indicate no 1444 proposed alternative. A peer supporting Expanded Types that 1445 receives a Request for an unacceptable authentication Type (4-253, 1446 255) MAY include the value 254 in the Nak Response (Type 3) in 1447 order to indicate the desire for an Expanded authentication Type. 1448 If the authenticator can accommodate this preference, it will 1449 respond with an Expanded Type Request (Type 254). 1451 Security Claims (see Section 7.2): 1453 Intended use: Physically secure lower layers; 1454 vulnerable to attack when used with 1455 wireless or over the Internet. 1456 Auth. mechanism: None 1457 Ciphersuite negotiation: No 1458 Mutual authentication: No 1459 Integrity protection: No 1460 Replay protection: No 1461 Confidentiality: No 1462 Key derivation: No 1463 Key strength: N/A 1464 Dictionary attack prot.: N/A 1465 Fast reconnect: No 1466 Crypt. binding: N/A 1467 Protected success/failure: No 1468 Session independence: N/A 1469 Fragmentation: No 1470 Channel binding: No 1472 5.3.2 Expanded Nak 1474 Description 1476 The Expanded Nak Type is valid only in Response messages. It MUST 1477 be sent only in reply to a Request of Type 254 (Expanded Type) 1478 where the authentication Type is unacceptable. The Expanded Nak 1479 Type uses the Expanded Type format itself, and the Response 1480 contains one or more authentication Types desired by the peer, all 1481 in Expanded Type format. Type zero (0) is used to indicate that 1482 the sender has no viable alternatives. The general format of the 1483 Expanded Type is described in Section 5.7. 1485 Since the Expanded Nak Type is valid only in Responses and has 1486 very limited functionality, it MUST NOT be used as a general 1487 purpose error indication, such as for communication of error 1488 messages, or negotiation of parameters specific to a particular 1489 EAP method. 1491 Code 1493 2 for Response. 1495 Identifier 1497 The Identifier field is one octet and aids in matching Responses 1498 with Requests. The Identifier field of an Expanded Nak Response 1499 MUST match the Identifier field of the Request packet that it is 1500 sent in response to. 1502 Length 1504 >=20 1506 Type 1508 254 1510 Vendor-Id 1512 0 (IETF) 1514 Vendor-Type 1516 3 (Nak) 1518 Vendor-Data 1520 The Expanded Nak Type is only sent when the Request contains an 1521 Expanded Type (254) as defined in Section 5.7. The Vendor-Data 1522 field of the Nak Response MUST contain one or more authentication 1523 Types (4 or greater), all in expanded format, 8 octets per Type, 1524 or the value zero (0), also in Expanded Type format, to indicate 1525 no proposed alternative. The desired authentication Types may 1526 include a mixture of Vendor-Specific and IETF Types. For example, 1527 an Expanded Nak Response indicating a preference for OTP (Type 5), 1528 and an MIT (Vendor-Id=20) Expanded Type of 6 would appear as 1529 follows: 1531 0 1 2 3 1532 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1533 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1534 | 2 | Identifier | Length=28 | 1535 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1536 | Type=254 | 0 (IETF) | 1537 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1538 | 3 (Nak) | 1539 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1540 | Type=254 | 0 (IETF) | 1541 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1542 | 5 (OTP) | 1543 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1544 | Type=254 | 20 (MIT) | 1545 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1546 | 6 | 1547 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1549 An Expanded Nak Response indicating a no desired alternative would 1550 appear as follows: 1552 0 1 2 3 1553 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1554 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1555 | 2 | Identifier | Length=20 | 1556 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1557 | Type=254 | 0 (IETF) | 1558 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1559 | 3 (Nak) | 1560 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1561 | Type=254 | 0 (IETF) | 1562 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1563 | 0 (No alternative) | 1564 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1566 Security Claims (see Section 7.2): 1568 Intended use: Physically secure lower layers; 1569 vulnerable to attack when used with 1570 wireless or over the Internet. 1571 Auth. mechanism: None 1572 Ciphersuite negotiation: No 1573 Mutual authentication: No 1574 Integrity protection: No 1575 Replay protection: No 1576 Confidentiality: No 1577 Key derivation: No 1578 Key strength: N/A 1579 Dictionary attack prot.: N/A 1580 Fast reconnect: No 1581 Crypt. binding: N/A 1582 Protected success/failure: No 1583 Session independence: N/A 1584 Fragmentation: No 1585 Channel binding: No 1587 5.4 MD5-Challenge 1589 Description 1591 The MD5-Challenge Type is analogous to the PPP CHAP protocol 1592 [RFC1994] (with MD5 as the specified algorithm). The Request 1593 contains a "challenge" message to the peer. A Response MUST be 1594 sent in reply to the Request. The Response MAY be either of Type 1595 4 (MD5-Challenge), Nak (Type 3) or Expanded Nak (Type 254). The 1596 Nak reply indicates the peer's desired authentication Type(s). 1597 EAP peer and EAP server implementations MUST support the 1598 MD5-Challenge mechanism. An authenticator that supports only 1599 pass-through MUST allow communication with a backend 1600 authentication server that is capable of supporting MD5-Challenge, 1601 although the EAP authenticator implementation need not support 1602 MD5-Challenge itself. However, if the EAP authenticator can be 1603 configured to authenticate peers locally (e.g., not operate in 1604 pass-through), then the requirement for support of the 1605 MD5-Challenge mechanism applies. 1607 Note that the use of the Identifier field in the MD5-Challenge 1608 Type is different from that described in [RFC1994]. EAP allows 1609 for retransmission of MD5-Challenge Request packets while 1610 [RFC1994] states that both the Identifier and Challenge fields 1611 MUST change each time a Challenge (the CHAP equivalent of the 1612 MD5-Challenge Request packet) is sent. 1614 Note: [RFC1994] treats the shared secret as an octet string, and 1615 does not specify how it is entered into the system (or if it is 1616 handled by the user at all). EAP MD5-Challenge implementations MAY 1617 support entering passphrases with non-ASCII characters. See 1618 Section 5 for instructions how the input should be processed and 1619 encoded into octets. 1621 Type 1623 4 1625 Type-Data 1627 The contents of the Type-Data field is summarized below. For 1628 reference on the use of these fields see the PPP Challenge 1629 Handshake Authentication Protocol [RFC1994]. 1631 0 1 2 3 1632 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1633 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1634 | Value-Size | Value ... 1635 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1636 | Name ... 1637 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1639 Security Claims (see Section 7.2): 1641 Intended use: Wired networks, including PPP, PPPOE, 1642 and IEEE 802 wired media. Use over the 1643 Internet or with wireless media only 1644 when protected. 1645 Auth. mechanism: Password or pre-shared key. 1646 Ciphersuite negotiation: No 1647 Mutual authentication: No 1648 Integrity protection: No 1649 Replay protection: No 1650 Confidentiality: No 1651 Key derivation: No 1652 Key strength: N/A 1653 Dictionary attack prot.: No 1654 Fast reconnect: No 1655 Crypt. binding: N/A 1656 Protected success/failure: No 1657 Session independence: N/A 1658 Fragmentation: No 1659 Channel binding: No 1661 5.5 One-Time Password (OTP) 1663 Description 1665 The One-Time Password system is defined in "A One-Time Password 1666 System" [RFC2289] and "OTP Extended Responses" [RFC2243]. The 1667 Request contains an OTP challenge in the format described in 1668 [RFC2289]. A Response MUST be sent in reply to the Request. The 1669 Response MUST be of Type 5 (OTP), Nak (Type 3) or Expanded Nak 1670 (Type 254). The Nak Response indicates the peer's desired 1671 authentication Type(s). The EAP OTP method is intended for use 1672 with the One-Time Password system only, and MUST NOT be used to 1673 provide support for cleartext passwords. 1675 Type 1677 5 1679 Type-Data 1681 The Type-Data field contains the OTP "challenge" as a displayable 1682 message in the Request. In the Response, this field is used for 1683 the 6 words from the OTP dictionary [RFC2289]. The messages MUST 1684 NOT be null terminated. The length of the field is derived from 1685 the Length field of the Request/Reply packet. 1687 Note: [RFC2289] does not specify how the secret pass-phrase is 1688 entered by the user, or how the pass-phrase is converted into 1689 octets. EAP OTP implementations MAY support entering passphrases 1690 with non-ASCII characters. See Section 5 for instructions how the 1691 input should be processed and encoded into octets. 1693 Security Claims (see Section 7.2): 1695 Intended use: Wired networks, including PPP, PPPOE, 1696 and IEEE 802 wired media. Use over the 1697 Internet or with wireless media only 1698 when protected. 1699 Auth. mechanism: One-Time Password 1700 Ciphersuite negotiation: No 1701 Mutual authentication: No 1702 Integrity protection: No 1703 Replay protection: Yes 1704 Confidentiality: No 1705 Key derivation: No 1706 Key strength: N/A 1707 Dictionary attack prot.: No 1708 Fast reconnect: No 1709 Crypt. binding: N/A 1710 Protected success/failure: No 1711 Session independence: N/A 1712 Fragmentation: No 1713 Channel binding: No 1715 5.6 Generic Token Card (GTC) 1717 Description 1719 The Generic Token Card Type is defined for use with various Token 1720 Card implementations which require user input. The Request 1721 contains a displayable message and the Response contains the Token 1722 Card information necessary for authentication. Typically, this 1723 would be information read by a user from the Token card device and 1724 entered as ASCII text. A Response MUST be sent in reply to the 1725 Request. The Response MUST be of Type 6 (GTC), Nak (Type 3) or 1726 Expanded Nak (Type 254). The Nak Response indicates the peer's 1727 desired authentication Type(s). The EAP GTC method is intended 1728 for use with the Token Cards supporting challenge/response 1729 authentication and MUST NOT be used to provide support for 1730 cleartext passwords in the absence of a protected tunnel with 1731 server authentication. 1733 Type 1735 6 1737 Type-Data 1739 The Type-Data field in the Request contains a displayable message 1740 greater than zero octets in length. The length of the message is 1741 determined by the Length field of the Request packet. The message 1742 MUST NOT be null terminated. A Response MUST be sent in reply to 1743 the Request with a Type field of 6 (Generic Token Card). The 1744 Response contains data from the Token Card required for 1745 authentication. The length of the data is determined by the 1746 Length field of the Response packet. 1748 EAP GTC implementations MAY support entering a response with 1749 non-ASCII characters. See Section 5 for instructions how the 1750 input should be processed and encoded into octets. 1752 Security Claims (see Section 7.2): 1754 Intended use: Wired networks, including PPP, PPPOE, 1755 and IEEE 802 wired media. Use over the 1756 Internet or with wireless media only 1757 when protected. 1758 Auth. mechanism: Hardware token. 1759 Ciphersuite negotiation: No 1760 Mutual authentication: No 1761 Integrity protection: No 1762 Replay protection: No 1763 Confidentiality: No 1764 Key derivation: No 1765 Key strength: N/A 1766 Dictionary attack prot.: No 1767 Fast reconnect: No 1768 Crypt. binding: N/A 1769 Protected success/failure: No 1770 Session independence: N/A 1771 Fragmentation: No 1772 Channel binding: No 1774 5.7 Expanded Types 1776 Description 1778 Since many of the existing uses of EAP are vendor-specific, the 1779 Expanded method Type is available to allow vendors to support 1780 their own Expanded Types not suitable for general usage. 1782 The Expanded Type is also used to expand the global Method Type 1783 space beyond the original 255 values. A Vendor-Id of 0 maps the 1784 original 255 possible Types onto a space of 2^32-1 possible Types. 1785 (Type 0 is only used in a Nak Response, to indicate no acceptable 1786 alternative) 1788 An implementation that supports the Expanded attribute MUST treat 1789 EAP Types that are less than 256 equivalently whether they appear 1790 as a single octet or as the 32-bit Vendor-Type within a Expanded 1791 Type where Vendor-Id is 0. Peers not equipped to interpret the 1792 Expanded Type MUST send a Nak as described in Section 5.3.1, and 1793 negotiate a more suitable authentication method. 1795 A summary of the Expanded Type format is shown below. The fields 1796 are transmitted from left to right. 1798 0 1 2 3 1799 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1800 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1801 | Type | Vendor-Id | 1802 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1803 | Vendor-Type | 1804 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1805 | Vendor data... 1806 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1808 Type 1810 254 for Expanded Type 1812 Vendor-Id 1814 The Vendor-Id is 3 octets and represents the SMI Network 1815 Management Private Enterprise Code of the Vendor in network byte 1816 order, as allocated by IANA. A Vendor-Id of zero is reserved for 1817 use by the IETF in providing an expanded global EAP Type space. 1819 Vendor-Type 1821 The Vendor-Type field is four octets and represents the 1822 vendor-specific method Type. 1824 If the Vendor-Id is zero, the Vendor-Type field is an extension 1825 and superset of the existing namespace for EAP Types. The first 1826 256 Types are reserved for compatibility with single-octet EAP 1827 Types that have already been assigned or may be assigned in the 1828 future. Thus, EAP Types from 0 through 255 are semantically 1829 identical whether they appear as single octet EAP Types or as 1830 Vendor-Types when Vendor-Id is zero. There is one exception to 1831 this rule: Expanded Nak and Legacy Nak packets share the same 1832 Type, but must be treated differently because they have a 1833 different format. 1835 Vendor-Data 1837 The Vendor-Data field is defined by the vendor. Where a Vendor-Id 1838 of zero is present, the Vendor-Data field will be used for 1839 transporting the contents of EAP methods of Types defined by the 1840 IETF. 1842 5.8 Experimental 1844 Description 1846 The Experimental Type has no fixed format or content. It is 1847 intended for use when experimenting with new EAP Types. This Type 1848 is intended for experimental and testing purposes. No guarantee 1849 is made for interoperability between peers using this Type, as 1850 outlined in [IANA-EXP]. 1852 Type 1854 255 1856 Type-Data 1858 Undefined 1860 6. IANA Considerations 1862 This section provides guidance to the Internet Assigned Numbers 1863 Authority (IANA) regarding registration of values related to the EAP 1864 protocol, in accordance with BCP 26, [RFC2434]. 1866 There are two name spaces in EAP that require registration: Packet 1867 Codes and method Types. 1869 EAP is not intended as a general-purpose protocol, and allocations 1870 SHOULD NOT be made for purposes unrelated to authentication. 1872 The following terms are used here with the meanings defined in BCP 1873 26: "name space", "assigned value", "registration". 1875 The following policies are used here with the meanings defined in BCP 1876 26: "Private Use", "First Come First Served", "Expert Review", 1877 "Specification Required", "IETF Consensus", "Standards Action". 1879 For registration requests where a Designated Expert should be 1880 consulted, the responsible IESG area director should appoint the 1881 Designated Expert. The intention is that any allocation will be 1882 accompanied by a published RFC. But in order to allow for the 1883 allocation of values prior to the RFC being approved for publication, 1884 the Designated Expert can approve allocations once it seems clear 1885 that an RFC will be published. The Designated expert will post a 1886 request to the EAP WG mailing list (or a successor designated by the 1887 Area Director) for comment and review, including an Internet-Draft. 1888 Before a period of 30 days has passed, the Designated Expert will 1889 either approve or deny the registration request and publish a notice 1890 of the decision to the EAP WG mailing list or its successor, as well 1891 as informing IANA. A denial notice must be justified by an 1892 explanation and, in the cases where it is possible, concrete 1893 suggestions on how the request can be modified so as to become 1894 acceptable. 1896 6.1 Packet Codes 1898 Packet Codes have a range from 1 to 255, of which 1-4 have been 1899 allocated. Because a new Packet Code has considerable impact on 1900 interoperability, a new Packet Code requires Standards Action, and 1901 should be allocated starting at 5. 1903 6.2 Method Types 1905 The original EAP method Type space has a range from 1 to 255, and is 1906 the scarcest resource in EAP, and thus must be allocated with care. 1907 Method Types 1-41 have been allocated, with 20 available for re-use. 1908 Method Types 42-191 may be allocated on the advice of a Designated 1909 Expert, with Specification Required. 1911 Allocation of blocks of method Types (more than one for a given 1912 purpose) should require IETF Consensus. EAP Type Values 192-253 are 1913 reserved and allocation requires Standards Action. 1915 Method Type 254 is allocated for the Expanded Type. Where the 1916 Vendor-Id field is non-zero, the Expanded Type is used for functions 1917 specific only to one vendor's implementation of EAP, where no 1918 interoperability is deemed useful. When used with a Vendor-Id of 1919 zero, method Type 254 can also be used to provide for an expanded 1920 IETF method Type space. Method Type values 256-4294967295 may be 1921 allocated after Type values 1-191 have been allocated. 1923 Method Type 255 is allocated for Experimental use, such as testing of 1924 new EAP methods before a permanent Type is allocated. 1926 7. Security Considerations 1928 EAP was designed for use with dialup PPP [RFC1661] and was later 1929 adapted for use in wired IEEE 802 networks [IEEE-802] in 1930 [IEEE-802.1X]. On these networks, an attacker would need to gain 1931 physical access to the telephone or switch infrastructure in order to 1932 mount an attack. While such attacks have been documented, such as in 1933 [DECEPTION], they are assumed to be rare. 1935 However, subsequently EAP has been proposed for use on wireless 1936 networks, and over the Internet, where physical security cannot be 1937 assumed. On such networks, the security vulnerabilities are greater, 1938 as are the requirements for EAP security. 1940 This section defines the threat model and security terms and 1941 describes the security claims section required in EAP method 1942 specifications. We then discuss threat mitigation. 1944 7.1 Threat model 1946 On physically insecure networks, it is possible for an attacker to 1947 gain access to the physical medium. This enables a range of attacks, 1948 including the following: 1950 [1] An attacker may try to discover user identities by snooping 1951 authentication traffic. 1953 [2] An attacker may try to modify or spoof EAP packets. 1955 [3] An attacker may launch denial of service attacks by spoofing 1956 lower layer indications or Success/Failure packets; by replaying 1957 EAP packets; or by generating packets with overlapping 1958 Identifiers. 1960 [4] An attacker may attempt to recover the pass-phrase by mounting 1961 an offline dictionary attack. 1963 [5] An attacker may attempt to convince the peer to connect to an 1964 untrusted network, by mounting a man-in-the-middle attack. 1966 [6] An attacker may attempt to disrupt the EAP negotiation in order 1967 cause a weak authentication method to be selected. 1969 [7] An attacker may attempt to recover keys by taking advantage of 1970 weak key derivation techniques used within EAP methods. 1972 [8] An attacker may attempt to take advantage of weak ciphersuites 1973 subsequently used after the EAP conversation is complete. 1975 [9] An attacker may attempt to perform downgrading attacks on lower 1976 layer ciphersuite negotiation in order to ensure that a weaker 1977 ciphersuite is used subsequently to EAP authentication. 1979 [10] An attacker acting as an authenticator may provide incorrect 1980 information to the EAP peer and/or server via out-of-band 1981 mechanisms (such as via a AAA or lower layer protocol). This 1982 includes impersonating another authenticator, or providing 1983 inconsistent information to the peer and EAP server. 1985 Where EAP is used over wired networks, an attacker typically requires 1986 access to the physical infrastructure in order to carry out these 1987 attacks. However, where EAP is used over wireless networks, EAP 1988 packets may be forwarded by authenticators (e.g., pre-authentication) 1989 so that the attacker need not be within the coverage area of an 1990 authenticator in order to carry out an attack on it or its peers. 1991 Where EAP is used over the Internet, attacks may be carried out at an 1992 even greater distance. 1994 7.2 Security claims 1996 In order to clearly articulate the security provided by an EAP 1997 method, EAP method specifications MUST include a Security Claims 1998 section including the following declarations: 2000 [a] Intended use. This includes a statement of whether the method is 2001 intended for use over a physically secure or insecure network, as 2002 well as a statement of the applicable lower layers. 2004 [b] Mechanism. This is a statement of the authentication technology: 2005 certificates, pre-shared keys, passwords, token cards, etc. 2007 [c] Security claims. This is a statement of the claimed security 2008 properties of the method, using terms defined in Section 1.2: 2009 mutual authentication, integrity protection, replay protection, 2010 confidentiality, key derivation, dictionary attack resistance, 2011 fast reconnect, cryptographic binding, protected result 2012 indications. The Security Claims section of an EAP method 2013 specification SHOULD provide justification for the claims that 2014 are made. This can be accomplished by including a proof in an 2015 Appendix, or including a reference to a proof. 2017 [d] Key strength. If the method derives keys, then the effective key 2018 strength MUST be estimated. This estimate is meant for potential 2019 users of the method to determine if the keys produced are strong 2020 enough for the intended application. 2022 The effective key strength SHOULD be stated as number of bits, 2023 defined as follows: If the effective key strength is N bits, the 2024 best currently known methods to recover the key (with 2025 non-negligible probability) require an effort comparable to 2^N 2026 operations of a typical block cipher. The statement SHOULD be 2027 accompanied by a short rationale, explaining how this number was 2028 arrived at. This explanation SHOULD include the parameters 2029 required to achieve the stated key strength based on current 2030 knowledge of the algorithms. 2032 (Note: Although it is difficult to define what "comparable 2033 effort" and "typical block cipher" exactly mean, reasonable 2034 approximations are sufficient here. Refer to e.g. [SILVERMAN] 2035 for more discussion.) 2037 The key strength depends on the methods used to derive the keys. 2038 For instance, if keys are derived from a shared secret (such as a 2039 password or a long-term secret), and possibly some public 2040 information such as nonces, the effective key strength is limited 2041 by the strength of the long-term secret (assuming that the 2042 derivation procedure is computationally simple). To take another 2043 example, when using public key algorithms, the strength of the 2044 symmetric key depends on the strength of the public keys used. 2046 [e] Description of key hierarchy. EAP methods deriving keys MUST 2047 either provide a reference to a key hierarchy specification, or 2048 describe how Master Session Keys (MSKs) and Extended Master 2049 Session Keys (EMSKs) are to be derived. 2051 [f] Indication of vulnerabilities. In addition to the security 2052 claims that are made, the specification MUST indicate which of 2053 the security claims detailed in Section 7.2.1 are NOT being made. 2055 7.2.1 Security claims terminology for EAP methods 2057 These terms are used to described the security properties of EAP 2058 methods: 2060 Protected ciphersuite negotiation 2061 This refers to the ability of an EAP method to negotiate 2062 the ciphersuite used to protect the EAP conversation, as 2063 well as to integrity protect the negotiation. It does not 2064 refer to the ability to negotiate the ciphersuite used to 2065 protect data. 2067 Mutual authentication 2068 This refers to an EAP method in which, within an 2069 interlocked exchange, the authenticator authenticates the 2070 peer and the peer authenticates the authenticator. Two 2071 independent one-way methods, running in opposite directions 2072 do not provide mutual authentication as defined here. 2074 Integrity protection 2075 This refers to providing data origin authentication and 2076 protection against unauthorized modification of information 2077 for EAP packets (including EAP Requests and Responses). 2078 When making this claim, a method specification MUST 2079 describe the EAP packets and fields within the EAP packet 2080 that are protected. 2082 Replay protection 2083 This refers to protection against replay of an EAP method 2084 or its messages, including method-specific success and 2085 failure indications. 2087 Confidentiality 2088 This refers to encryption of EAP messages, including EAP 2089 Requests and Responses, and method-specific success and 2090 failure indications. A method making this claim MUST 2091 support identity protection (see Section 7.3). 2093 Key derivation 2094 This refers to the ability of the EAP method to derive 2095 exportable keying material such as the Master Session Key 2096 (MSK), and Extended Master Session Key (EMSK). The MSK is 2097 used only for further key derivation, not directly for 2098 protection of the EAP conversation or subsequent data. Use 2099 of the EMSK is reserved. 2101 Key strength 2102 If the effective key strength is N bits, the best currently 2103 known methods to recover the key (with non-negligible 2104 probability) require an effort comparable to 2^N operations 2105 of a typical block cipher. 2107 Dictionary attack resistance 2108 Where password authentication is used, passwords are 2109 commonly selected from a small set (as compared to a set of 2110 N-bit keys), which raises a concern about dictionary 2111 attacks. A method may be said to provide protection 2112 against dictionary attacks if, when it uses a password as a 2113 secret, the method does not allow an offline attack that 2114 has a work factor based on the number of passwords in an 2115 attacker's dictionary. 2117 Fast reconnect 2118 The ability, in the case where a security association has 2119 been previously established, to create a new or refreshed 2120 security association in a smaller number of round-trips. 2122 Cryptographic binding 2123 The demonstration of the EAP peer to the EAP server that a 2124 single entity has acted as the EAP peer for all methods 2125 executed within a tunnel method. Binding MAY also imply 2126 that the EAP server demonstrates to the peer that a single 2127 entity has acted as the EAP server for all methods executed 2128 within a tunnel method. If executed correctly, binding 2129 serves to mitigate man-in-the-middle vulnerabilities. 2131 Protected result indications 2132 The ability within a method for the authenticator to 2133 indicate to the peer whether it has successfully 2134 authenticated to it, and for the peer to acknowledge 2135 receipt of that indication as well as indicating to the 2136 authenticator whether it has successfully authenticated to 2137 the peer. Since EAP Success and Failure packets are 2138 neither acknowledged nor integrity protected, this claim 2139 requires implementation of a method-specific result 2140 exchange that is authenticated, integrity and replay 2141 protected on a per-packet basis. 2143 Session independence 2144 The demonstration that passive attacks (such as capture of 2145 the EAP conversation) or active attacks (including 2146 compromise of the MSK or EMSK) does not enable compromise 2147 of subsequent or prior MSKs or EMSKs. 2149 Fragmentation 2150 This refers to whether an EAP method supports fragmentation 2151 and reassembly. As noted in Section 3.1, EAP methods 2152 should support fragmentation and reassembly if EAP packets 2153 can exceed the minimum MTU of 1020 octets. 2155 Channel binding 2156 The communication within an EAP method of 2157 integrity-protected channel properties such as endpoint 2158 identifiers which can be compared to values communicated 2159 via out of band mechanisms (such as via a AAA or lower 2160 layer protocol). 2162 7.3 Identity protection 2164 An Identity exchange is optional within the EAP conversation. 2165 Therefore, it is possible to omit the Identity exchange entirely, or 2166 to use a method-specific identity exchange once a protected channel 2167 has been established. 2169 However, where roaming is supported as described in [RFC2607], it may 2170 be necessary to locate the appropriate backend authentication server 2171 before the authentication conversation can proceed. The realm 2172 portion of the Network Access Identifier (NAI) [RFC2486] is typically 2173 included within the EAP-Response/Identity in order to enable the 2174 authentication exchange to be routed to the appropriate backend 2175 authentication server. Therefore while the peer-name portion of the 2176 NAI may be omitted in the EAP-Response/Identity, where proxies or 2177 relays are present, the realm portion may be required. 2179 It is possible for the identity in the identity response to be 2180 different from the identity authenticated by the EAP method. This may 2181 be intentional in the case of identity privacy. An EAP method SHOULD 2182 use the authenticated identity when making access control decisions. 2184 7.4 Man-in-the-middle attacks 2186 Where EAP is tunneled within another protocol that omits peer 2187 authentication, there exists a potential vulnerability to 2188 man-in-the-middle attack. For details, see [BINDING] and [MITM]. 2190 As noted in Section 2.1, EAP does not permit untunnelled sequences of 2191 authentication methods. Were a sequence of EAP authentication 2192 methods to be permitted, the peer might not have proof that a single 2193 entity has acted as the authenticator for all EAP methods within the 2194 sequence. For example, an authenticator might terminate one EAP 2195 method, then forward the next method in the sequence to another party 2196 without the peer's knowledge or consent. Similarly, the 2197 authenticator might not have proof that a single entity has acted as 2198 the peer for all EAP methods within the sequence. 2200 Tunnelling EAP within another protocol enables an attack by a rogue 2201 EAP authenticator tunneling EAP to a legitimate server. Where the 2202 tunneling protocol is used for key establishment but does not require 2203 peer authentication, an attacker convincing a legitimate peer to 2204 connect to it will be able to tunnel EAP packets to a legitimate 2205 server, successfully authenticating and obtaining the key. This 2206 allows the attacker to successfully establish itself as a 2207 man-in-the-middle, gaining access to the network, as well as the 2208 ability to decrypt data traffic between the legitimate peer and 2209 server. 2211 This attack may be mitigated by the following measures: 2213 [a] Requiring mutual authentication within EAP tunneling mechanisms. 2215 [b] Requiring cryptographic binding between the EAP tunneling 2216 protocol and the tunneled EAP methods. Where cryptographic 2217 binding is supported, a mechanism is also needed to protect 2218 against downgrade attacks that would bypass it. For further 2219 details on cryptographic binding, see [BINDING]. 2221 [c] Limiting the EAP methods authorized for use without protection, 2222 based on peer and authenticator policy. 2224 [d] Avoiding the use of tunnels when a single, strong method is 2225 available. 2227 7.5 Packet modification attacks 2229 While EAP methods may support per-packet data origin authentication, 2230 integrity and replay protection, support is not provided within the 2231 EAP layer. 2233 Since the Identifier is only a single octet, it is easy to guess, 2234 allowing an attacker to successfully inject or replay EAP packets. An 2235 attacker may also modify EAP headers (Code, Identifier, Length, Type) 2236 within EAP packets where the header is unprotected. This could cause 2237 packets to be inappropriately discarded or misinterpreted. 2239 In the case of PPP and IEEE 802 wired links, it is assumed that such 2240 attacks are restricted to attackers who can gain access to the 2241 physical link. However, where EAP is run over physically insecure 2242 lower layers such as wireless (802.11 or cellular) or the Internet 2243 (such as within protocols supporting PPP, EAP or Ethernet Tunneling), 2244 this assumption is no longer valid and the vulnerability to attack is 2245 greater. 2247 To protect EAP messages sent over physically insecure lower layers, 2248 methods providing mutual authentication and key derivation, as well 2249 as per-packet origin authentication, integrity and replay protection 2250 SHOULD be used. 2252 Method-specific MICs may be used to provide protection. If a 2253 per-packet MIC is employed within an EAP method, then peers, 2254 authentication servers, and authenticators not operating in 2255 pass-through mode MUST validate the MIC. MIC validation failures 2256 SHOULD be logged. Whether a MIC validation failure is considered a 2257 fatal error or not is determined by the EAP method specification. 2259 Since EAP messages of Types Identity, Notification, and Nak do not 2260 include their own MIC, it may be desirable for the EAP method MIC to 2261 cover information contained within these messages, as well as the 2262 header of each EAP message. 2264 To provide protection, EAP also may be encapsulated within a 2265 protected channel created by protocols such as ISAKMP [RFC2408] as is 2266 done in [IKEv2] or within TLS [RFC2246]. However, as noted in 2267 Section 7.4, EAP tunneling may result in a man-in-the-middle 2268 vulnerability. 2270 Existing EAP methods define message integrity checks (MICs) that 2271 cover more than one EAP packet. For example, EAP-TLS [RFC2716] 2272 defines a MIC over a TLS record that could be split into multiple 2273 fragments; within the FINISHED message, the MIC is computed over 2274 previous messages. Where the MIC covers more than one EAP packet, a 2275 MIC validation failure is typically considered a fatal error. 2277 Within EAP-TLS [RFC2716] a MIC validation failure is treated as a 2278 fatal error, since that is what is specified in TLS [RFC2246]. 2279 However, it is also possible to develop EAP methods that support 2280 per-packet MICs, and respond to verification failures by silently 2281 discarding the offending packet. 2283 In this document, descriptions of EAP message handling assume that 2284 per-packet MIC validation, where it occurs, is effectively performed 2285 as though it occurs before sending any responses or changing the 2286 state of the host which received the packet. 2288 7.6 Dictionary attacks 2290 Password authentication algorithms such as EAP-MD5, MS-CHAPv1 2291 [RFC2433] and Kerberos V [RFC1510] are known to be vulnerable to 2292 dictionary attacks. MS-CHAPv1 vulnerabilities are documented in 2293 [PPTPv1]; Kerberos vulnerabilities are described in [KRBATTACK], 2294 [KRBLIM], and [KERB4WEAK]. 2296 In order to protect against dictionary attacks, an authentication 2297 algorithm resistant to dictionary attack (as defined in Section 7.2) 2298 SHOULD be used where EAP runs over lower layers which are not 2299 physically secure. 2301 If an authentication algorithm is used that is known to be vulnerable 2302 to dictionary attack, then the conversation may be tunneled within a 2303 protected channel in order to provide additional protection. However, 2304 as noted in Section 7.4, EAP tunneling may result in a 2305 man-in-the-middle vulnerability, and therefore dictionary attack 2306 resistant methods are preferred. 2308 7.7 Connection to an untrusted network 2310 With EAP methods supporting one-way authentication, such as EAP-MD5, 2311 the peer does not authenticate the authenticator. Where the lower 2312 layer is not physically secure (such as where EAP runs over wireless 2313 media or the Internet), the peer is vulnerable to a rogue 2314 authenticator. As a result, where the lower layer is not physically 2315 secure, a method supporting mutual authentication is RECOMMENDED. 2317 In EAP there is no requirement that authentication be full duplex or 2318 that the same protocol be used in both directions. It is perfectly 2319 acceptable for different protocols to be used in each direction. This 2320 will, of course, depend on the specific protocols negotiated. 2321 However, in general, completing a single unitary mutual 2322 authentication is preferable to two one-way authentications, one in 2323 each direction. This is because separate authentications that are 2324 not bound cryptographically so as to demonstrate they are part of the 2325 same session are subject to man-in-the-middle attacks, as discussed 2326 in Section 7.4. 2328 7.8 Negotiation attacks 2330 In a negotiation attack, the attacker attempts to convince the peer 2331 and authenticator to negotiate a less secure EAP method. EAP does 2332 not provide protection for Nak Response packets, although it is 2333 possible for a method to include coverage of Nak Responses within a 2334 method-specific MIC. 2336 Within or associated with each authenticator, it is not anticipated 2337 that a particular named peer will support a choice of methods. This 2338 would make the peer vulnerable to attacks that negotiate the least 2339 secure method from among a set. Instead, for each named peer there 2340 SHOULD be an indication of exactly one method used to authenticate 2341 that peer name. If a peer needs to make use of different 2342 authentication methods under different circumstances, then distinct 2343 identities SHOULD be employed, each of which identifies exactly one 2344 authentication method. 2346 7.9 Implementation idiosyncrasies 2348 The interaction of EAP with lower layers such as PPP and IEEE 802 are 2349 highly implementation dependent. 2351 For example, upon failure of authentication, some PPP implementations 2352 do not terminate the link, instead limiting traffic in Network-Layer 2353 Protocols to a filtered subset, which in turn allows the peer the 2354 opportunity to update secrets or send mail to the network 2355 administrator indicating a problem. Similarly, while in 2356 [IEEE-802.1X] an authentication failure will result in denied access 2357 to the controlled port, limited traffic may be permitted on the 2358 uncontrolled port. 2360 In EAP there is no provision for retries of failed authentication. 2361 However, in PPP the LCP state machine can renegotiate the 2362 authentication protocol at any time, thus allowing a new attempt. 2363 Similarly, in IEEE 802.1X the Supplicant or Authenticator can 2364 re-authenticate at any time. It is recommended that any counters 2365 used for authentication failure not be reset until after successful 2366 authentication, or subsequent termination of the failed link. 2368 7.10 Key derivation 2370 It is possible for the peer and EAP server to mutually authenticate 2371 and derive keys. In order to provide keying material for use in a 2372 subsequently negotiated ciphersuite, an EAP method supporting key 2373 derivation MUST export a Master Session Key (MSK) of at least 64 2374 octets, and an Extended Master Session Key (EMSK) of at least 64 2375 octets. EAP Methods deriving keys MUST provide for mutual 2376 authentication between the EAP peer and the EAP Server. 2378 The MSK and EMSK MUST NOT be used directly to protect data; however, 2379 they are of sufficient size to enable derivation of a AAA-Key 2380 subsequently used to derive Transient Session Keys (TSKs) for use 2381 with the selected ciphersuite. Each ciphersuite is responsible for 2382 specifying how to derive the TSKs from the AAA-Key. 2384 The AAA-Key is derived from the keying material exported by the EAP 2385 method (MSK and EMSK). This derivation occurs on the AAA server. In 2386 many existing protocols that use EAP, the AAA-Key and MSK are 2387 equivalent, but more complicated mechanisms are possible (see 2388 [KEYFRAME] for details). 2390 EAP methods SHOULD ensure the freshness of the MSK and EMSK even in 2391 cases where one party may not have a high quality random number 2392 generator. A RECOMMENDED method is for each party to provide a nonce 2393 of at least 128 bits, used in the derivation of the MSK and EMSK. 2395 EAP methods export the MSK and EMSK and not Transient Session Keys so 2396 as to allow EAP methods to be ciphersuite and media independent. 2397 Keying material exported by EAP methods MUST be independent of the 2398 ciphersuite negotiated to protect data. 2400 Depending on the lower layer, EAP methods may run before or after 2401 ciphersuite negotiation, so that the selected ciphersuite may not be 2402 known to the EAP method. By providing keying material usable with 2403 any ciphersuite, EAP methods can used with a wide range of 2404 ciphersuites and media. 2406 It is RECOMMENDED that methods providing integrity protection of EAP 2407 packets include coverage of all the EAP header fields, including the 2408 Code, Identifier, Length, Type and Type-Data fields. 2410 In order to preserve algorithm independence, EAP methods deriving 2411 keys SHOULD support (and document) the protected negotiation of the 2412 ciphersuite used to protect the EAP conversation between the peer and 2413 server. This is distinct from the ciphersuite negotiated between the 2414 peer and authenticator, used to protect data. 2416 The strength of Transient Session Keys (TSKs) used to protect data is 2417 ultimately dependent on the strength of keys generated by the EAP 2418 method. If an EAP method cannot produce keying material of 2419 sufficient strength, then the TSKs may be subject to brute force 2420 attack. In order to enable deployments requiring strong keys, EAP 2421 methods supporting key derivation SHOULD be capable of generating an 2422 MSK and EMSK, each with an effective key strength of at least 128 2423 bits. 2425 Methods supporting key derivation MUST demonstrate cryptographic 2426 separation between the MSK and EMSK branches of the EAP key 2427 hierarchy. Without violating a fundamental cryptographic assumption 2428 (such as the non-invertibility of a one-way function) an attacker 2429 recovering the MSK or EMSK MUST NOT be able to recover the other 2430 quantity with a level of effort less than brute force. 2432 Non-overlapping substrings of the MSK MUST be cryptographically 2433 separate from each other, as defined in Section 7.2.1. That is, 2434 knowledge of one substring MUST NOT help in recovering some other 2435 substring without breaking some hard cryptographic assumption. This 2436 is required because some existing ciphersuites form TSKs by simply 2437 splitting the AAA-Key to pieces of appropriate length. Likewise, 2438 non-overlapping substrings of the EMSK MUST be cryptographically 2439 separate from each other, and from substrings of the MSK. 2441 The EMSK is reserved for future use and MUST remain on the EAP peer 2442 and EAP server where it is derived; it MUST NOT be transported to, or 2443 shared with, additional parties, or used to derive any other keys. 2444 (This restriction will be relaxed in a future document that specifies 2445 how the EMSK can be used.) 2447 Since EAP does not provide for explicit key lifetime negotiation, EAP 2448 peers, authenticators and authentication servers MUST be prepared for 2449 situations in which one of the parties discards key state which 2450 remains valid on another party. 2452 This specification does not provide detailed guidance on how EAP 2453 methods derive the MSK and EMSK; how the AAA-Key is derived from the 2454 MSK and/or EMSK; or how the TSKs are derived from the AAA-Key. 2456 The development and validation of key derivation algorithms is 2457 difficult, and as a result EAP methods SHOULD reuse well established 2458 and analyzed mechanisms for key derivation (such as those specified 2459 in IKE [RFC2409] or TLS [RFC2246]), rather than inventing new ones. 2460 EAP methods SHOULD also utilize well established and analyzed 2461 mechanisms for MSK and EMSK derivation. Further details on EAP Key 2462 Derivation are provided within [KEYFRAME]. 2464 7.11 Weak ciphersuites 2466 If after the initial EAP authentication, data packets are sent 2467 without per-packet authentication, integrity and replay protection, 2468 an attacker with access to the media can inject packets, "flip bits" 2469 within existing packets, replay packets, or even hijack the session 2470 completely. Without per-packet confidentiality, it is possible to 2471 snoop data packets. 2473 As a result, as noted in Section 3.1, where EAP is used over a 2474 physically insecure lower layer, per-packet authentication, integrity 2475 and replay protection SHOULD be used, and per-packet confidentiality 2476 is also recommended. 2478 Additionally, if the lower layer performs ciphersuite negotiation, it 2479 should be understood that EAP does not provide by itself integrity 2480 protection of that negotiation. Therefore, in order to avoid 2481 downgrading attacks which would lead to weaker ciphersuites being 2482 used, clients implementing lower layer ciphersuite negotiation SHOULD 2483 protect against negotiation downgrading. 2485 This can be done by enabling users to configure which are the 2486 acceptable ciphersuites as a matter of security policy; or, the 2487 ciphersuite negotiation MAY be authenticated using keying material 2488 derived from the EAP authentication and a MIC algorithm agreed upon 2489 in advance by lower-layer peers. 2491 7.12 Link layer 2493 There exists a number of reliability and security issues with link 2494 layer indications in PPP, IEEE 802 wired networks and IEEE 802.11 2495 wireless LANs: 2497 [a] PPP. In PPP, link layer indications such as LCP-Terminate (a 2498 link failure indication) and NCP (a link success indication) are 2499 not authenticated or integrity protected. They can therefore be 2500 spoofed by an attacker with access to the physical medium. 2502 [b] IEEE 802 wired networks. On wired networks, IEEE 802.1X messages 2503 are sent to a non-forwardable multicast MAC address. As a 2504 result, while the IEEE 802.1X EAPOL-Start and EAPOL-Logoff frames 2505 are not authenticated or integrity protected, only an attacker 2506 with access to the physical link can spoof these messages. 2508 [c] IEEE 802.11 wireless LANs. In IEEE 802.11, link layer 2509 indications include Disassociate and Deauthenticate frames (link 2510 failure indications), and the first message of the 4-way 2511 handshake (link success indication). These messages are not 2512 authenticated or integrity protected, and although they are not 2513 forwardable, they are spoofable by an attacker within range. 2515 In IEEE 802.11, IEEE 802.1X data frames may be sent as Class 3 2516 unicast data frames, and are therefore forwardable. This implies 2517 that while EAPOL-Start and EAPOL-Logoff messages may be 2518 authenticated and integrity protected, they can be spoofed by an 2519 authenticated attacker far from the target when 2520 "pre-authentication" is enabled. 2522 In IEEE 802.11 a "link down" indication is an unreliable 2523 indication of link failure, since wireless signal strength can 2524 come and go and may be influenced by radio frequency interference 2525 generated by an attacker. To avoid unnecessary resets, it is 2526 advisable to damp these indications, rather than passing them 2527 directly to the EAP. Since EAP supports retransmission, it is 2528 robust against transient connectivity losses. 2530 7.13 Separation of authenticator and backend authentication server 2532 It is possible for the EAP peer and EAP server to mutually 2533 authenticate and derive a AAA-Key for a ciphersuite used to protect 2534 subsequent data traffic. This does not present an issue on the peer, 2535 since the peer and EAP client reside on the same machine; all that is 2536 required is for the client to derive the AAA-Key from the MSK and 2537 EMSK exported by the EAP method, and to subsequently pass a Transient 2538 Session Key (TSK) to the ciphersuite module. 2540 However, in the case where the authenticator and authentication 2541 server reside on different machines, there are several implications 2542 for security. 2544 [a] Authentication will occur between the peer and the authentication 2545 server, not between the peer and the authenticator. This means 2546 that it is not possible for the peer to validate the identity of 2547 the authenticator that it is speaking to, using EAP alone. 2549 [b] As discussed in [RFC3579], the authenticator is dependent on the 2550 AAA protocol in order to know the outcome of an authentication 2551 conversation, and does not look at the encapsulated EAP packet 2552 (if one is present) to determine the outcome. In practice this 2553 implies that the AAA protocol spoken between the authenticator 2554 and authentication server MUST support per-packet authentication, 2555 integrity and replay protection. 2557 [c] Where EAP is used over lower layers which are not physically 2558 secure, after completion of the EAP conversation, a secure 2559 association protocol SHOULD be run between the peer and 2560 authenticator in order to provide mutual authentication; 2561 guarantee liveness of the TSKs; provide protected ciphersuite and 2562 capabilities negotiation; synchronize key usage. 2564 [d] A AAA-Key derived from the MSK and/or EMSK negotiated between the 2565 peer and authentication server MAY be transmitted to the 2566 authenticator. Therefore a mechanism needs to be provided to 2567 transmit the AAA-Key from the authentication server to the 2568 authenticator that needs it. The specification of the AAA-key 2569 derivation, transport and wrapping mechanisms is outside the 2570 scope of this document. Further details on AAA-Key Derivation 2571 are provided within [KEYFRAME]. 2573 7.14 Cleartext Passwords 2575 EAP does not support cleartext password authentication. This 2576 omission is intentional. Where EAP is carried over physically 2577 insecure lower layers, including wireless LANs [IEEE-802.11] or the 2578 Internet, use of cleartext passwords would allow the password to be 2579 captured by an attacker with access to the lower layer. 2581 Since protocols encapsulating EAP, such as RADIUS [RFC3579], may not 2582 provide confidentiality, even where the lower layer is physically 2583 secure, EAP frames may be subsequently encapsulated for transport 2584 over the Internet where they may be captured by an attacker. 2586 As a result, cleartext passwords cannot be securely used within EAP, 2587 except where encapsulated within a protected tunnel with server 2588 authentication. Some of the same risks apply to EAP methods without 2589 dictionary attack resistance, as defined in Section 7.2.1. For 2590 details, see Section 7.6. 2592 7.15 Channel binding 2594 It is possible for a compromised or poorly implemented EAP 2595 authenticator to communicate incorrect information to the EAP peer 2596 and/or server. This may enable an authenticator to impersonate 2597 another authenticator or communicate incorrect information via 2598 out-of-band mechanisms (such as via a AAA or lower layer protocol). 2600 Where EAP is used in pass-through mode, the EAP peer typically does 2601 not verify the identity of the pass-through authenticator, it only 2602 verifies that the pass-through authenticator is trusted by the EAP 2603 server. This creates a potential security vulnerability. 2605 Section 4.3.7 of [RFC3579] describes how an EAP pass-through 2606 authenticator acting as a AAA client can be detected if it attempts 2607 to impersonate another authenticator (such by sending incorrect 2608 NAS-Identifier [RFC2865], NAS-IP-Address [RFC2865] or 2609 NAS-IPv6-Address [RFC3162] attributes via the AAA protocol). 2610 However, it is possible for a pass-through authenticator acting as a 2611 AAA client to provide correct information to the AAA server while 2612 communicating misleading information to the EAP peer via a lower 2613 layer protocol. 2615 For example, it is possible for a compromised authenticator to 2616 utilize another authenticator's Called-Station-Id or NAS-Identifier 2617 in communicating with the EAP peer via a lower layer protocol, or for 2618 a pass-through authenticator acting as a AAA client to provide an 2619 incorrect peer Calling-Station-Id [RFC2865][RFC3580] to the AAA 2620 server via the AAA protocol. 2622 In order to address this vulnerability, EAP methods may support a 2623 protected exchange of channel properties such as endpoint 2624 identifiers, including (but not limited to): Called-Station-Id 2625 [RFC2865][RFC3580], Calling-Station-Id [RFC2865][RFC3580], 2626 NAS-Identifier [RFC2865], NAS-IP-Address [RFC2865], and 2627 NAS-IPv6-Address [RFC3162]. 2629 Using such a protected exchange, it is possible to match the channel 2630 properties provided by the authenticator via out-of-band mechanisms 2631 against those exchanged within the EAP method. Where discrepancies 2632 are found, these SHOULD be logged; additional actions MAY also be 2633 taken, such as denying access. 2635 8. Acknowledgments 2637 This protocol derives much of its inspiration from Dave Carrel's AHA 2638 draft as well as the PPP CHAP protocol [RFC1994]. Valuable feedback 2639 was provided by Yoshihiro Ohba of Toshiba America Research, Jari 2640 Arkko of Ericsson, Sachin Seth of Microsoft, Glen Zorn of Cisco 2641 Systems, Jesse Walker of Intel, Bill Arbaugh, Nick Petroni and Bryan 2642 Payne of the University of Maryland, Steve Bellovin of AT&T Research, 2643 Paul Funk of Funk Software, Pasi Eronen of Nokia, Joseph Salowey of 2644 Cisco and Paul Congdon of HP and members of the EAP working group. 2646 The use of Security Claims sections for EAP methods, as required by 2647 Section 7.2 and specified for each EAP method described in this 2648 document, was inspired by Glen Zorn through [EAP-EVAL]. 2650 Normative References 2652 [RFC1661] Simpson, W., "The Point-to-Point Protocol (PPP)", STD 51, 2653 RFC 1661, July 1994. 2655 [RFC1750] Eastlake, D., Crocker, S. and J. Schiller, "Randomness 2656 Recommendations for Security", RFC 1750, December 1994. 2658 [RFC1994] Simpson, W., "PPP Challenge Handshake Authentication 2659 Protocol (CHAP)", RFC 1994, August 1996. 2661 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 2662 Requirement Levels", BCP 14, RFC 2119, March 1997. 2664 [RFC2243] Metz, C., "OTP Extended Responses", RFC 2243, November 2665 1997. 2667 [RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO 2668 10646", RFC 2279, January 1998. 2670 [RFC2289] Haller, N., Metz, C., Nesser, P. and M. Straw, "A One-Time 2671 Password System", RFC 2289, February 1998. 2673 [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an 2674 IANA Considerations Section in RFCs", BCP 26, RFC 2434, 2675 October 1998. 2677 [RFC2988] Paxson, V. and M. Allman, "Computing TCP's Retransmission 2678 Timer", RFC 2988, November 2000. 2680 [IEEE-802] 2681 Institute of Electrical and Electronics Engineers, "Local 2682 and Metropolitan Area Networks: Overview and 2683 Architecture", IEEE Standard 802, 1990. 2685 [IEEE-802.1X] 2686 Institute of Electrical and Electronics Engineers, "Local 2687 and Metropolitan Area Networks: Port-Based Network Access 2688 Control", IEEE Standard 802.1X, September 2001. 2690 Informative References 2692 [RFC793] Postel, J., "Transmission Control Protocol", STD 7, RFC 2693 793, September 1981. 2695 [RFC1510] Kohl, J. and B. Neuman, "The Kerberos Network 2696 Authentication Service (V5)", RFC 1510, September 1993. 2698 [RFC2222] Myers, J., "Simple Authentication and Security Layer 2699 (SASL)", RFC 2222, October 1997. 2701 [RFC2246] Dierks, T., Allen, C., Treese, W., Karlton, P., Freier, A. 2702 and P. Kocher, "The TLS Protocol Version 1.0", RFC 2246, 2703 January 1999. 2705 [RFC2284] Blunk, L. and J. Vollbrecht, "PPP Extensible 2706 Authentication Protocol (EAP)", RFC 2284, March 1998. 2708 [RFC2486] Aboba, B. and M. Beadles, "The Network Access Identifier", 2709 RFC 2486, January 1999. 2711 [RFC2401] Kent, S. and R. Atkinson, "Security Architecture for the 2712 Internet Protocol", RFC 2401, November 1998. 2714 [RFC2408] Maughan, D., Schneider, M. and M. Schertler, "Internet 2715 Security Association and Key Management Protocol 2716 (ISAKMP)", RFC 2408, November 1998. 2718 [RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange 2719 (IKE)", RFC 2409, November 1998. 2721 [RFC2433] Zorn, G. and S. Cobb, "Microsoft PPP CHAP Extensions", RFC 2722 2433, October 1998. 2724 [RFC2607] Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy 2725 Implementation in Roaming", RFC 2607, June 1999. 2727 [RFC2661] Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, G. 2728 and B. Palter, "Layer Two Tunneling Protocol "L2TP"", RFC 2729 2661, August 1999. 2731 [RFC2716] Aboba, B. and D. Simon, "PPP EAP TLS Authentication 2732 Protocol", RFC 2716, October 1999. 2734 [RFC2743] Linn, J., "Generic Security Service Application Program 2735 Interface Version 2, Update 1", RFC 2743, January 2000. 2737 [RFC2865] Rigney, C., Willens, S., Rubens, A. and W. Simpson, 2738 "Remote Authentication Dial In User Service (RADIUS)", RFC 2739 2865, June 2000. 2741 [RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C., 2742 Schwarzbauer, H., Taylor, T., Rytina, I., Kalla, M., 2743 Zhang, L. and V. Paxson, "Stream Control Transmission 2744 Protocol", RFC 2960, October 2000. 2746 [RFC3162] Aboba, B., Zorn, G. and D. Mitton, "RADIUS and IPv6", RFC 2747 3162, August 2001. 2749 [RFC3454] Hoffman, P. and M. Blanchet, "Preparation of 2750 Internationalized Strings ("stringprep")", RFC 3454, 2751 December 2002. 2753 [RFC3579] Aboba, B. and P. Calhoun, "RADIUS (Remote Authentication 2754 Dial In User Service) Support For Extensible 2755 Authentication Protocol (EAP)", RFC 3579, September 2003. 2757 [RFC3580] Congdon, P., Aboba, B., Smith, A., Zorn, G. and J. Roese, 2758 "IEEE 802.1X Remote Authentication Dial In User Service 2759 (RADIUS) Usage Guidelines", RFC 3580, September 2003. 2761 [DECEPTION] 2762 Slatalla, M. and J. Quittner, "Masters of Deception", 2763 Harper-Collins , New York, 1995. 2765 [KRBATTACK] 2766 Wu, T., "A Real-World Analysis of Kerberos Password 2767 Security", Proceedings of the 1999 ISOC Network and 2768 Distributed System Security Symposium, http:// 2769 www.isoc.org/isoc/conferences/ndss/99/proceedings/papers/ 2770 wu.pdf. 2772 [KRBLIM] Bellovin, S. and M. Merrit, "Limitations of the Kerberos 2773 authentication system", Proceedings of the 1991 Winter 2774 USENIX Conference, pp. 253-267, 1991. 2776 [KERB4WEAK] 2777 Dole, B., Lodin, S. and E. Spafford, "Misplaced trust: 2778 Kerberos 4 session keys", Proceedings of the Internet 2779 Society Network and Distributed System Security Symposium, 2780 pp. 60-70, March 1997. 2782 [PIC] Aboba, B., Krawczyk, H. and Y. Sheffer, "PIC, A Pre-IKE 2783 Credential Provisioning Protocol", draft-ietf-ipsra-pic-06 2784 (work in progress), October 2002. 2786 [IKEv2] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", 2787 draft-ietf-ipsec-ikev2-11 (work in progress), October 2788 2003. 2790 [PPTPv1] Schneier, B. and Mudge, "Cryptanalysis of Microsoft's 2791 Point-to- Point Tunneling Protocol", Proceedings of the 2792 5th ACM Conference on Communications and Computer 2793 Security, ACM Press, November 1998. 2795 [IEEE-802.3] 2796 Institute of Electrical and Electronics Engineers, 2797 "Information technology - Telecommunications and 2798 information exchange between systems - Local and 2799 metropolitan area networks - Specific requirements - Part 2800 3: Carrier sense multiple access with collision detection 2801 (CSMA/CD) access method and physical layer 2802 specifications"", IEEE Standard 802.3, September 1998. 2804 [IEEE-802.11] 2805 Institute of Electrical and Electronics Engineers, 2806 "Wireless LAN Medium Access Control (MAC) and Physical 2807 Layer (PHY) Specifications", IEEE Standard 802.11, 1999. 2809 [SILVERMAN] 2810 Silverman, Robert D., "A Cost-Based Security Analysis of 2811 Symmetric and Asymmetric Key Lengths", RSA Laboratories 2812 Bulletin 13, April 2000 (Revised November 2001), http:// 2813 www.rsasecurity.com/rsalabs/bulletins/bulletin13.html. 2815 [IANA-EXP] 2816 Narten, T., "Assigning Experimental and Testing Numbers 2817 Considered Useful", 2818 draft-narten-iana-experimental-allocations-05 (work in 2819 progress), November 2003. 2821 [KEYFRAME] 2822 Aboba, B., "EAP Key Management Framework", 2823 draft-ietf-eap-keying-01 (work in progress), October 2003. 2825 [SASLPREP] 2826 Zeilenga, K., "SASLprep: Stringprep profile for user names 2827 and passwords", draft-ietf-sasl-saslprep-04 (work in 2828 progress), October 2003. 2830 [IEEE-802.11i] 2831 Institute of Electrical and Electronics Engineers, 2832 "Unapproved Draft Supplement to Standard for 2833 Telecommunications and Information Exchange Between 2834 Systems - LAN/MAN Specific Requirements - Part 11: 2835 Wireless LAN Medium Access Control (MAC) and Physical 2836 Layer (PHY) Specifications: Specification for Enhanced 2837 Security", IEEE Draft 802.11i (work in progress), 2003. 2839 [DIAM-EAP] 2840 Eronen, P., Hiller, T. and G. Zorn, "Diameter Extensible 2841 Authentication Protocol (EAP) Application", 2842 draft-ietf-aaa-eap-03 (work in progress), October 2003. 2844 [EAP-EVAL] 2845 Zorn, G., "Specifying Security Claims for EAP 2846 Authentication Types", draft-zorn-eap-eval-00 (work in 2847 progress), October 2002. 2849 [BINDING] Puthenkulam, J., "The Compound Authentication Binding 2850 Problem", draft-puthenkulam-eap-binding-04 (work in 2851 progress), October 2003. 2853 [MITM] Asokan, N., Niemi, V. and K. Nyberg, "Man-in-the-Middle in 2854 Tunnelled Authentication Protocols", IACR ePrint Archive 2855 Report 2002/163, October 2002, . 2858 Authors' Addresses 2860 Larry J. Blunk 2861 Merit Network, Inc 2862 4251 Plymouth Rd., Suite 2000 2863 Ann Arbor, MI 48105-2785 2864 USA 2866 Phone: +1 734-647-9563 2867 Fax: +1 734-647-3185 2868 EMail: ljb@merit.edu 2870 John R. Vollbrecht 2871 Vollbrecht Consulting LLC 2872 9682 Alice Hill Drive 2873 Dexter, MI 48130 2874 USA 2876 Phone: 2877 EMail: jrv@umich.edu 2878 Bernard Aboba 2879 Microsoft Corporation 2880 One Microsoft Way 2881 Redmond, WA 98052 2882 USA 2884 Phone: +1 425 706 6605 2885 Fax: +1 425 936 6605 2886 EMail: bernarda@microsoft.com 2888 James Carlson 2889 Sun Microsystems, Inc 2890 1 Network Drive 2891 Burlington, MA 01803-2757 2892 USA 2894 Phone: +1 781 442 2084 2895 Fax: +1 781 442 1677 2896 EMail: james.d.carlson@sun.com 2898 Henrik Levkowetz 2899 ipUnplugged AB 2900 Arenavagen 33 2901 Stockholm S-121 28 2902 SWEDEN 2904 Phone: +46 708 32 16 08 2905 EMail: henrik@levkowetz.com 2907 Appendix A. Changes from RFC 2284 2909 This section lists the major changes between [RFC2284] and this 2910 document. Minor changes, including style, grammar, spelling and 2911 editorial changes are not mentioned here. 2913 o The Terminology section (Section 1.2) has been expanded, defining 2914 more concepts and giving more exact definitions. 2916 o The two concepts Mutual authentication and Key derivation are 2917 introduced, and discussed throughout the document where 2918 appropriate. 2920 o In Section 2, it is explicitly specified that more than one 2921 exchange of Request and Response packets may occur as part of the 2922 EAP authentication exchange. How this may and may not be used is 2923 specified in detail in Section 2.1. 2925 o Also in Section 2, some requirements on the authenticator when 2926 acting in pass-through mode has been made explicit. 2928 o An EAP multiplexing model (Section 2.2) has been added, to 2929 illustrate a typical implementation of EAP. There is no 2930 requirement that an implementation conforms to this model, as long 2931 as the on-the-wire behavior is consistent with it. 2933 o As EAP is now in use with a variety of lower layers, not just PPP 2934 for which it was first designed, Section 3 on lower layer behavior 2935 has been added. 2937 o In the description of the EAP Request and Response interaction 2938 (Section 4.1), it has been more exactly specified when packets 2939 should be silently discarded, and also the behavior on receiving 2940 duplicate requests. The implementation notes in this section has 2941 been substantially expanded. 2943 o In Section 4.2, it has been clarified that Success and Failure 2944 packets must not contain additional data, and the implementation 2945 note has been expanded. A subsection giving requirements on 2946 processing of success and failure packets has been added. 2948 o Section 5 on EAP Request/Response Types lists two new Type values: 2949 the Expanded Type (Section 5.7), which is used to expand the Type 2950 value number space, and the Experimental Type. In the Expanded 2951 Type number space, the new Expanded Nak (Section 5.3.2) Type has 2952 been added. Clarifications have been made in the description of 2953 most of the existing Types. Security claims summaries have been 2954 added for authentication methods. 2956 o In Section 5, Section 5.1 and Section 5.2, requirements has been 2957 added that fields with displayable messages should contain UTF-8 2958 encoded ISO 10646 characters. 2960 o In Section 5.5, support for OTP Extended Responses [RFC2243] has 2961 been added to EAP OTP. 2963 o An IANA Considerations section (Section 6) has been added, giving 2964 registration policies for the numbering spaces defined for EAP. 2966 o The Security Considerations (Section 7) have been greatly 2967 expanded, aiming at giving a much more comprehensive coverage of 2968 possible threats and other security considerations. 2970 o In Section 7.5, text has been added on method-specific behavior, 2971 providing guidance on how EAP method-specific integrity checks 2972 should be processed. Where possible, it is desirable for a 2973 method-specific MIC to be computed over the entire EAP packet, 2974 including the EAP layer header (Code, Identifier, Length) and EAP 2975 method layer header (Type, Type-Data). 2977 Appendix B. Open issues 2979 (This section should be removed by the RFC editor before publication) 2981 Open issues relating to this specification are tracked on the 2982 following web site: 2984 http://www.drizzle.com/~aboba/EAP/eapissues.html 2986 The current working documents for this draft are available at this 2987 web site: 2989 http://www.levkowetz.com/pub/ietf/drafts/eap/rfc2284bis/ 2991 Intellectual Property Statement 2993 The IETF takes no position regarding the validity or scope of any 2994 intellectual property or other rights that might be claimed to 2995 pertain to the implementation or use of the technology described in 2996 this document or the extent to which any license under such rights 2997 might or might not be available; neither does it represent that it 2998 has made any effort to identify any such rights. Information on the 2999 IETF's procedures with respect to rights in standards-track and 3000 standards-related documentation can be found in BCP-11. Copies of 3001 claims of rights made available for publication and any assurances of 3002 licenses to be made available, or the result of an attempt made to 3003 obtain a general license or permission for the use of such 3004 proprietary rights by implementors or users of this specification can 3005 be obtained from the IETF Secretariat. 3007 The IETF invites any interested party to bring to its attention any 3008 copyrights, patents or patent applications, or other proprietary 3009 rights which may cover technology that may be required to practice 3010 this standard. Please address the information to the IETF Executive 3011 Director. 3013 Full Copyright Statement 3015 Copyright (C) The Internet Society (2003). All Rights Reserved. 3017 This document and translations of it may be copied and furnished to 3018 others, and derivative works that comment on or otherwise explain it 3019 or assist in its implementation may be prepared, copied, published 3020 and distributed, in whole or in part, without restriction of any 3021 kind, provided that the above copyright notice and this paragraph are 3022 included on all such copies and derivative works. However, this 3023 document itself may not be modified in any way, such as by removing 3024 the copyright notice or references to the Internet Society or other 3025 Internet organizations, except as needed for the purpose of 3026 developing Internet standards in which case the procedures for 3027 copyrights defined in the Internet Standards process must be 3028 followed, or as required to translate it into languages other than 3029 English. 3031 The limited permissions granted above are perpetual and will not be 3032 revoked by the Internet Society or its successors or assignees. 3034 This document and the information contained herein is provided on an 3035 "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING 3036 TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 3037 BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION 3038 HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF 3039 MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 3041 Acknowledgment 3043 Funding for the RFC Editor function is currently provided by the 3044 Internet Society. 3046 Attachment Converted: "c:\program files\qualcomm\eudora\imap\dominant\ids\attach\Untitled3"