idnits 2.17.1 draft-ietf-eap-rfc2284bis-08.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Looks like you're using RFC 2026 boilerplate. This must be updated to follow RFC 3978/3979, as updated by RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- == No 'Intended status' indicated for this document; assuming Proposed Standard Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** There are 11 instances of lines with control characters in the document. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year == Line 287 has weird spacing: '...such as bulk ...' == Line 1535 has weird spacing: '...ed Type of 6 ...' == Line 1631 has weird spacing: '...pe-Data field...' == Line 1949 has weird spacing: '...; or by gener...' == The document seems to use 'NOT RECOMMENDED' as an RFC 2119 keyword, but does not include the phrase in its RFC 2119 key words list. -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (February 14, 2004) is 7348 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) -- Looks like a reference, but probably isn't: '1' on line 1942 -- Looks like a reference, but probably isn't: '2' on line 1945 -- Looks like a reference, but probably isn't: '3' on line 1947 -- Looks like a reference, but probably isn't: '4' on line 1952 -- Looks like a reference, but probably isn't: '5' on line 1955 -- Looks like a reference, but probably isn't: '6' on line 1958 -- Looks like a reference, but probably isn't: '7' on line 1961 -- Looks like a reference, but probably isn't: '8' on line 1964 -- Looks like a reference, but probably isn't: '9' on line 1967 -- Looks like a reference, but probably isn't: '10' on line 1971 == Unused Reference: 'RFC2222' is defined on line 2770, but no explicit reference was found in the text == Unused Reference: 'RFC2401' is defined on line 2782, but no explicit reference was found in the text == Unused Reference: 'RFC2743' is defined on line 2805, but no explicit reference was found in the text == Unused Reference: 'IEEE-802.3' is defined on line 2866, but no explicit reference was found in the text ** Obsolete normative reference: RFC 2279 (Obsoleted by RFC 3629) ** Obsolete normative reference: RFC 2434 (Obsoleted by RFC 5226) ** Obsolete normative reference: RFC 2988 (Obsoleted by RFC 6298) -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE-802' -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE-802.1X' -- Obsolete informational reference (is this intentional?): RFC 793 (Obsoleted by RFC 9293) -- Obsolete informational reference (is this intentional?): RFC 1510 (Obsoleted by RFC 4120, RFC 6649) -- Obsolete informational reference (is this intentional?): RFC 1750 (Obsoleted by RFC 4086) -- Obsolete informational reference (is this intentional?): RFC 2222 (Obsoleted by RFC 4422, RFC 4752) -- Obsolete informational reference (is this intentional?): RFC 2246 (Obsoleted by RFC 4346) -- Obsolete informational reference (is this intentional?): RFC 2284 (Obsoleted by RFC 3748) -- Obsolete informational reference (is this intentional?): RFC 2486 (Obsoleted by RFC 4282) -- Obsolete informational reference (is this intentional?): RFC 2401 (Obsoleted by RFC 4301) -- Obsolete informational reference (is this intentional?): RFC 2408 (Obsoleted by RFC 4306) -- Obsolete informational reference (is this intentional?): RFC 2409 (Obsoleted by RFC 4306) -- Obsolete informational reference (is this intentional?): RFC 2716 (Obsoleted by RFC 5216) -- Obsolete informational reference (is this intentional?): RFC 2960 (Obsoleted by RFC 4960) -- Obsolete informational reference (is this intentional?): RFC 3454 (Obsoleted by RFC 7564) == Outdated reference: A later version (-07) exists of draft-ietf-ipsra-pic-06 == Outdated reference: A later version (-17) exists of draft-ietf-ipsec-ikev2-12 == Outdated reference: A later version (-22) exists of draft-ietf-eap-keying-01 == Outdated reference: A later version (-10) exists of draft-ietf-sasl-saslprep-04 == Outdated reference: A later version (-10) exists of draft-ietf-aaa-eap-03 == Outdated reference: A later version (-04) exists of draft-walker-ieee802-req-00 Summary: 5 errors (**), 0 flaws (~~), 17 warnings (==), 27 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 EAP Working Group L. Blunk 3 Internet-Draft Merit Network, Inc 4 Obsoletes: 2284 (if approved) J. Vollbrecht 5 Expires: August 14, 2004 Vollbrecht Consulting LLC 6 B. Aboba 7 Microsoft 8 J. Carlson 9 Sun 10 H. Levkowetz, Ed. 11 ipUnplugged 12 February 14, 2004 14 Extensible Authentication Protocol (EAP) 15 17 Status of this Memo 19 This document is an Internet-Draft and is in full conformance with 20 all provisions of Section 10 of RFC2026. 22 Internet-Drafts are working documents of the Internet Engineering 23 Task Force (IETF), its areas, and its working groups. Note that other 24 groups may also distribute working documents as Internet-Drafts. 26 Internet-Drafts are draft documents valid for a maximum of six months 27 and may be updated, replaced, or obsoleted by other documents at any 28 time. It is inappropriate to use Internet-Drafts as reference 29 material or to cite them other than as "work in progress". 31 The list of current Internet-Drafts can be accessed at http:// 32 www.ietf.org/ietf/1id-abstracts.txt 34 The list of Internet-Draft Shadow Directories can be accessed at 35 http://www.ietf.org/shadow.html 37 This Internet-Draft will expire on August 14, 2004. 39 Copyright Notice 41 Copyright (C) The Internet Society (2004). All Rights Reserved. 43 Abstract 45 This document defines the Extensible Authentication Protocol (EAP), 46 an authentication framework which supports multiple authentication 47 methods. EAP typically runs directly over data link layers such as 48 PPP or IEEE 802, without requiring IP. EAP provides its own support 49 for duplicate elimination and retransmission, but is reliant on lower 50 layer ordering guarantees. Fragmentation is not supported within EAP 51 itself; however, individual EAP methods may support this. 53 This document obsoletes RFC 2284. A summary of the changes between 54 this document and RFC 2284 is available in Appendix A. 56 Table of Contents 58 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4 59 1.1 Specification of Requirements . . . . . . . . . . . . 4 60 1.2 Terminology . . . . . . . . . . . . . . . . . . . . . 4 61 1.3 Applicability . . . . . . . . . . . . . . . . . . . . 7 62 2. Extensible Authentication Protocol (EAP) . . . . . . . . . . 8 63 2.1 Support for sequences . . . . . . . . . . . . . . . . 10 64 2.2 EAP multiplexing model . . . . . . . . . . . . . . . . 10 65 2.3 Pass-through behavior . . . . . . . . . . . . . . . . 12 66 2.4 Peer-to-Peer Operation . . . . . . . . . . . . . . . . 14 67 3. Lower layer behavior . . . . . . . . . . . . . . . . . . . . 16 68 3.1 Lower layer requirements . . . . . . . . . . . . . . . 16 69 3.2 EAP usage within PPP . . . . . . . . . . . . . . . . . 18 70 3.2.1 PPP Configuration Option Format . . . . . . . . 19 71 3.3 EAP usage within IEEE 802 . . . . . . . . . . . . . . 19 72 3.4 Lower layer indications . . . . . . . . . . . . . . . 19 73 4. EAP Packet format . . . . . . . . . . . . . . . . . . . . . 20 74 4.1 Request and Response . . . . . . . . . . . . . . . . . 21 75 4.2 Success and Failure . . . . . . . . . . . . . . . . . 24 76 4.3 Retransmission Behavior . . . . . . . . . . . . . . . 26 77 5. Initial EAP Request/Response Types . . . . . . . . . . . . . 27 78 5.1 Identity . . . . . . . . . . . . . . . . . . . . . . . 28 79 5.2 Notification . . . . . . . . . . . . . . . . . . . . . 29 80 5.3 Nak . . . . . . . . . . . . . . . . . . . . . . . . . 31 81 5.3.1 Legacy Nak . . . . . . . . . . . . . . . . . . . 31 82 5.3.2 Expanded Nak . . . . . . . . . . . . . . . . . . 32 83 5.4 MD5-Challenge . . . . . . . . . . . . . . . . . . . . 35 84 5.5 One-Time Password (OTP) . . . . . . . . . . . . . . . 36 85 5.6 Generic Token Card (GTC) . . . . . . . . . . . . . . . 38 86 5.7 Expanded Types . . . . . . . . . . . . . . . . . . . . 39 87 5.8 Experimental . . . . . . . . . . . . . . . . . . . . . 40 88 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . 41 89 6.1 Packet Codes . . . . . . . . . . . . . . . . . . . . . 42 90 6.2 Method Types . . . . . . . . . . . . . . . . . . . . . 42 91 7. Security Considerations . . . . . . . . . . . . . . . . . . 42 92 7.1 Threat model . . . . . . . . . . . . . . . . . . . . . 42 93 7.2 Security claims . . . . . . . . . . . . . . . . . . . 44 94 7.2.1 Security claims terminology for EAP methods . . 45 95 7.3 Identity protection . . . . . . . . . . . . . . . . . 47 96 7.4 Man-in-the-middle attacks . . . . . . . . . . . . . . 47 97 7.5 Packet modification attacks . . . . . . . . . . . . . 48 98 7.6 Dictionary attacks . . . . . . . . . . . . . . . . . . 49 99 7.7 Connection to an untrusted network . . . . . . . . . . 50 100 7.8 Negotiation attacks . . . . . . . . . . . . . . . . . 50 101 7.9 Implementation idiosyncrasies . . . . . . . . . . . . 51 102 7.10 Key derivation . . . . . . . . . . . . . . . . . . . . 51 103 7.11 Weak ciphersuites . . . . . . . . . . . . . . . . . . 53 104 7.12 Link layer . . . . . . . . . . . . . . . . . . . . . . 54 105 7.13 Separation of authenticator and backend authentication 106 server . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 107 7.14 Cleartext Passwords . . . . . . . . . . . . . . . . . 55 108 7.15 Channel binding . . . . . . . . . . . . . . . . . . . 56 109 7.16 Protected Result Indications . . . . . . . . . . . . . 57 110 8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . 59 111 Normative References . . . . . . . . . . . . . . . . . . . . 59 112 Informative References . . . . . . . . . . . . . . . . . . . 60 113 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 64 114 A. Changes from RFC 2284 . . . . . . . . . . . . . . . . . . . 65 115 B. Open issues . . . . . . . . . . . . . . . . . . . . . . . . 66 116 Intellectual Property and Copyright Statements . . . . . . . 68 118 1. Introduction 120 This document defines the Extensible Authentication Protocol (EAP), 121 an authentication framework which supports multiple authentication 122 methods. EAP typically runs directly over data link layers such as 123 PPP or IEEE 802, without requiring IP. EAP provides its own support 124 for duplicate elimination and retransmission, but is reliant on lower 125 layer ordering guarantees. Fragmentation is not supported within EAP 126 itself; however, individual EAP methods may support this. 128 EAP may be used on dedicated links as well as switched circuits, and 129 wired as well as wireless links. To date, EAP has been implemented 130 with hosts and routers that connect via switched circuits or dial-up 131 lines using PPP [RFC1661]. It has also been implemented with 132 switches and access points using IEEE 802 [IEEE-802]. EAP 133 encapsulation on IEEE 802 wired media is described in [IEEE-802.1X], 134 and encapsulation on IEEE wireless LANs in [IEEE-802.11i]. 136 One of the advantages of the EAP architecture is its flexibility. 137 EAP is used to select a specific authentication mechanism, typically 138 after the authenticator requests more information in order to 139 determine the specific authentication method to be used. Rather than 140 requiring the authenticator to be updated to support each new 141 authentication method, EAP permits the use of a backend 142 authentication server which may implement some or all authentication 143 methods, with the authenticator acting as a pass-through for some or 144 all methods and peers. 146 Within this document, authenticator requirements apply regardless of 147 whether the authenticator is operating as a pass-through or not. 148 Where the requirement is meant to apply to either the authenticator 149 or backend authentication server, depending on where the EAP 150 authentication is terminated, the term "EAP server" will be used. 152 1.1 Specification of Requirements 154 In this document, several words are used to signify the requirements 155 of the specification. These words are often capitalized. The key 156 words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", 157 "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document 158 are to be interpreted as described in [RFC2119]. 160 1.2 Terminology 162 This document frequently uses the following terms: 164 authenticator 165 The end of the link initiating EAP authentication. The 166 term Authenticator is used in [IEEE-802.1X], and 167 authenticator has the same meaning in this document. 169 peer 170 The end of the link that responds to the authenticator. In 171 [IEEE-802.1X], this end is known as the Supplicant. 173 Supplicant 174 The end of the link that responds to the authenticator in 175 [IEEE-802.1X]. In this document, this end of the link is 176 called the peer. 178 backend authentication server 179 A backend authentication server is an entity that provides 180 an authentication service to an authenticator. When used, 181 this server typically executes EAP methods for the 182 authenticator. This terminology is also used in 183 [IEEE-802.1X]. 185 AAA 186 Authentication, Authorization and Accounting. AAA 187 protocols with EAP support include RADIUS [RFC3579] and 188 Diameter [DIAM-EAP]. In this document, the terms "AAA 189 server" and "backend authentication server" are used 190 interchangeably. 192 Displayable Message 193 This is interpreted to be a human readable string of 194 characters. The message encoding MUST follow the UTF-8 195 transformation format [RFC2279]. 197 EAP server 198 The entity that terminates the EAP authentication method 199 with the peer. In the case where no backend authentication 200 server is used, the EAP server is part of the 201 authenticator. In the case where the authenticator 202 operates in pass-through mode, the EAP server is located on 203 the backend authentication server. 205 Silently Discard 206 This means the implementation discards the packet without 207 further processing. The implementation SHOULD provide the 208 capability of logging the event, including the contents of 209 the silently discarded packet, and SHOULD record the event 210 in a statistics counter. 212 Successful authentication 213 In the context of this document, "successful 214 authentication" is an exchange of EAP messages, as a result 215 of which the authenticator decides to allow access by the 216 peer, and the peer decides to use this access. The 217 authenticator's decision typically involves both 218 authentication and authorization aspects; the peer may 219 successfully authenticate to the authenticator but access 220 may be denied by the authenticator due to policy reasons. 222 Message Integrity Check (MIC) 223 A keyed hash function used for authentication and integrity 224 protection of data. This is usually called a Message 225 Authentication Code (MAC), but IEEE 802 specifications (and 226 this document) use the acronym MIC to avoid confusion with 227 Medium Access Control. 229 Cryptographic separation 230 Two keys (x and y) are "cryptographically separate" if an 231 adversary that knows all messages exchanged in the protocol 232 cannot compute x from y or y from x without "breaking" some 233 cryptographic assumption. In particular, this definition 234 allows that the adversary has the knowledge of all nonces 235 sent in cleartext as well as all predictable counter values 236 used in the protocol. Breaking a cryptographic assumption 237 would typically require inverting a one-way function or 238 predicting the outcome of a cryptographic pseudo-random 239 number generator without knowledge of the secret state. In 240 other words, if the keys are cryptographically separate, 241 there is no shortcut to compute x from y or y from x, but 242 the work an adversary must do to perform this computation 243 is equivalent to performing exhaustive search for the 244 secret state value. 246 Master Session Key (MSK) 247 Keying material that is derived between the EAP peer and 248 server and exported by the EAP method. The MSK is at least 249 64 octets in length. In existing implementations a AAA 250 server acting as an EAP server transports the MSK to the 251 authenticator. 253 Extended Master Session Key (EMSK) 254 Additional keying material derived between the EAP client 255 and server that is exported by the EAP method. The EMSK is 256 at least 64 octets in length. The EMSK is not shared with 257 the authenticator or any other third party. The EMSK is 258 reserved for future uses that are not defined yet. 260 Result indications 261 A method provides result indications if after the method's 262 last message is sent and received: 264 1) The peer is aware of whether it has authenticated 265 the server, as well as whether the server has 266 authenticated it. 268 2) The server is aware of whether it has 269 authenticated the peer, as well as whether the 270 peer has authenticated it. 272 In the case where successful authentication is sufficient 273 to authorize access then the peer and authenticator will 274 also know if the other party is willing to provide or 275 accept access. This may not always be the case. An 276 authenticated peer may be denied access due to lack of 277 authorization (e.g. session limit) or other reasons. Since 278 the EAP exchange is run between the peer and the server, 279 other nodes (such as AAA proxies) may also affect the 280 authorization decision. This is discussed in more detail in 281 Section 7.16. 283 1.3 Applicability 285 EAP was designed for use in network access authentication, where IP 286 layer connectivity may not be available. Use of EAP for other 287 purposes, such as bulk data transport, is NOT RECOMMENDED. 289 Since EAP does not require IP connectivity, it provides just enough 290 support for the reliable transport of authentication protocols, and 291 no more. 293 EAP is a lock-step protocol which only supports a single packet in 294 flight. As a result EAP cannot efficiently transport bulk data, 295 unlike transport protocols such as TCP [RFC793] or SCTP [RFC2960]. 297 While EAP provides support for retransmission, it assumes ordering 298 guarantees provided by the lower layer, so out of order reception is 299 not supported. 301 Since EAP does not support fragmentation and reassembly, EAP 302 authentication methods generating payloads larger than the minimum 303 EAP MTU need to provide fragmentation support. 305 While authentication methods such as EAP-TLS [RFC2716] provide 306 support for fragmentation and reassembly, the EAP methods defined in 307 this document do not. As a result, if the EAP packet size exceeds 308 the EAP MTU of the link, these methods will encounter difficulties. 310 EAP authentication is initiated by the server (authenticator), 311 whereas many authentication protocols are initiated by the client 312 (peer). As a result, it may be necessary for an authentication 313 algorithm to add one or two additional messages (at most one 314 roundtrip) in order to run over EAP. 316 Where certificate-based authentication is supported, the number of 317 additional roundtrips may be much larger due to fragmentation of 318 certificate chains. In general, a fragmented EAP packet will require 319 as many round-trips to send as there are fragments. For example, a 320 certificate chain 14960 octets in size would require ten round-trips 321 to send with a 1496 octet EAP MTU. 323 Where EAP runs over a lower layer in which significant packet loss is 324 experienced, or where the connection between the authenticator and 325 authentication server experiences significant packet loss, EAP 326 methods requiring many round-trips can experience difficulties. In 327 these situations, use of EAP methods with fewer roundtrips is 328 advisable. 330 2. Extensible Authentication Protocol (EAP) 332 The EAP authentication exchange proceeds as follows: 334 [1] The authenticator sends a Request to authenticate the peer. The 335 Request has a Type field to indicate what is being requested. 336 Examples of Request Types include Identity, MD5-challenge, etc. 337 The MD5-challenge Type corresponds closely to the CHAP 338 authentication protocol [RFC1994]. Typically, the authenticator 339 will send an initial Identity Request; however, an initial 340 Identity Request is not required, and MAY be bypassed. For 341 example, the identity may not be required where it is determined 342 by the port to which the peer has connected (leased lines, 343 dedicated switch or dial-up ports); or where the identity is 344 obtained in another fashion (via calling station identity or MAC 345 address, in the Name field of the MD5-Challenge Response, etc.). 347 [2] The peer sends a Response packet in reply to a valid Request. As 348 with the Request packet the Response packet contains a Type 349 field, which corresponds to the Type field of the Request. 351 [3] The authenticator sends an additional Request packet, and the 352 peer replies with a Response. The sequence of Requests and 353 Responses continues as long as needed. EAP is a 'lock step' 354 protocol, so that other than the initial Request, a new Request 355 cannot be sent prior to receiving a valid Response. The 356 authenticator is responsible for retransmitting requests as 357 described in Section 4.1. After a suitable number of 358 retransmissions, the authenticator SHOULD end the EAP 359 conversation. The authenticator MUST NOT send a Success or 360 Failure packet when retransmitting or when it fails to get a 361 response from the peer. 363 [4] The conversation continues until the authenticator cannot 364 authenticate the peer (unacceptable Responses to one or more 365 Requests), in which case the authenticator implementation MUST 366 transmit an EAP Failure (Code 4). Alternatively, the 367 authentication conversation can continue until the authenticator 368 determines that successful authentication has occurred, in which 369 case the authenticator MUST transmit an EAP Success (Code 3). 371 Advantages: 373 o The EAP protocol can support multiple authentication mechanisms 374 without having to pre-negotiate a particular one. 376 o Network Access Server (NAS) devices (e.g., a switch or access 377 point) do not have to understand each authentication method and 378 MAY act as a pass-through agent for a backend authentication 379 server. Support for pass-through is optional. An authenticator 380 MAY authenticate local peers while at the same time acting as a 381 pass-through for non-local peers and authentication methods it 382 does not implement locally. 384 o Separation of the authenticator from the backend authentication 385 server simplifies credentials management and policy decision 386 making. 388 Disadvantages: 390 o For use in PPP, EAP does require the addition of a new 391 authentication Type to PPP LCP and thus PPP implementations will 392 need to be modified to use it. It also strays from the previous 393 PPP authentication model of negotiating a specific authentication 394 mechanism during LCP. Similarly, switch or access point 395 implementations need to support [IEEE-802.1X] in order to use EAP. 397 o Where the authenticator is separate from the backend 398 authentication server, this complicates the security analysis and, 399 if needed, key distribution. 401 2.1 Support for sequences 403 An EAP conversation MAY utilize a sequence of methods. A common 404 example of this is an Identity request followed by a single EAP 405 authentication method such as an MD5-Challenge. However the peer and 406 authenticator MUST utilize only one authentication method (Type 4 or 407 greater) within an EAP conversation, after which the authenticator 408 MUST send a Success or Failure packet. 410 Once a peer has sent a Response of the same Type as the initial 411 Request, an authenticator MUST NOT send a Request of a different Type 412 prior to completion of the final round of a given method (with the 413 exception of a Notification-Request) and MUST NOT send a Request for 414 an additional method of any Type after completion of the initial 415 authentication method; a peer receiving such Requests MUST treat them 416 as invalid, and silently discard them. As a result, Identity Requery 417 is not supported. 419 A peer MUST NOT send a Nak (legacy or expanded) in reply to a 420 Request, after an initial non-Nak Response has been sent. Since 421 spoofed EAP Request packets may be sent by an attacker, an 422 authenticator receiving an unexpected Nak SHOULD discard it and log 423 the event. 425 Multiple authentication methods within an EAP conversation are not 426 supported due to their vulnerability to man-in-the-middle attacks 427 (see Section 7.4) and incompatibility with existing implementations. 429 Where a single EAP authentication method is utilized, but other 430 methods are run within it (a "tunneled" method) the prohibition 431 against multiple authentication methods does not apply. Such 432 "tunneled" methods appear as a single authentication method to EAP. 433 Backward compatibility can be provided, since a peer not supporting a 434 "tunneled" method can reply to the initial EAP-Request with a Nak 435 (legacy or expanded). To address security vulnerabilities, 436 "tunneled" methods MUST support protection against man-in-the-middle 437 attacks. 439 2.2 EAP multiplexing model 441 Conceptually, EAP implementations consist of the following 442 components: 444 [a] Lower layer. The lower layer is responsible for transmitting and 445 receiving EAP frames between the peer and authenticator. EAP has 446 been run over a variety of lower layers including PPP; wired IEEE 447 802 LANs [IEEE-802.1X] ; IEEE 802.11 wireless LANs [IEEE-802.11]; 448 UDP ( L2TP [RFC2661] and IKEv2 [IKEv2]); and TCP [PIC]. Lower 449 layer behavior is discussed in Section 3. 451 [b] EAP layer. The EAP layer receives and transmits EAP packets via 452 the lower layer, implements duplicate detection and 453 retransmission, and delivers and receives EAP messages to and 454 from the EAP peer and authenticator layers. 456 [c] EAP peer and authenticator layers. Based on the Code field, the 457 EAP layer demultiplexes incoming EAP packets to the EAP peer and 458 authenticator layers. Typically an EAP implementation on a given 459 host will support either peer or authenticator functionality, but 460 it is possible for a host to act as both an EAP peer and 461 authenticator. In such an implementation both EAP peer and 462 authenticator layers will be present. 464 [d] EAP method layers. EAP methods implement the authentication 465 algorithms and receive and transmit EAP messages via the EAP peer 466 and authenticator layers. Since fragmentation support is not 467 provided by EAP itself, this is the responsibility of EAP 468 methods, which are discussed in Section 5. 470 The EAP multiplexing model is illustrated in Figure 1 below. Note 471 that there is no requirement that an implementation conform to this 472 model, as long as the on-the-wire behavior is consistent with it. 474 +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ 475 | | | | | | 476 | EAP method| EAP method| | EAP method| EAP method| 477 | Type = X | Type = Y | | Type = X | Type = Y | 478 | V | | | ^ | | 479 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 480 | ! | | ! | 481 | EAP ! Peer layer | | EAP ! Auth. layer | 482 | ! | | ! | 483 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 484 | ! | | ! | 485 | EAP ! layer | | EAP ! layer | 486 | ! | | ! | 487 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 488 | ! | | ! | 489 | Lower ! layer | | Lower ! layer | 490 | ! | | ! | 491 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 492 ! ! 493 ! Peer ! Authenticator 494 +------------>-------------+ 495 Figure 1: EAP Multiplexing Model 497 Within EAP, the Code field functions much like a protocol number in 498 IP. It is assumed that the EAP layer demultiplexes incoming EAP 499 packets according to the Code field. Received EAP packets with 500 Code=1 (Request), 3 (Success) and 4 (Failure) are delivered by the 501 EAP layer to the EAP peer layer, if implemented. EAP packets with 502 Code=2 (Response) are delivered to the EAP authenticator layer, if 503 implemented. 505 Within EAP, the Type field functions much like a port number in UDP 506 or TCP. It is assumed that the EAP peer and authenticator layers 507 demultiplex incoming EAP packets according to their Type, and deliver 508 them only to the EAP method corresponding to that Type. An EAP 509 method implementation on a host may register to receive packets from 510 the peer or authenticator layers, or both, depending on which role(s) 511 it supports. 513 Since EAP authentication methods may wish to access the Identity, 514 implementations SHOULD make the Identity Request and Response 515 accessible to authentication methods (Types 4 or greater) in addition 516 to the Identity method. The Identity Type is discussed in Section 517 5.1. 519 A Notification Response is only used as confirmation that the peer 520 received the Notification Request, not that it has processed it, or 521 displayed the message to the user. It cannot be assumed that the 522 contents of the Notification Request or Response is available to 523 another method. The Notification Type is discussed in Section 5.2. 525 Nak (Type 3) or Expanded Nak (Type 254) are utilized for the purposes 526 of method negotiation. Peers respond to an initial EAP Request for 527 an unacceptable Type with a Nak Response (Type 3) or Expanded Nak 528 Response (Type 254). It cannot be assumed that the contents of the 529 Nak Response(s) are available to another method. The Nak Type(s) are 530 discussed in Section 5.3. 532 EAP packets with Codes of Success or Failure do not include a Type 533 field, and are not delivered to an EAP method. Success and Failure 534 are discussed in Section 4.2. 536 Given these considerations, the Success, Failure, Nak Response(s) and 537 Notification Request/Response messages MUST NOT be used to carry data 538 destined for delivery to other EAP methods. 540 2.3 Pass-through behavior 542 When operating as a "pass-through authenticator", an authenticator 543 performs checks on the Code, Identifier and Length fields as 544 described in Section 4.1. It forwards EAP packets received from the 545 peer and destined to its authenticator layer to the backend 546 authentication server; packets received from the backend 547 authentication server destined to the peer are forwarded to it. 549 A host receiving an EAP packet may only do one of three things with 550 it: act on it, drop it, or forward it. The forwarding decision is 551 typically based only on examination of the Code, Identifier and 552 Length fields. A pass-through authenticator implementation MUST be 553 capable of forwarding to the backend authentication server EAP 554 packets received from the peer with Code=2 (Response). It also MUST 555 be capable of receiving EAP packets from the backend authentication 556 server and forwarding EAP packets of Code=1 (Request), Code=3 557 (Success), and Code=4 (Failure) to the peer. 559 Unless the authenticator implements one or more authentication 560 methods locally which support the authenticator role, the EAP method 561 layer header fields (Type, Type-Data) are not examined as part of the 562 forwarding decision. Where the authenticator supports local 563 authentication methods, it MAY examine the Type field to determine 564 whether to act on the packet itself or forward it. Compliant 565 pass-through authenticator implementations MUST by default forward 566 EAP packets of any Type. 568 EAP packets received with Code=1 (Request), Code=3 (Success), and 569 Code=4 (Failure) are demultiplexed by the EAP layer and delivered to 570 the peer layer. Therefore unless a host implements an EAP peer 571 layer, these packets will be silently discarded. Similarly, EAP 572 packets received with Code=2 (Response) are demultiplexed by the EAP 573 layer and delivered to the authenticator layer. Therefore unless a 574 host implements an EAP authenticator layer, these packets will be 575 silently discarded. The behavior of a "pass-through peer" is 576 undefined within this specification, and is unsupported by AAA 577 protocols such as RADIUS [RFC3579] and Diameter [DIAM-EAP]. 579 The forwarding model is illustrated in Figure 2. 581 Peer Pass-through Authenticator Authentication 582 Server 584 +-+-+-+-+-+-+ +-+-+-+-+-+-+ 585 | | | | 586 |EAP method | |EAP method | 587 | V | | ^ | 588 +-+-+-!-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-!-+-+-+ 589 | ! | |EAP | EAP | | | ! | 590 | ! | |Peer | Auth.| EAP Auth. | | ! | 591 |EAP ! peer| | | +-----------+ | |EAP !Auth.| 592 | ! | | | ! | ! | | ! | 593 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+ 594 | ! | | ! | ! | | ! | 595 |EAP !layer| | EAP !layer| EAP !layer | |EAP !layer| 596 | ! | | ! | ! | | ! | 597 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+ 598 | ! | | ! | ! | | ! | 599 |Lower!layer| | Lower!layer| AAA ! /IP | | AAA ! /IP | 600 | ! | | ! | ! | | ! | 601 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+ 602 ! ! ! ! 603 ! ! ! ! 604 +-------->--------+ +--------->-------+ 606 Figure 2: Pass-through Authenticator 608 For sessions in which the authenticator acts as a pass-through, it 609 MUST determine the outcome of the authentication solely based on the 610 Accept/Reject indication sent by the backend authentication server; 611 the outcome MUST NOT be determined by the contents of an EAP packet 612 sent along with the Accept/Reject indication, or the absence of such 613 an encapsulated EAP packet. 615 2.4 Peer-to-Peer Operation 617 Since EAP is a peer-to-peer protocol, an independent and simultaneous 618 authentication may take place in the reverse direction (depending on 619 the capabilities of the lower layer). Both ends of the link may act 620 as authenticators and peers at the same time. In this case it is 621 necessary for both ends to implement EAP authenticator and peer 622 layers. In addition, the EAP method implementations on both peers 623 must support both authenticator and peer functionality. 625 Although EAP supports peer-to-peer operation, some EAP 626 implementations, methods, AAA protocols and link layers may not 627 support this. Some EAP methods may support asymmetric 628 authentication, with one type of credential being required for the 629 peer and another type for the authenticator. Hosts supporting 630 peer-to-peer operation with such a method would need to be 631 provisioned with both types of credentials. 633 For example, EAP-TLS [RFC2716] is a client-server protocol in which 634 distinct certificate profiles are typically utilized for the client 635 and server. This implies that a host supporting peer-to-peer 636 authentication with EAP-TLS would need to implement both the EAP peer 637 and authenticator layers; support both peer and authenticator roles 638 in the EAP-TLS implementation; and provision certificates appropriate 639 for each role. 641 AAA protocols such as RADIUS/EAP [RFC3579] and Diameter EAP 642 [DIAM-EAP] only support "pass-through authenticator" operation. As 643 noted in [RFC3579] Section 2.6.2, a RADIUS server responds to an 644 Access-Request encapsulating an EAP-Request, Success or Failure 645 packet with an Access-Reject. There is therefore no support for 646 "pass-through peer" operation. 648 Even where a method is used which supports mutual authentication and 649 protected result indications, several considerations may dictate that 650 two EAP authentications, (one in each direction) are required. These 651 include: 653 [1] Support for bi-directional session key derivation in the lower 654 layer. Lower layers such as IEEE 802.11 may only support 655 uni-directional derivation and transport of transient session 656 keys. For example, the group-key handshake defined in 657 [IEEE-802.11i] is uni-directional, since in IEEE 802.11 658 infrastructure mode only the Access Point (AP) sends multicast/ 659 broadcast traffic. In IEEE 802.11 ad hoc mode where either peer 660 may send multicast/broadcast traffic, two uni-directional 661 group-key exchanges are required. Due to limitations of the 662 design, this also implies the need for unicast key derivations 663 and EAP method exchanges to occur in each direction. 665 [2] Support for tie-breaking in the lower layer. Lower layers such 666 as IEEE 802.11 ad hoc do not support "tie breaking" wherein two 667 hosts initiating authentication with each other will only go 668 forward with a single authentication. This implies that even if 669 802.11 were to support a bi-directional group-key handshake, then 670 two authentications, one in each direction, might still occur. 672 [3] Peer policy satisfaction. EAP methods may support protected 673 result indications, enabling the peer to indicate to the EAP 674 server within the method that it successfully authenticated the 675 EAP server, as well as for the server to indicate that it has 676 authenticated the peer. However, a pass-through authenticator 677 will not be aware that the peer has accepted the credentials 678 offered by the EAP server, unless this information is provided to 679 the authenticator via the AAA protocol. The authenticator SHOULD 680 interpret the receipt of a key attribute within an Accept packet 681 as an indication that the peer has successfully authenticated the 682 server. 684 However, it is possible that the EAP peer's access policy was not 685 satisfied during the initial EAP exchange, even though mutual 686 authentication occurred. For example, the EAP authenticator may 687 not have demonstrated authorization to act in both peer and 688 authenticator roles. As a result, the peer may require an 689 additional authentication in the reverse direction, even if the 690 peer provided an indication that the EAP server had successfully 691 authenticated to it. 693 3. Lower layer behavior 695 3.1 Lower layer requirements 697 EAP makes the following assumptions about lower layers: 699 [1] Unreliable transport. In EAP, the authenticator retransmits 700 Requests that have not yet received Responses, so that EAP does 701 not assume that lower layers are reliable. Since EAP defines its 702 own retransmission behavior, it is possible (though undesirable) 703 for retransmission to occur both in the lower layer and the EAP 704 layer when EAP is run over a reliable lower layer. 706 Note that EAP Success and Failure packets are not retransmitted. 707 Without a reliable lower layer, and a non-negligible error rate, 708 these packets can be lost, resulting in timeouts. It is 709 therefore desirable for implementations to improve their 710 resilience to loss of EAP Success or Failure packets, as 711 described in Section 4.2. 713 [2] Lower layer error detection. While EAP does not assume that the 714 lower layer is reliable, it does rely on lower layer error 715 detection (e.g., CRC, Checksum, MIC, etc.). EAP methods may not 716 include a MIC, or if they do, it may not be computed over all the 717 fields in the EAP packet, such as the Code, Identifier, Length or 718 Type fields. As a result, without lower layer error detection, 719 undetected errors could creep into the EAP layer or EAP method 720 layer header fields, resulting in authentication failures. 722 For example, EAP TLS [RFC2716], which computes its MIC over the 723 Type-Data field only, regards MIC validation failures as a fatal 724 error. Without lower layer error detection, this method and 725 others like it will not perform reliably. 727 [3] Lower layer security. EAP does not require lower layers to 728 provide security services such as per-packet confidentiality, 729 authentication, integrity and replay protection. However, where 730 these security services are available, EAP methods supporting Key 731 Derivation (see Section 7.2.1) can be used to provide dynamic 732 keying material. This makes it possible to bind the EAP 733 authentication to subsequent data and protect against data 734 modification, spoofing or replay. See Section 7.1 for details. 736 [4] Minimum MTU. EAP is capable of functioning on lower layers that 737 provide an EAP MTU size of 1020 octets or greater. 739 EAP does not support path MTU discovery, and fragmentation and 740 reassembly is not supported by EAP, nor by the methods defined in 741 this specification: the Identity (1), Notification (2), Nak 742 Response (3), MD5-Challenge (4), One Time Password (5), Generic 743 Token Card (6) and expanded Nak Response (254) Types. 745 Typically, the EAP peer obtains information on the EAP MTU from 746 the lower layers and sets the EAP frame size to an appropriate 747 value. Where the authenticator operates in pass-through mode, 748 the authentication server does not have a direct way of 749 determining the EAP MTU, and therefore relies on the 750 authenticator to provide it with this information, such as via 751 the Framed-MTU attribute, as described in [RFC3579], Section 2.4. 753 While methods such as EAP-TLS [RFC2716] support fragmentation and 754 reassembly, EAP methods originally designed for use within PPP 755 where a 1500 octet MTU is guaranteed for control frames (see 756 [RFC1661], Section 6.1) may lack fragmentation and reassembly 757 features. 759 EAP methods can assume a minimum EAP MTU of 1020 octets, in the 760 absence of other information. EAP methods SHOULD include support 761 for fragmentation and reassembly if their payloads can be larger 762 than this minimum EAP MTU. 764 EAP is a lock-step protocol, which implies a certain inefficiency 765 when handling fragmentation and reassembly. Therefore if the 766 lower layer supports fragmentation and reassembly (such as where 767 EAP is transported over IP), it may be preferable for 768 fragmentation and reassembly to occur in the lower layer rather 769 than in EAP. This can be accomplished by providing an 770 artificially large EAP MTU to EAP, causing fragmentation and 771 reassembly to be handled within the lower layer. 773 [5] Possible duplication. Where the lower layer is reliable, it will 774 provide the EAP layer with a non-duplicated stream of packets. 775 However, while it is desirable that lower layers provide for 776 non-duplication, this is not a requirement. The Identifier field 777 provides both the peer and authenticator with the ability to 778 detect duplicates. 780 [6] Ordering guarantees. EAP does not require the Identifier to be 781 monotonically increasing, and so is reliant on lower layer 782 ordering guarantees for correct operation. EAP was originally 783 defined to run on PPP, and [RFC1661] Section 1 has an ordering 784 requirement: 786 "The Point-to-Point Protocol is designed for simple links 787 which transport packets between two peers. These links 788 provide full-duplex simultaneous bi-directional operation, and 789 are assumed to deliver packets in order." 791 Lower layer transports for EAP MUST preserve ordering between a 792 source and destination, at a given priority level (the ordering 793 guarantee provided by [IEEE-802]). 795 Reordering, if it occurs, will typically result in an EAP 796 authentication failure, causing EAP authentication to be rerun. 797 In an environment in which reordering is likely, it is therefore 798 expected that EAP authentication failures will be common. It is 799 RECOMMENDED that EAP only be run over lower layers that provide 800 ordering guarantees; running EAP over raw IP or UDP transport is 801 NOT RECOMMENDED. Encapsulation of EAP within RADIUS [RFC3579] 802 satisfies ordering requirements, since RADIUS is a "lockstep" 803 protocol that delivers packets in order. 805 3.2 EAP usage within PPP 807 In order to establish communications over a point-to-point link, each 808 end of the PPP link first sends LCP packets to configure the data 809 link during Link Establishment phase. After the link has been 810 established, PPP provides for an optional Authentication phase before 811 proceeding to the Network-Layer Protocol phase. 813 By default, authentication is not mandatory. If authentication of 814 the link is desired, an implementation MUST specify the 815 Authentication Protocol Configuration Option during Link 816 Establishment phase. 818 If the identity of the peer has been established in the 819 Authentication phase, the server can use that identity in the 820 selection of options for the following network layer negotiations. 822 When implemented within PPP, EAP does not select a specific 823 authentication mechanism at PPP Link Control Phase, but rather 824 postpones this until the Authentication Phase. This allows the 825 authenticator to request more information before determining the 826 specific authentication mechanism. This also permits the use of a 827 "backend" server which actually implements the various mechanisms 828 while the PPP authenticator merely passes through the authentication 829 exchange. The PPP Link Establishment and Authentication phases, and 830 the Authentication Protocol Configuration Option, are defined in The 831 Point-to-Point Protocol (PPP) [RFC1661]. 833 3.2.1 PPP Configuration Option Format 835 A summary of the PPP Authentication Protocol Configuration Option 836 format to negotiate EAP is shown below. The fields are transmitted 837 from left to right. 839 Exactly one EAP packet is encapsulated in the Information field of a 840 PPP Data Link Layer frame where the protocol field indicates type hex 841 C227 (PPP EAP). 843 0 1 2 3 844 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 845 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 846 | Type | Length | Authentication Protocol | 847 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 849 Type 851 3 853 Length 855 4 857 Authentication Protocol 859 C227 (Hex) for Extensible Authentication Protocol (EAP) 861 3.3 EAP usage within IEEE 802 863 The encapsulation of EAP over IEEE 802 is defined in [IEEE-802.1X]. 864 The IEEE 802 encapsulation of EAP does not involve PPP, and IEEE 865 802.1X does not include support for link or network layer 866 negotiations. As a result, within IEEE 802.1X it is not possible to 867 negotiate non-EAP authentication mechanisms, such as PAP or CHAP 868 [RFC1994]. 870 3.4 Lower layer indications 872 The reliability and security of lower layer indications is dependent 873 on the lower layer. Since EAP is media independent, the presence or 874 absence of lower layer security is not taken into account in the 875 processing of EAP messages. 877 To improve reliability, if a peer receives a lower layer success 878 indication as defined in Section 7.2, it MAY conclude that a Success 879 packet has been lost, and behave as if it had actually received a 880 Success packet. This includes choosing to ignore the Success in some 881 circumstances as described in Section 4.2. 883 A discussion of some reliability and security issues with lower layer 884 indications in PPP, IEEE 802 wired networks and IEEE 802.11 wireless 885 LANs can be found in the Security Considerations, Section 7.12. 887 After EAP authentication is complete, the peer will typically 888 transmit and receive data via the authenticator. It is desirable to 889 provide assurance that the entities transmitting data are the same 890 ones that successfully completed EAP authentication. To accomplish 891 this, it is necessary for the lower layer to provide per-packet 892 integrity, authentication and replay protection and to bind these 893 per-packet services to the keys derived during EAP authentication. 894 Otherwise it is possible for subsequent data traffic to be modified, 895 spoofed or replayed. 897 Where keying material for the lower layer ciphersuite is itself 898 provided by EAP, ciphersuite negotiation and key activation is 899 controlled by the lower layer. In PPP, ciphersuites are negotiated 900 within ECP so that it is not possible to use keys derived from EAP 901 authentication until the completion of ECP. Therefore an initial EAP 902 exchange cannot be protected by a PPP ciphersuite, although EAP 903 re-authentication can be protected. 905 In IEEE 802 media, initial key activation also typically occurs after 906 completion of EAP authentication. Therefore an initial EAP exchange 907 typically cannot be protected by the lower layer ciphersuite, 908 although an EAP re-authentication or pre-authentication exchange can 909 be protected. 911 4. EAP Packet format 913 A summary of the EAP packet format is shown below. The fields are 914 transmitted from left to right. 916 0 1 2 3 917 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 918 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 919 | Code | Identifier | Length | 920 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 921 | Data ... 922 +-+-+-+-+ 924 Code 926 The Code field is one octet and identifies the Type of EAP packet. 927 EAP Codes are assigned as follows: 929 1 Request 930 2 Response 931 3 Success 932 4 Failure 934 Since EAP only defines Codes 1-4, EAP packets with other codes 935 MUST be silently discarded by both authenticators and peers. 937 Identifier 939 The Identifier field is one octet and aids in matching Responses 940 with Requests. 942 Length 944 The Length field is two octets and indicates the length of the EAP 945 packet including the Code, Identifier, Length and Data fields. 946 Octets outside the range of the Length field should be treated as 947 Data Link Layer padding and MUST be ignored on reception. A 948 message with the Length field set to a value larger than the 949 number of received octets MUST be silently discarded. 951 Data 953 The Data field is zero or more octets. The format of the Data 954 field is determined by the Code field. 956 4.1 Request and Response 958 Description 960 The Request packet (Code field set to 1) is sent by the 961 authenticator to the peer. Each Request has a Type field which 962 serves to indicate what is being requested. Additional Request 963 packets MUST be sent until a valid Response packet is received, or 964 an optional retry counter expires. 966 Retransmitted Requests MUST be sent with the same Identifier value 967 in order to distinguish them from new Requests. The content of the 968 data field is dependent on the Request Type. The peer MUST send a 969 Response packet in reply to a valid Request packet. Responses 970 MUST only be sent in reply to a valid Request and never 971 retransmitted on a timer. 973 If a peer receives a valid duplicate Request for which it has 974 already sent a Response, it MUST resend its original Response 975 without reprocessing the Request. Requests MUST be processed in 976 the order that they are received, and MUST be processed to their 977 completion before inspecting the next Request. 979 A summary of the Request and Response packet format is shown below. 980 The fields are transmitted from left to right. 982 0 1 2 3 983 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 984 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 985 | Code | Identifier | Length | 986 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 987 | Type | Type-Data ... 988 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 990 Code 992 1 for Request 993 2 for Response 995 Identifier 997 The Identifier field is one octet. The Identifier field MUST be 998 the same if a Request packet is retransmitted due to a timeout 999 while waiting for a Response. Any new (non-retransmission) 1000 Requests MUST modify the Identifier field. 1002 The Identifier field of the Response MUST match that of the 1003 currently outstanding Request. An authenticator receiving a 1004 Response whose Identifier value does not match that of the 1005 currently outstanding Request MUST silently discard the Response. 1007 In order to avoid confusion between new Requests and 1008 retransmissions, the Identifier value chosen for each new Request 1009 need only be different from the previous Request, but need not be 1010 unique within the conversation. One way to achieve this is to 1011 start the Identifier at an initial value and increment it for each 1012 new Request. Initializing the first Identifier with a random 1013 number rather than starting from zero is recommended, since it 1014 makes sequence attacks somewhat harder. 1016 Since the Identifier space is unique to each session, 1017 authenticators are not restricted to only 256 simultaneous 1018 authentication conversations. Similarly, with re-authentication, 1019 an EAP conversation might continue over a long period of time, and 1020 is not limited to only 256 roundtrips. 1022 Implementation Note: The authenticator is responsible for 1023 retransmitting Request messages. If the Request message is 1024 obtained from elsewhere (such as from a backend authentication 1025 server), then the authenticator will need to save a copy of the 1026 Request in order to accomplish this. The peer is responsible 1027 for detecting and handling duplicate Request messages before 1028 processing them in any way, including passing them on to an 1029 outside party. The authenticator is also responsible for 1030 discarding Response messages with a non-matching Identifier 1031 value before acting on them in any way, including passing them 1032 on to the backend authentication server for verification. 1033 Since the authenticator can retransmit before receiving a 1034 Response from the peer, the authenticator can receive multiple 1035 Responses, each with a matching Identifier. Until a new Request 1036 is received by the authenticator, the Identifier value is not 1037 updated, so that the authenticator forwards Responses to the 1038 backend authentication server, one at a time. 1040 Length 1042 The Length field is two octets and indicates the length of the EAP 1043 packet including the Code, Identifier, Length, Type, and Type-Data 1044 fields. Octets outside the range of the Length field should be 1045 treated as Data Link Layer padding and MUST be ignored on 1046 reception. A message with the Length field set to a value larger 1047 than the number of received octets MUST be silently discarded. 1049 Type 1051 The Type field is one octet. This field indicates the Type of 1052 Request or Response. A single Type MUST be specified for each EAP 1053 Request or Response. An initial specification of Types follows in 1054 Section 5 of this document. 1056 The Type field of a Response MUST either match that of the 1057 Request, or correspond to a legacy or Expanded Nak (see Section 1058 5.3) indicating that a Request Type is unacceptable to the peer. 1059 A peer MUST NOT send a Nak (legacy or expanded) in response to a 1060 Request, after an initial non-Nak Response has been sent. An EAP 1061 server receiving a Response not meeting these requirements MUST 1062 silently discard it. 1064 Type-Data 1066 The Type-Data field varies with the Type of Request and the 1067 associated Response. 1069 4.2 Success and Failure 1071 The Success packet is sent by the authenticator to the peer after 1072 completion of an EAP authentication method (Type 4 or greater), to 1073 indicate that the peer has authenticated successfully to the 1074 authenticator. The authenticator MUST transmit an EAP packet with 1075 the Code field set to 3 (Success). If the authenticator cannot 1076 authenticate the peer (unacceptable Responses to one or more 1077 Requests) then after unsuccessful completion of the EAP method in 1078 progress, the implementation MUST transmit an EAP packet with the 1079 Code field set to 4 (Failure). An authenticator MAY wish to issue 1080 multiple Requests before sending a Failure response in order to allow 1081 for human typing mistakes. Success and Failure packets MUST NOT 1082 contain additional data. 1084 Success and Failure packets MUST NOT be sent by an EAP authenticator 1085 if the specification of the given method does not explicitly permit 1086 the method to finish at that point. A peer EAP implementation 1087 receiving a Success or Failure packet where sending one is not 1088 explicitly permitted MUST silently discard it. By default, an EAP 1089 peer MUST silently discard a "canned" Success packet (a Success 1090 packet sent immediately upon connection). This ensures that a rogue 1091 authenticator will not be able to bypass mutual authentication by 1092 sending a Success packet prior to conclusion of the EAP method 1093 conversation. 1095 Implementation Note: Because the Success and Failure packets are 1096 not acknowledged, they are not retransmitted by the authenticator, 1097 and may be potentially lost. A peer MUST allow for this 1098 circumstance as described in this note. See also Section 3.4 for 1099 guidance on the processing of lower layer success and failure 1100 indications. 1102 As described in Section 2.1, only a single EAP authentication 1103 method is allowed within an EAP conversation. EAP methods may 1104 implement method-specific result indications. After the 1105 authenticator sends a method-specific failure indication to the 1106 peer, regardless of the response from the peer, it MUST 1107 subsequently send a Failure packet. After the authenticator sends 1108 a method-specific success indication to the peer, and receives a 1109 method-specific success indication from the peer, it MUST 1110 subsequently send a Success packet. 1112 On the peer, once the method completes unsuccessfully (that is, 1113 either the authenticator sends a method-specific failure 1114 indication, or the peer decides that it does not want to continue 1115 the conversation, possibly after sending a method-specific failure 1116 indication), the peer MUST terminate the conversation and indicate 1117 failure to the lower layer. The peer MUST silently discard 1118 Success packets and MAY silently discard Failure packets. As a 1119 result, loss of a Failure packet need not result in a timeout. 1121 On the peer, after protected successful result indications have 1122 been exchanged by both sides, a Failure packet MUST be silently 1123 discarded. The peer MAY, in the event that an EAP Success is not 1124 received, conclude that the EAP Success packet was lost and that 1125 authentication concluded successfully. 1127 If the authenticator has not sent a method-specific result 1128 indication, and the peer is willing to continue the conversation, 1129 once the method completes the peer waits for a Success or Failure 1130 packet and MUST NOT silently discard either of them. In the event 1131 that neither a Success nor Failure packet is received, the peer 1132 SHOULD terminate the conversation to avoid lengthy timeouts in 1133 case the lost packet was an EAP Failure. 1135 If the peer attempts to authenticate to the authenticator and 1136 fails to do so, the authenticator MUST send a Failure packet and 1137 MUST NOT grant access by sending a Success packet. However, an 1138 authenticator MAY omit having the peer authenticate to it in 1139 situations where limited access is offered (e.g., guest access). 1140 In this case the authenticator MUST send a Success packet. 1142 Where the peer authenticates successfully to the authenticator, 1143 but the authenticator does not send a method-specific result 1144 indication the authenticator MAY deny access by sending a Failure 1145 packet where the peer is not currently authorized for network 1146 access. 1148 A summary of the Success and Failure packet format is shown below. 1149 The fields are transmitted from left to right. 1151 0 1 2 3 1152 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1153 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1154 | Code | Identifier | Length | 1155 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1157 Code 1159 3 for Success 1160 4 for Failure 1162 Identifier 1164 The Identifier field is one octet and aids in matching replies to 1165 Responses. The Identifier field MUST match the Identifier field 1166 of the Response packet that it is sent in response to. 1168 Length 1170 4 1172 4.3 Retransmission Behavior 1174 Because the authentication process will often involve user input, 1175 some care must be taken when deciding upon retransmission strategies 1176 and authentication timeouts. By default, where EAP is run over an 1177 unreliable lower layer, the EAP retransmission timer SHOULD be 1178 dynamically estimated. A maximum of 3-5 retransmissions is 1179 suggested. 1181 When run over a reliable lower layer (e.g., EAP over ISAKMP/TCP, as 1182 within [PIC]), the authenticator retransmission timer SHOULD be set 1183 to an infinite value, so that retransmissions do not occur at the EAP 1184 layer. The peer may still maintain a timeout value so as to avoid 1185 waiting indefinitely for a Request. 1187 Where the authentication process requires user input, the measured 1188 round trip times may be determined by user responsiveness rather than 1189 network characteristics, so that dynamic RTO estimation may not be 1190 helpful. Instead, the retransmission timer SHOULD be set so as to 1191 provide sufficient time for the user to respond, with longer timeouts 1192 required in certain cases, such as where Token Cards (see Section 1193 5.6) are involved. 1195 In order to provide the EAP authenticator with guidance as to the 1196 appropriate timeout value, a hint can be communicated to the 1197 authenticator by the backend authentication server (such as via the 1198 RADIUS Session-Timeout attribute). 1200 In order to dynamically estimate the EAP retransmission timer, the 1201 algorithms for estimation of SRTT, RTTVAR and RTO described in 1203 [RFC2988] are RECOMMENDED, including use of Karn's algorithm, with 1204 the following potential modifications: 1206 [a] In order to avoid synchronization behaviors that can occur with 1207 fixed timers among distributed systems, the retransmission timer 1208 is calculated with a jitter by using the RTO value and randomly 1209 adding a value drawn between -RTOmin/2 and RTOmin/2. Alternative 1210 calculations to create jitter MAY be used. These MUST be 1211 pseudo-random. For a discussion of pseudo-random number 1212 generation, see [RFC1750]. 1214 [b] When EAP is transported over a single link (as opposed to over 1215 the Internet), smaller values of RTOinitial, RTOmin and RTOmax 1216 MAY be used. Recommended values are RTOinitial=1 second, 1217 RTOmin=200ms, RTOmax=20 seconds. 1219 [c] When EAP is transported over a single link (as opposed to over 1220 the Internet), estimates MAY be done on a per-authenticator 1221 basis, rather than a per-session basis. This enables the 1222 retransmission estimate to make the most use of information on 1223 link-layer behavior. 1225 [d] An EAP implementation MAY clear SRTT and RTTVAR after backing off 1226 the timer multiple times as it is likely that the current SRTT 1227 and RTTVAR are bogus in this situation. Once SRTT and RTTVAR are 1228 cleared they should be initialized with the next RTT sample taken 1229 as described in [RFC2988] equation 2.2. 1231 5. Initial EAP Request/Response Types 1233 This section defines the initial set of EAP Types used in Request/ 1234 Response exchanges. More Types may be defined in follow-on 1235 documents. The Type field is one octet and identifies the structure 1236 of an EAP Request or Response packet. The first 3 Types are 1237 considered special case Types. 1239 The remaining Types define authentication exchanges. Nak (Type 3) or 1240 Expanded Nak (Type 254) are valid only for Response packets, they 1241 MUST NOT be sent in a Request. 1243 All EAP implementations MUST support Types 1-4, which are defined in 1244 this document, and SHOULD support Type 254. Implementations MAY 1245 support other Types defined here or in future RFCs. 1247 1 Identity 1248 2 Notification 1249 3 Nak (Response only) 1250 4 MD5-Challenge 1251 5 One Time Password (OTP) 1252 6 Generic Token Card (GTC) 1253 254 Expanded Types 1254 255 Experimental use 1256 EAP methods MAY support authentication based on shared secrets. If 1257 the shared secret is a passphrase entered by the user, 1258 implementations MAY support entering passphrases with non-ASCII 1259 characters. In this case, the input should be processed using an 1260 appropriate stringprep [RFC3454] profile, and encoded in octets using 1261 UTF-8 encoding [RFC2279]. A preliminary version of a possible 1262 stringprep profile is described in [SASLPREP]. 1264 5.1 Identity 1266 Description 1268 The Identity Type is used to query the identity of the peer. 1269 Generally, the authenticator will issue this as the initial 1270 Request. An optional displayable message MAY be included to 1271 prompt the peer in the case where there is an expectation of 1272 interaction with a user. A Response of Type 1 (Identity) SHOULD 1273 be sent in Response to a Request with a Type of 1 (Identity). 1275 Some EAP implementations piggy-back various options into the 1276 Identity Request after a NUL-character. By default an EAP 1277 implementation SHOULD NOT assume that an Identity Request or 1278 Response can be larger than 1020 octets. 1280 It is RECOMMENDED that the Identity Response be used primarily for 1281 routing purposes and selecting which EAP method to use. EAP 1282 Methods SHOULD include a method-specific mechanism for obtaining 1283 the identity, so that they do not have to rely on the Identity 1284 Response. Identity Requests and Responses are sent in cleartext, 1285 so an attacker may snoop on the identity, or even modify or spoof 1286 identity exchanges. To address these threats, it is preferable 1287 for an EAP method to include an identity exchange that supports 1288 per-packet authentication, integrity and replay protection and 1289 confidentiality. The Identity Response may not be the appropriate 1290 identity for the method; it may have been truncated or obfuscated 1291 so as to provide privacy; or it may have been decorated for 1292 routing purposes. Where the peer is configured to only accept 1293 authentication methods supporting protected identity exchanges, 1294 the peer MAY provide an abbreviated Identity Response (such as 1295 omitting the peer-name portion of the NAI [RFC2486]). For further 1296 discussion of identity protection, see Section 7.3. 1298 Implementation Note: The peer MAY obtain the Identity via user 1299 input. It is suggested that the authenticator retry the 1300 Identity Request in the case of an invalid Identity or 1301 authentication failure to allow for potential typos on the part 1302 of the user. It is suggested that the Identity Request be 1303 retried a minimum of 3 times before terminating the 1304 authentication. The Notification Request MAY be used to 1305 indicate an invalid authentication attempt prior to 1306 transmitting a new Identity Request (optionally, the failure 1307 MAY be indicated within the message of the new Identity Request 1308 itself). 1310 Type 1312 1 1314 Type-Data 1316 This field MAY contain a displayable message in the Request, 1317 containing UTF-8 encoded ISO 10646 characters [RFC2279]. Where 1318 the Request contains a null, only the portion of the field prior 1319 to the null is displayed. If the Identity is unknown, the 1320 Identity Response field should be zero bytes in length. The 1321 Identity Response field MUST NOT be null terminated. In all 1322 cases, the length of the Type-Data field is derived from the 1323 Length field of the Request/Response packet. 1325 Security Claims (see Section 7.2): 1327 Auth. mechanism: None 1328 Ciphersuite negotiation: No 1329 Mutual authentication: No 1330 Integrity protection: No 1331 Replay protection: No 1332 Confidentiality: No 1333 Key derivation: No 1334 Key strength: N/A 1335 Dictionary attack prot.: N/A 1336 Fast reconnect: No 1337 Crypt. binding: N/A 1338 Protected result ind.: No 1339 Session independence: N/A 1340 Fragmentation: No 1341 Channel binding: No 1343 5.2 Notification 1345 Description 1347 The Notification Type is optionally used to convey a displayable 1348 message from the authenticator to the peer. An authenticator MAY 1349 send a Notification Request to the peer at any time when there is 1350 no outstanding Request, prior to completion of an EAP 1351 authentication method. The peer MUST respond to a Notification 1352 Request with a Notification Response unless the EAP authentication 1353 method specification prohibits the use of Notification message. 1354 In any case, a Nak Response MUST NOT be sent in response to a 1355 Notification Request. Note that the default maximum length of a 1356 Notification Request is 1020 octets. By default, this leaves at 1357 most 1015 octets for the human readable message. 1359 An EAP method MAY indicate within its specification that 1360 Notification messages must not be sent during that method. In 1361 this case, the peer MUST silently discard Notification Requests 1362 from the point where an initial Request for that Type is answered 1363 with a Response of the same Type. 1365 The peer SHOULD display this message to the user or log it if it 1366 cannot be displayed. The Notification Type is intended to provide 1367 an acknowledged notification of some imperative nature, but it is 1368 not an error indication, and therefore does not change the state 1369 of the peer. Examples include a password with an expiration time 1370 that is about to expire, an OTP sequence integer which is nearing 1371 0, an authentication failure warning, etc. In most circumstances, 1372 Notification should not be required. 1374 Type 1376 2 1378 Type-Data 1380 The Type-Data field in the Request contains a displayable message 1381 greater than zero octets in length, containing UTF-8 encoded ISO 1382 10646 characters [RFC2279]. The length of the message is 1383 determined by Length field of the Request packet. The message 1384 MUST NOT be null terminated. A Response MUST be sent in reply to 1385 the Request with a Type field of 2 (Notification). The Type-Data 1386 field of the Response is zero octets in length. The Response 1387 should be sent immediately (independent of how the message is 1388 displayed or logged). 1390 Security Claims (see Section 7.2): 1392 Auth. mechanism: None 1393 Ciphersuite negotiation: No 1394 Mutual authentication: No 1395 Integrity protection: No 1396 Replay protection: No 1397 Confidentiality: No 1398 Key derivation: No 1399 Key strength: N/A 1400 Dictionary attack prot.: N/A 1401 Fast reconnect: No 1402 Crypt. binding: N/A 1403 Protected result ind.: No 1404 Session independence: N/A 1405 Fragmentation: No 1406 Channel binding: No 1408 5.3 Nak 1410 5.3.1 Legacy Nak 1412 Description 1414 The legacy Nak Type is valid only in Response messages. It is 1415 sent in reply to a Request where the desired authentication Type 1416 is unacceptable. Authentication Types are numbered 4 and above. 1417 The Response contains one or more authentication Types desired by 1418 the Peer. Type zero (0) is used to indicate that the sender has 1419 no viable alternatives, and therefore the authenticator SHOULD NOT 1420 send another Request after receiving a Nak Response containing a 1421 zero value. 1423 Since the legacy Nak Type is valid only in Responses and has very 1424 limited functionality, it MUST NOT be used as a general purpose 1425 error indication, such as for communication of error messages, or 1426 negotiation of parameters specific to a particular EAP method. 1428 Code 1430 2 for Response. 1432 Identifier 1434 The Identifier field is one octet and aids in matching Responses 1435 with Requests. The Identifier field of a legacy Nak Response MUST 1436 match the Identifier field of the Request packet that it is sent 1437 in response to. 1439 Length 1441 >=6 1443 Type 1445 3 1447 Type-Data 1449 Where a peer receives a Request for an unacceptable authentication 1450 Type (4-253,255), or a peer lacking support for Expanded Types 1451 receives a Request for Type 254, a Nak Response (Type 3) MUST be 1452 sent. The Type-Data field of the Nak Response (Type 3) MUST 1453 contain one or more octets indicating the desired authentication 1454 Type(s), one octet per Type, or the value zero (0) to indicate no 1455 proposed alternative. A peer supporting Expanded Types that 1456 receives a Request for an unacceptable authentication Type (4-253, 1457 255) MAY include the value 254 in the Nak Response (Type 3) in 1458 order to indicate the desire for an Expanded authentication Type. 1459 If the authenticator can accommodate this preference, it will 1460 respond with an Expanded Type Request (Type 254). 1462 Security Claims (see Section 7.2): 1464 Auth. mechanism: None 1465 Ciphersuite negotiation: No 1466 Mutual authentication: No 1467 Integrity protection: No 1468 Replay protection: No 1469 Confidentiality: No 1470 Key derivation: No 1471 Key strength: N/A 1472 Dictionary attack prot.: N/A 1473 Fast reconnect: No 1474 Crypt. binding: N/A 1475 Protected result ind.: No 1476 Session independence: N/A 1477 Fragmentation: No 1478 Channel binding: No 1480 5.3.2 Expanded Nak 1481 Description 1483 The Expanded Nak Type is valid only in Response messages. It MUST 1484 be sent only in reply to a Request of Type 254 (Expanded Type) 1485 where the authentication Type is unacceptable. The Expanded Nak 1486 Type uses the Expanded Type format itself, and the Response 1487 contains one or more authentication Types desired by the peer, all 1488 in Expanded Type format. Type zero (0) is used to indicate that 1489 the sender has no viable alternatives. The general format of the 1490 Expanded Type is described in Section 5.7. 1492 Since the Expanded Nak Type is valid only in Responses and has 1493 very limited functionality, it MUST NOT be used as a general 1494 purpose error indication, such as for communication of error 1495 messages, or negotiation of parameters specific to a particular 1496 EAP method. 1498 Code 1500 2 for Response. 1502 Identifier 1504 The Identifier field is one octet and aids in matching Responses 1505 with Requests. The Identifier field of an Expanded Nak Response 1506 MUST match the Identifier field of the Request packet that it is 1507 sent in response to. 1509 Length 1511 >=20 1513 Type 1515 254 1517 Vendor-Id 1519 0 (IETF) 1521 Vendor-Type 1523 3 (Nak) 1525 Vendor-Data 1527 The Expanded Nak Type is only sent when the Request contains an 1528 Expanded Type (254) as defined in Section 5.7. The Vendor-Data 1529 field of the Nak Response MUST contain one or more authentication 1530 Types (4 or greater), all in expanded format, 8 octets per Type, 1531 or the value zero (0), also in Expanded Type format, to indicate 1532 no proposed alternative. The desired authentication Types may 1533 include a mixture of Vendor-Specific and IETF Types. For example, 1534 an Expanded Nak Response indicating a preference for OTP (Type 5), 1535 and an MIT (Vendor-Id=20) Expanded Type of 6 would appear as 1536 follows: 1538 0 1 2 3 1539 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1540 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1541 | 2 | Identifier | Length=28 | 1542 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1543 | Type=254 | 0 (IETF) | 1544 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1545 | 3 (Nak) | 1546 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1547 | Type=254 | 0 (IETF) | 1548 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1549 | 5 (OTP) | 1550 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1551 | Type=254 | 20 (MIT) | 1552 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1553 | 6 | 1554 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1556 An Expanded Nak Response indicating a no desired alternative would 1557 appear as follows: 1559 0 1 2 3 1560 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1561 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1562 | 2 | Identifier | Length=20 | 1563 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1564 | Type=254 | 0 (IETF) | 1565 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1566 | 3 (Nak) | 1567 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1568 | Type=254 | 0 (IETF) | 1569 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1570 | 0 (No alternative) | 1571 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1573 Security Claims (see Section 7.2): 1575 Auth. mechanism: None 1576 Ciphersuite negotiation: No 1577 Mutual authentication: No 1578 Integrity protection: No 1579 Replay protection: No 1580 Confidentiality: No 1581 Key derivation: No 1582 Key strength: N/A 1583 Dictionary attack prot.: N/A 1584 Fast reconnect: No 1585 Crypt. binding: N/A 1586 Protected result ind.: No 1587 Session independence: N/A 1588 Fragmentation: No 1589 Channel binding: No 1591 5.4 MD5-Challenge 1593 Description 1595 The MD5-Challenge Type is analogous to the PPP CHAP protocol 1596 [RFC1994] (with MD5 as the specified algorithm). The Request 1597 contains a "challenge" message to the peer. A Response MUST be 1598 sent in reply to the Request. The Response MAY be either of Type 1599 4 (MD5-Challenge), Nak (Type 3) or Expanded Nak (Type 254). The 1600 Nak reply indicates the peer's desired authentication Type(s). 1601 EAP peer and EAP server implementations MUST support the 1602 MD5-Challenge mechanism. An authenticator that supports only 1603 pass-through MUST allow communication with a backend 1604 authentication server that is capable of supporting MD5-Challenge, 1605 although the EAP authenticator implementation need not support 1606 MD5-Challenge itself. However, if the EAP authenticator can be 1607 configured to authenticate peers locally (e.g., not operate in 1608 pass-through), then the requirement for support of the 1609 MD5-Challenge mechanism applies. 1611 Note that the use of the Identifier field in the MD5-Challenge 1612 Type is different from that described in [RFC1994]. EAP allows 1613 for retransmission of MD5-Challenge Request packets while 1614 [RFC1994] states that both the Identifier and Challenge fields 1615 MUST change each time a Challenge (the CHAP equivalent of the 1616 MD5-Challenge Request packet) is sent. 1618 Note: [RFC1994] treats the shared secret as an octet string, and 1619 does not specify how it is entered into the system (or if it is 1620 handled by the user at all). EAP MD5-Challenge implementations MAY 1621 support entering passphrases with non-ASCII characters. See 1622 Section 5 for instructions how the input should be processed and 1623 encoded into octets. 1625 Type 1627 4 1629 Type-Data 1631 The contents of the Type-Data field is summarized below. For 1632 reference on the use of these fields see the PPP Challenge 1633 Handshake Authentication Protocol [RFC1994]. 1635 0 1 2 3 1636 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1637 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1638 | Value-Size | Value ... 1639 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1640 | Name ... 1641 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1643 Security Claims (see Section 7.2): 1645 Auth. mechanism: Password or pre-shared key. 1646 Ciphersuite negotiation: No 1647 Mutual authentication: No 1648 Integrity protection: No 1649 Replay protection: No 1650 Confidentiality: No 1651 Key derivation: No 1652 Key strength: N/A 1653 Dictionary attack prot.: No 1654 Fast reconnect: No 1655 Crypt. binding: N/A 1656 Protected result ind.: No 1657 Session independence: N/A 1658 Fragmentation: No 1659 Channel binding: No 1661 5.5 One-Time Password (OTP) 1662 Description 1664 The One-Time Password system is defined in "A One-Time Password 1665 System" [RFC2289] and "OTP Extended Responses" [RFC2243]. The 1666 Request contains an OTP challenge in the format described in 1667 [RFC2289]. A Response MUST be sent in reply to the Request. The 1668 Response MUST be of Type 5 (OTP), Nak (Type 3) or Expanded Nak 1669 (Type 254). The Nak Response indicates the peer's desired 1670 authentication Type(s). The EAP OTP method is intended for use 1671 with the One-Time Password system only, and MUST NOT be used to 1672 provide support for cleartext passwords. 1674 Type 1676 5 1678 Type-Data 1680 The Type-Data field contains the OTP "challenge" as a displayable 1681 message in the Request. In the Response, this field is used for 1682 the 6 words from the OTP dictionary [RFC2289]. The messages MUST 1683 NOT be null terminated. The length of the field is derived from 1684 the Length field of the Request/Reply packet. 1686 Note: [RFC2289] does not specify how the secret pass-phrase is 1687 entered by the user, or how the pass-phrase is converted into 1688 octets. EAP OTP implementations MAY support entering passphrases 1689 with non-ASCII characters. See Section 5 for instructions how the 1690 input should be processed and encoded into octets. 1692 Security Claims (see Section 7.2): 1694 Auth. mechanism: One-Time Password 1695 Ciphersuite negotiation: No 1696 Mutual authentication: No 1697 Integrity protection: No 1698 Replay protection: Yes 1699 Confidentiality: No 1700 Key derivation: No 1701 Key strength: N/A 1702 Dictionary attack prot.: No 1703 Fast reconnect: No 1704 Crypt. binding: N/A 1705 Protected result ind.: No 1706 Session independence: N/A 1707 Fragmentation: No 1708 Channel binding: No 1710 5.6 Generic Token Card (GTC) 1712 Description 1714 The Generic Token Card Type is defined for use with various Token 1715 Card implementations which require user input. The Request 1716 contains a displayable message and the Response contains the Token 1717 Card information necessary for authentication. Typically, this 1718 would be information read by a user from the Token card device and 1719 entered as ASCII text. A Response MUST be sent in reply to the 1720 Request. The Response MUST be of Type 6 (GTC), Nak (Type 3) or 1721 Expanded Nak (Type 254). The Nak Response indicates the peer's 1722 desired authentication Type(s). The EAP GTC method is intended 1723 for use with the Token Cards supporting challenge/response 1724 authentication and MUST NOT be used to provide support for 1725 cleartext passwords in the absence of a protected tunnel with 1726 server authentication. 1728 Type 1730 6 1732 Type-Data 1734 The Type-Data field in the Request contains a displayable message 1735 greater than zero octets in length. The length of the message is 1736 determined by the Length field of the Request packet. The message 1737 MUST NOT be null terminated. A Response MUST be sent in reply to 1738 the Request with a Type field of 6 (Generic Token Card). The 1739 Response contains data from the Token Card required for 1740 authentication. The length of the data is determined by the 1741 Length field of the Response packet. 1743 EAP GTC implementations MAY support entering a response with 1744 non-ASCII characters. See Section 5 for instructions how the 1745 input should be processed and encoded into octets. 1747 Security Claims (see Section 7.2): 1749 Auth. mechanism: Hardware token. 1750 Ciphersuite negotiation: No 1751 Mutual authentication: No 1752 Integrity protection: No 1753 Replay protection: No 1754 Confidentiality: No 1755 Key derivation: No 1756 Key strength: N/A 1757 Dictionary attack prot.: No 1758 Fast reconnect: No 1759 Crypt. binding: N/A 1760 Protected result ind.: No 1761 Session independence: N/A 1762 Fragmentation: No 1763 Channel binding: No 1765 5.7 Expanded Types 1767 Description 1769 Since many of the existing uses of EAP are vendor-specific, the 1770 Expanded method Type is available to allow vendors to support 1771 their own Expanded Types not suitable for general usage. 1773 The Expanded Type is also used to expand the global Method Type 1774 space beyond the original 255 values. A Vendor-Id of 0 maps the 1775 original 255 possible Types onto a space of 2^32-1 possible Types. 1776 (Type 0 is only used in a Nak Response, to indicate no acceptable 1777 alternative) 1779 An implementation that supports the Expanded attribute MUST treat 1780 EAP Types that are less than 256 equivalently whether they appear 1781 as a single octet or as the 32-bit Vendor-Type within a Expanded 1782 Type where Vendor-Id is 0. Peers not equipped to interpret the 1783 Expanded Type MUST send a Nak as described in Section 5.3.1, and 1784 negotiate a more suitable authentication method. 1786 A summary of the Expanded Type format is shown below. The fields 1787 are transmitted from left to right. 1789 0 1 2 3 1790 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1791 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1792 | Type | Vendor-Id | 1793 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1794 | Vendor-Type | 1795 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1796 | Vendor data... 1797 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1799 Type 1801 254 for Expanded Type 1803 Vendor-Id 1805 The Vendor-Id is 3 octets and represents the SMI Network 1806 Management Private Enterprise Code of the Vendor in network byte 1807 order, as allocated by IANA. A Vendor-Id of zero is reserved for 1808 use by the IETF in providing an expanded global EAP Type space. 1810 Vendor-Type 1812 The Vendor-Type field is four octets and represents the 1813 vendor-specific method Type. 1815 If the Vendor-Id is zero, the Vendor-Type field is an extension 1816 and superset of the existing namespace for EAP Types. The first 1817 256 Types are reserved for compatibility with single-octet EAP 1818 Types that have already been assigned or may be assigned in the 1819 future. Thus, EAP Types from 0 through 255 are semantically 1820 identical whether they appear as single octet EAP Types or as 1821 Vendor-Types when Vendor-Id is zero. There is one exception to 1822 this rule: Expanded Nak and Legacy Nak packets share the same 1823 Type, but must be treated differently because they have a 1824 different format. 1826 Vendor-Data 1828 The Vendor-Data field is defined by the vendor. Where a Vendor-Id 1829 of zero is present, the Vendor-Data field will be used for 1830 transporting the contents of EAP methods of Types defined by the 1831 IETF. 1833 5.8 Experimental 1835 Description 1837 The Experimental Type has no fixed format or content. It is 1838 intended for use when experimenting with new EAP Types. This Type 1839 is intended for experimental and testing purposes. No guarantee 1840 is made for interoperability between peers using this Type, as 1841 outlined in [IANA-EXP]. 1843 Type 1845 255 1847 Type-Data 1849 Undefined 1851 6. IANA Considerations 1853 This section provides guidance to the Internet Assigned Numbers 1854 Authority (IANA) regarding registration of values related to the EAP 1855 protocol, in accordance with BCP 26, [RFC2434]. 1857 There are two name spaces in EAP that require registration: Packet 1858 Codes and method Types. 1860 EAP is not intended as a general-purpose protocol, and allocations 1861 SHOULD NOT be made for purposes unrelated to authentication. 1863 The following terms are used here with the meanings defined in BCP 1864 26: "name space", "assigned value", "registration". 1866 The following policies are used here with the meanings defined in BCP 1867 26: "Private Use", "First Come First Served", "Expert Review", 1868 "Specification Required", "IETF Consensus", "Standards Action". 1870 For registration requests where a Designated Expert should be 1871 consulted, the responsible IESG area director should appoint the 1872 Designated Expert. The intention is that any allocation will be 1873 accompanied by a published RFC. But in order to allow for the 1874 allocation of values prior to the RFC being approved for publication, 1875 the Designated Expert can approve allocations once it seems clear 1876 that an RFC will be published. The Designated expert will post a 1877 request to the EAP WG mailing list (or a successor designated by the 1878 Area Director) for comment and review, including an Internet-Draft. 1879 Before a period of 30 days has passed, the Designated Expert will 1880 either approve or deny the registration request and publish a notice 1881 of the decision to the EAP WG mailing list or its successor, as well 1882 as informing IANA. A denial notice must be justified by an 1883 explanation and, in the cases where it is possible, concrete 1884 suggestions on how the request can be modified so as to become 1885 acceptable. 1887 6.1 Packet Codes 1889 Packet Codes have a range from 1 to 255, of which 1-4 have been 1890 allocated. Because a new Packet Code has considerable impact on 1891 interoperability, a new Packet Code requires Standards Action, and 1892 should be allocated starting at 5. 1894 6.2 Method Types 1896 The original EAP method Type space has a range from 1 to 255, and is 1897 the scarcest resource in EAP, and thus must be allocated with care. 1898 Method Types 1-41 have been allocated, with 20 available for re-use. 1899 Method Types 42-191 may be allocated on the advice of a Designated 1900 Expert, with Specification Required. 1902 Allocation of blocks of method Types (more than one for a given 1903 purpose) should require IETF Consensus. EAP Type Values 192-253 are 1904 reserved and allocation requires Standards Action. 1906 Method Type 254 is allocated for the Expanded Type. Where the 1907 Vendor-Id field is non-zero, the Expanded Type is used for functions 1908 specific only to one vendor's implementation of EAP, where no 1909 interoperability is deemed useful. When used with a Vendor-Id of 1910 zero, method Type 254 can also be used to provide for an expanded 1911 IETF method Type space. Method Type values 256-4294967295 may be 1912 allocated after Type values 1-191 have been allocated. 1914 Method Type 255 is allocated for Experimental use, such as testing of 1915 new EAP methods before a permanent Type is allocated. 1917 7. Security Considerations 1919 This section defines a generic threat model as well as the EAP method 1920 security claims mitigating those threats. 1922 It is expected that the generic threat model and corresponding 1923 security claims will used to define EAP method requirements for use 1924 in specific environments. An example of such a requirements analysis 1925 is provided in [IEEE-802.11i-req]. A security claims section is 1926 required in EAP method specifications, so that EAP methods can be 1927 evaluated against the requirements. 1929 7.1 Threat model 1931 EAP was developed for use with PPP [RFC1661] and was later adapted 1932 for use in wired IEEE 802 networks [IEEE-802] in [IEEE-802.1X]. 1933 Subsequently EAP has been proposed for use on wireless LAN networks, 1934 and over the Internet. In all these situations it is possible for an 1935 attacker to gain access to links over which EAP packets are 1936 transmitted. For example, attacks on telephone infrastructure are 1937 documented in [DECEPTION]. 1939 An attacker with access to the link may carry out a number of 1940 attacks, including: 1942 [1] An attacker may try to discover user identities by snooping 1943 authentication traffic. 1945 [2] An attacker may try to modify or spoof EAP packets. 1947 [3] An attacker may launch denial of service attacks by spoofing 1948 lower layer indications or Success/Failure packets; by replaying 1949 EAP packets; or by generating packets with overlapping 1950 Identifiers. 1952 [4] An attacker may attempt to recover the pass-phrase by mounting 1953 an offline dictionary attack. 1955 [5] An attacker may attempt to convince the peer to connect to an 1956 untrusted network, by mounting a man-in-the-middle attack. 1958 [6] An attacker may attempt to disrupt the EAP negotiation in order 1959 cause a weak authentication method to be selected. 1961 [7] An attacker may attempt to recover keys by taking advantage of 1962 weak key derivation techniques used within EAP methods. 1964 [8] An attacker may attempt to take advantage of weak ciphersuites 1965 subsequently used after the EAP conversation is complete. 1967 [9] An attacker may attempt to perform downgrading attacks on lower 1968 layer ciphersuite negotiation in order to ensure that a weaker 1969 ciphersuite is used subsequently to EAP authentication. 1971 [10] An attacker acting as an authenticator may provide incorrect 1972 information to the EAP peer and/or server via out-of-band 1973 mechanisms (such as via a AAA or lower layer protocol). This 1974 includes impersonating another authenticator, or providing 1975 inconsistent information to the peer and EAP server. 1977 Depending on the lower layer, these attacks may be carried out 1978 without requiring physical proximity. Where EAP is used over 1979 wireless networks, EAP packets may be forwarded by authenticators 1980 (e.g., pre-authentication) so that the attacker need not be within 1981 the coverage area of an authenticator in order to carry out an attack 1982 on it or its peers. Where EAP is used over the Internet, attacks may 1983 be carried out at an even greater distance. 1985 7.2 Security claims 1987 In order to clearly articulate the security provided by an EAP 1988 method, EAP method specifications MUST include a Security Claims 1989 section including the following declarations: 1991 [a] Mechanism. This is a statement of the authentication technology: 1992 certificates, pre-shared keys, passwords, token cards, etc. 1994 [b] Security claims. This is a statement of the claimed security 1995 properties of the method, using terms defined in Section 7.2.1: 1996 mutual authentication, integrity protection, replay protection, 1997 confidentiality, key derivation, dictionary attack resistance, 1998 fast reconnect, cryptographic binding, protected result 1999 indications. The Security Claims section of an EAP method 2000 specification SHOULD provide justification for the claims that 2001 are made. This can be accomplished by including a proof in an 2002 Appendix, or including a reference to a proof. 2004 [c] Key strength. If the method derives keys, then the effective key 2005 strength MUST be estimated. This estimate is meant for potential 2006 users of the method to determine if the keys produced are strong 2007 enough for the intended application. 2009 The effective key strength SHOULD be stated as number of bits, 2010 defined as follows: If the effective key strength is N bits, the 2011 best currently known methods to recover the key (with 2012 non-negligible probability) require on average an effort 2013 comparable to 2^(N-1) operations of a typical block cipher. The 2014 statement SHOULD be accompanied by a short rationale, explaining 2015 how this number was arrived at. This explanation SHOULD include 2016 the parameters required to achieve the stated key strength based 2017 on current knowledge of the algorithms. 2019 (Note: Although it is difficult to define what "comparable 2020 effort" and "typical block cipher" exactly mean, reasonable 2021 approximations are sufficient here. Refer to e.g. [SILVERMAN] 2022 for more discussion.) 2024 The key strength depends on the methods used to derive the keys. 2025 For instance, if keys are derived from a shared secret (such as a 2026 password or a long-term secret), and possibly some public 2027 information such as nonces, the effective key strength is limited 2028 by the strength of the long-term secret (assuming that the 2029 derivation procedure is computationally simple). To take another 2030 example, when using public key algorithms, the strength of the 2031 symmetric key depends on the strength of the public keys used. 2033 [d] Description of key hierarchy. EAP methods deriving keys MUST 2034 either provide a reference to a key hierarchy specification, or 2035 describe how Master Session Keys (MSKs) and Extended Master 2036 Session Keys (EMSKs) are to be derived. 2038 [e] Indication of vulnerabilities. In addition to the security 2039 claims that are made, the specification MUST indicate which of 2040 the security claims detailed in Section 7.2.1 are NOT being made. 2042 7.2.1 Security claims terminology for EAP methods 2044 These terms are used to described the security properties of EAP 2045 methods: 2047 Protected ciphersuite negotiation 2048 This refers to the ability of an EAP method to negotiate 2049 the ciphersuite used to protect the EAP conversation, as 2050 well as to integrity protect the negotiation. It does not 2051 refer to the ability to negotiate the ciphersuite used to 2052 protect data. 2054 Mutual authentication 2055 This refers to an EAP method in which, within an 2056 interlocked exchange, the authenticator authenticates the 2057 peer and the peer authenticates the authenticator. Two 2058 independent one-way methods, running in opposite directions 2059 do not provide mutual authentication as defined here. 2061 Integrity protection 2062 This refers to providing data origin authentication and 2063 protection against unauthorized modification of information 2064 for EAP packets (including EAP Requests and Responses). 2065 When making this claim, a method specification MUST 2066 describe the EAP packets and fields within the EAP packet 2067 that are protected. 2069 Replay protection 2070 This refers to protection against replay of an EAP method 2071 or its messages, including method-specific success and 2072 failure indications. 2074 Confidentiality 2075 This refers to encryption of EAP messages, including EAP 2076 Requests and Responses, and method-specific success and 2077 failure indications. A method making this claim MUST 2078 support identity protection (see Section 7.3). 2080 Key derivation 2081 This refers to the ability of the EAP method to derive 2082 exportable keying material such as the Master Session Key 2083 (MSK), and Extended Master Session Key (EMSK). The MSK is 2084 used only for further key derivation, not directly for 2085 protection of the EAP conversation or subsequent data. Use 2086 of the EMSK is reserved. 2088 Key strength 2089 If the effective key strength is N bits, the best currently 2090 known methods to recover the key (with non-negligible 2091 probability) require on average an effort comparable to 2092 2^(N-1) operations of a typical block cipher. 2094 Dictionary attack resistance 2095 Where password authentication is used, passwords are 2096 commonly selected from a small set (as compared to a set of 2097 N-bit keys), which raises a concern about dictionary 2098 attacks. A method may be said to provide protection 2099 against dictionary attacks if, when it uses a password as a 2100 secret, the method does not allow an offline attack that 2101 has a work factor based on the number of passwords in an 2102 attacker's dictionary. 2104 Fast reconnect 2105 The ability, in the case where a security association has 2106 been previously established, to create a new or refreshed 2107 security association more efficiently or in a smaller 2108 number of round-trips. 2110 Cryptographic binding 2111 The demonstration of the EAP peer to the EAP server that a 2112 single entity has acted as the EAP peer for all methods 2113 executed within a tunnel method. Binding MAY also imply 2114 that the EAP server demonstrates to the peer that a single 2115 entity has acted as the EAP server for all methods executed 2116 within a tunnel method. If executed correctly, binding 2117 serves to mitigate man-in-the-middle vulnerabilities. 2119 Session independence 2120 The demonstration that passive attacks (such as capture of 2121 the EAP conversation) or active attacks (including 2122 compromise of the MSK or EMSK) does not enable compromise 2123 of subsequent or prior MSKs or EMSKs. 2125 Fragmentation 2126 This refers to whether an EAP method supports fragmentation 2127 and reassembly. As noted in Section 3.1, EAP methods 2128 should support fragmentation and reassembly if EAP packets 2129 can exceed the minimum MTU of 1020 octets. 2131 Channel binding 2132 The communication within an EAP method of 2133 integrity-protected channel properties such as endpoint 2134 identifiers which can be compared to values communicated 2135 via out of band mechanisms (such as via a AAA or lower 2136 layer protocol). 2138 Note: This list of security claims is not exhaustive. Additional 2139 properties, such as additional denial-of-service protection, may be 2140 relevant as well. 2142 7.3 Identity protection 2144 An Identity exchange is optional within the EAP conversation. 2145 Therefore, it is possible to omit the Identity exchange entirely, or 2146 to use a method-specific identity exchange once a protected channel 2147 has been established. 2149 However, where roaming is supported as described in [RFC2607], it may 2150 be necessary to locate the appropriate backend authentication server 2151 before the authentication conversation can proceed. The realm 2152 portion of the Network Access Identifier (NAI) [RFC2486] is typically 2153 included within the EAP-Response/Identity in order to enable the 2154 authentication exchange to be routed to the appropriate backend 2155 authentication server. Therefore while the peer-name portion of the 2156 NAI may be omitted in the EAP-Response/Identity, where proxies or 2157 relays are present, the realm portion may be required. 2159 It is possible for the identity in the identity response to be 2160 different from the identity authenticated by the EAP method. This may 2161 be intentional in the case of identity privacy. An EAP method SHOULD 2162 use the authenticated identity when making access control decisions. 2164 7.4 Man-in-the-middle attacks 2166 Where EAP is tunneled within another protocol that omits peer 2167 authentication, there exists a potential vulnerability to 2168 man-in-the-middle attack. For details, see [BINDING] and [MITM]. 2170 As noted in Section 2.1, EAP does not permit untunnelled sequences of 2171 authentication methods. Were a sequence of EAP authentication 2172 methods to be permitted, the peer might not have proof that a single 2173 entity has acted as the authenticator for all EAP methods within the 2174 sequence. For example, an authenticator might terminate one EAP 2175 method, then forward the next method in the sequence to another party 2176 without the peer's knowledge or consent. Similarly, the 2177 authenticator might not have proof that a single entity has acted as 2178 the peer for all EAP methods within the sequence. 2180 Tunnelling EAP within another protocol enables an attack by a rogue 2181 EAP authenticator tunneling EAP to a legitimate server. Where the 2182 tunneling protocol is used for key establishment but does not require 2183 peer authentication, an attacker convincing a legitimate peer to 2184 connect to it will be able to tunnel EAP packets to a legitimate 2185 server, successfully authenticating and obtaining the key. This 2186 allows the attacker to successfully establish itself as a 2187 man-in-the-middle, gaining access to the network, as well as the 2188 ability to decrypt data traffic between the legitimate peer and 2189 server. 2191 This attack may be mitigated by the following measures: 2193 [a] Requiring mutual authentication within EAP tunneling mechanisms. 2195 [b] Requiring cryptographic binding between the EAP tunneling 2196 protocol and the tunneled EAP methods. Where cryptographic 2197 binding is supported, a mechanism is also needed to protect 2198 against downgrade attacks that would bypass it. For further 2199 details on cryptographic binding, see [BINDING]. 2201 [c] Limiting the EAP methods authorized for use without protection, 2202 based on peer and authenticator policy. 2204 [d] Avoiding the use of tunnels when a single, strong method is 2205 available. 2207 7.5 Packet modification attacks 2209 While EAP methods may support per-packet data origin authentication, 2210 integrity and replay protection, support is not provided within the 2211 EAP layer. 2213 Since the Identifier is only a single octet, it is easy to guess, 2214 allowing an attacker to successfully inject or replay EAP packets. An 2215 attacker may also modify EAP headers (Code, Identifier, Length, Type) 2216 within EAP packets where the header is unprotected. This could cause 2217 packets to be inappropriately discarded or misinterpreted. 2219 To protect EAP packets against modification, spoofing or replay, 2220 methods supporting protected ciphersuite negotiation, mutual 2221 authentication and key derivation as well as integrity and replay 2222 protection are recommended. See Section 7.2.1 for definition of 2223 these security claims. 2225 Method-specific MICs may be used to provide protection. If a 2226 per-packet MIC is employed within an EAP method, then peers, 2227 authentication servers, and authenticators not operating in 2228 pass-through mode MUST validate the MIC. MIC validation failures 2229 SHOULD be logged. Whether a MIC validation failure is considered a 2230 fatal error or not is determined by the EAP method specification. 2232 It is RECOMMENDED that methods providing integrity protection of EAP 2233 packets include coverage of all the EAP header fields, including the 2234 Code, Identifier, Length, Type and Type-Data fields. 2236 Since EAP messages of Types Identity, Notification, and Nak do not 2237 include their own MIC, it may be desirable for the EAP method MIC to 2238 cover information contained within these messages, as well as the 2239 header of each EAP message. 2241 To provide protection, EAP also may be encapsulated within a 2242 protected channel created by protocols such as ISAKMP [RFC2408] as is 2243 done in [IKEv2] or within TLS [RFC2246]. However, as noted in 2244 Section 7.4, EAP tunneling may result in a man-in-the-middle 2245 vulnerability. 2247 Existing EAP methods define message integrity checks (MICs) that 2248 cover more than one EAP packet. For example, EAP-TLS [RFC2716] 2249 defines a MIC over a TLS record that could be split into multiple 2250 fragments; within the FINISHED message, the MIC is computed over 2251 previous messages. Where the MIC covers more than one EAP packet, a 2252 MIC validation failure is typically considered a fatal error. 2254 Within EAP-TLS [RFC2716] a MIC validation failure is treated as a 2255 fatal error, since that is what is specified in TLS [RFC2246]. 2256 However, it is also possible to develop EAP methods that support 2257 per-packet MICs, and respond to verification failures by silently 2258 discarding the offending packet. 2260 In this document, descriptions of EAP message handling assume that 2261 per-packet MIC validation, where it occurs, is effectively performed 2262 as though it occurs before sending any responses or changing the 2263 state of the host which received the packet. 2265 7.6 Dictionary attacks 2267 Password authentication algorithms such as EAP-MD5, MS-CHAPv1 2269 [RFC2433] and Kerberos V [RFC1510] are known to be vulnerable to 2270 dictionary attacks. MS-CHAPv1 vulnerabilities are documented in 2271 [PPTPv1]; Kerberos vulnerabilities are described in [KRBATTACK], 2272 [KRBLIM], and [KERB4WEAK]. 2274 In order to protect against dictionary attacks, authentication 2275 methods resistant to dictionary attacks (as defined in Section 7.2.1) 2276 are recommended. 2278 If an authentication algorithm is used that is known to be vulnerable 2279 to dictionary attack, then the conversation may be tunneled within a 2280 protected channel in order to provide additional protection. However, 2281 as noted in Section 7.4, EAP tunneling may result in a 2282 man-in-the-middle vulnerability, and therefore dictionary attack 2283 resistant methods are preferred. 2285 7.7 Connection to an untrusted network 2287 With EAP methods supporting one-way authentication, such as EAP-MD5, 2288 the peer does not authenticate the authenticator, making the peer 2289 vulnerable to attack by a rogue authenticator. Methods supporting 2290 mutual authentication (as defined in Section 7.2.1) address this 2291 vulnerability. 2293 In EAP there is no requirement that authentication be full duplex or 2294 that the same protocol be used in both directions. It is perfectly 2295 acceptable for different protocols to be used in each direction. This 2296 will, of course, depend on the specific protocols negotiated. 2297 However, in general, completing a single unitary mutual 2298 authentication is preferable to two one-way authentications, one in 2299 each direction. This is because separate authentications that are 2300 not bound cryptographically so as to demonstrate they are part of the 2301 same session are subject to man-in-the-middle attacks, as discussed 2302 in Section 7.4. 2304 7.8 Negotiation attacks 2306 In a negotiation attack, the attacker attempts to convince the peer 2307 and authenticator to negotiate a less secure EAP method. EAP does 2308 not provide protection for Nak Response packets, although it is 2309 possible for a method to include coverage of Nak Responses within a 2310 method-specific MIC. 2312 Within or associated with each authenticator, it is not anticipated 2313 that a particular named peer will support a choice of methods. This 2314 would make the peer vulnerable to attacks that negotiate the least 2315 secure method from among a set. Instead, for each named peer there 2316 SHOULD be an indication of exactly one method used to authenticate 2317 that peer name. If a peer needs to make use of different 2318 authentication methods under different circumstances, then distinct 2319 identities SHOULD be employed, each of which identifies exactly one 2320 authentication method. 2322 7.9 Implementation idiosyncrasies 2324 The interaction of EAP with lower layers such as PPP and IEEE 802 are 2325 highly implementation dependent. 2327 For example, upon failure of authentication, some PPP implementations 2328 do not terminate the link, instead limiting traffic in Network-Layer 2329 Protocols to a filtered subset, which in turn allows the peer the 2330 opportunity to update secrets or send mail to the network 2331 administrator indicating a problem. Similarly, while in 2332 [IEEE-802.1X] an authentication failure will result in denied access 2333 to the controlled port, limited traffic may be permitted on the 2334 uncontrolled port. 2336 In EAP there is no provision for retries of failed authentication. 2337 However, in PPP the LCP state machine can renegotiate the 2338 authentication protocol at any time, thus allowing a new attempt. 2339 Similarly, in IEEE 802.1X the Supplicant or Authenticator can 2340 re-authenticate at any time. It is recommended that any counters 2341 used for authentication failure not be reset until after successful 2342 authentication, or subsequent termination of the failed link. 2344 7.10 Key derivation 2346 It is possible for the peer and EAP server to mutually authenticate 2347 and derive keys. In order to provide keying material for use in a 2348 subsequently negotiated ciphersuite, an EAP method supporting key 2349 derivation MUST export a Master Session Key (MSK) of at least 64 2350 octets, and an Extended Master Session Key (EMSK) of at least 64 2351 octets. EAP Methods deriving keys MUST provide for mutual 2352 authentication between the EAP peer and the EAP Server. 2354 The MSK and EMSK MUST NOT be used directly to protect data; however, 2355 they are of sufficient size to enable derivation of a AAA-Key 2356 subsequently used to derive Transient Session Keys (TSKs) for use 2357 with the selected ciphersuite. Each ciphersuite is responsible for 2358 specifying how to derive the TSKs from the AAA-Key. 2360 The AAA-Key is derived from the keying material exported by the EAP 2361 method (MSK and EMSK). This derivation occurs on the AAA server. In 2362 many existing protocols that use EAP, the AAA-Key and MSK are 2363 equivalent, but more complicated mechanisms are possible (see 2364 [KEYFRAME] for details). 2366 EAP methods SHOULD ensure the freshness of the MSK and EMSK even in 2367 cases where one party may not have a high quality random number 2368 generator. A RECOMMENDED method is for each party to provide a nonce 2369 of at least 128 bits, used in the derivation of the MSK and EMSK. 2371 EAP methods export the MSK and EMSK and not Transient Session Keys so 2372 as to allow EAP methods to be ciphersuite and media independent. 2373 Keying material exported by EAP methods MUST be independent of the 2374 ciphersuite negotiated to protect data. 2376 Depending on the lower layer, EAP methods may run before or after 2377 ciphersuite negotiation, so that the selected ciphersuite may not be 2378 known to the EAP method. By providing keying material usable with 2379 any ciphersuite, EAP methods can used with a wide range of 2380 ciphersuites and media. 2382 In order to preserve algorithm independence, EAP methods deriving 2383 keys SHOULD support (and document) the protected negotiation of the 2384 ciphersuite used to protect the EAP conversation between the peer and 2385 server. This is distinct from the ciphersuite negotiated between the 2386 peer and authenticator, used to protect data. 2388 The strength of Transient Session Keys (TSKs) used to protect data is 2389 ultimately dependent on the strength of keys generated by the EAP 2390 method. If an EAP method cannot produce keying material of 2391 sufficient strength, then the TSKs may be subject to brute force 2392 attack. In order to enable deployments requiring strong keys, EAP 2393 methods supporting key derivation SHOULD be capable of generating an 2394 MSK and EMSK, each with an effective key strength of at least 128 2395 bits. 2397 Methods supporting key derivation MUST demonstrate cryptographic 2398 separation between the MSK and EMSK branches of the EAP key 2399 hierarchy. Without violating a fundamental cryptographic assumption 2400 (such as the non-invertibility of a one-way function) an attacker 2401 recovering the MSK or EMSK MUST NOT be able to recover the other 2402 quantity with a level of effort less than brute force. 2404 Non-overlapping substrings of the MSK MUST be cryptographically 2405 separate from each other, as defined in Section 7.2.1. That is, 2406 knowledge of one substring MUST NOT help in recovering some other 2407 substring without breaking some hard cryptographic assumption. This 2408 is required because some existing ciphersuites form TSKs by simply 2409 splitting the AAA-Key to pieces of appropriate length. Likewise, 2410 non-overlapping substrings of the EMSK MUST be cryptographically 2411 separate from each other, and from substrings of the MSK. 2413 The EMSK is reserved for future use and MUST remain on the EAP peer 2414 and EAP server where it is derived; it MUST NOT be transported to, or 2415 shared with, additional parties, or used to derive any other keys. 2416 (This restriction will be relaxed in a future document that specifies 2417 how the EMSK can be used.) 2419 Since EAP does not provide for explicit key lifetime negotiation, EAP 2420 peers, authenticators and authentication servers MUST be prepared for 2421 situations in which one of the parties discards key state which 2422 remains valid on another party. 2424 This specification does not provide detailed guidance on how EAP 2425 methods derive the MSK and EMSK; how the AAA-Key is derived from the 2426 MSK and/or EMSK; or how the TSKs are derived from the AAA-Key. 2428 The development and validation of key derivation algorithms is 2429 difficult, and as a result EAP methods SHOULD reuse well established 2430 and analyzed mechanisms for key derivation (such as those specified 2431 in IKE [RFC2409] or TLS [RFC2246]), rather than inventing new ones. 2432 EAP methods SHOULD also utilize well established and analyzed 2433 mechanisms for MSK and EMSK derivation. Further details on EAP Key 2434 Derivation are provided within [KEYFRAME]. 2436 7.11 Weak ciphersuites 2438 If after the initial EAP authentication, data packets are sent 2439 without per-packet authentication, integrity and replay protection, 2440 an attacker with access to the media can inject packets, "flip bits" 2441 within existing packets, replay packets, or even hijack the session 2442 completely. Without per-packet confidentiality, it is possible to 2443 snoop data packets. 2445 To protect against data modification, spoofing or snooping, it is 2446 recommended that EAP methods supporting mutual authentication, and 2447 key derivation (as defined by Section 7.2.1) be used, along with 2448 lower layers providing per-packet confidentiality, authentication, 2449 integrity and replay protection. 2451 Additionally, if the lower layer performs ciphersuite negotiation, it 2452 should be understood that EAP does not provide by itself integrity 2453 protection of that negotiation. Therefore, in order to avoid 2454 downgrading attacks which would lead to weaker ciphersuites being 2455 used, clients implementing lower layer ciphersuite negotiation SHOULD 2456 protect against negotiation downgrading. 2458 This can be done by enabling users to configure which are the 2459 acceptable ciphersuites as a matter of security policy; or, the 2460 ciphersuite negotiation MAY be authenticated using keying material 2461 derived from the EAP authentication and a MIC algorithm agreed upon 2462 in advance by lower-layer peers. 2464 7.12 Link layer 2466 There are reliability and security issues with link layer indications 2467 in PPP, IEEE 802 LANs and IEEE 802.11 wireless LANs: 2469 [a] PPP. In PPP, link layer indications such as LCP-Terminate (a 2470 link failure indication) and NCP (a link success indication) are 2471 not authenticated or integrity protected. They can therefore be 2472 spoofed by an attacker with access to the link. 2474 [b] IEEE 802. IEEE 802.1X EAPOL-Start and EAPOL-Logoff frames are 2475 not authenticated or integrity protected. They can therefore be 2476 spoofed by an attacker with access to the link. 2478 [c] IEEE 802.11. In IEEE 802.11, link layer indications include 2479 Disassociate and Deauthenticate frames (link failure 2480 indications), and the first message of the 4-way handshake (link 2481 success indication). These messages are not authenticated or 2482 integrity protected, and although they are not forwardable, they 2483 are spoofable by an attacker within range. 2485 In IEEE 802.11, IEEE 802.1X data frames may be sent as Class 3 2486 unicast data frames, and are therefore forwardable. This implies 2487 that while EAPOL-Start and EAPOL-Logoff messages may be 2488 authenticated and integrity protected, they can be spoofed by an 2489 authenticated attacker far from the target when 2490 "pre-authentication" is enabled. 2492 In IEEE 802.11 a "link down" indication is an unreliable 2493 indication of link failure, since wireless signal strength can 2494 come and go and may be influenced by radio frequency interference 2495 generated by an attacker. To avoid unnecessary resets, it is 2496 advisable to damp these indications, rather than passing them 2497 directly to the EAP. Since EAP supports retransmission, it is 2498 robust against transient connectivity losses. 2500 7.13 Separation of authenticator and backend authentication server 2502 It is possible for the EAP peer and EAP server to mutually 2503 authenticate and derive a AAA-Key for a ciphersuite used to protect 2504 subsequent data traffic. This does not present an issue on the peer, 2505 since the peer and EAP client reside on the same machine; all that is 2506 required is for the client to derive the AAA-Key from the MSK and 2507 EMSK exported by the EAP method, and to subsequently pass a Transient 2508 Session Key (TSK) to the ciphersuite module. 2510 However, in the case where the authenticator and authentication 2511 server reside on different machines, there are several implications 2512 for security. 2514 [a] Authentication will occur between the peer and the authentication 2515 server, not between the peer and the authenticator. This means 2516 that it is not possible for the peer to validate the identity of 2517 the authenticator that it is speaking to, using EAP alone. 2519 [b] As discussed in [RFC3579], the authenticator is dependent on the 2520 AAA protocol in order to know the outcome of an authentication 2521 conversation, and does not look at the encapsulated EAP packet 2522 (if one is present) to determine the outcome. In practice this 2523 implies that the AAA protocol spoken between the authenticator 2524 and authentication server MUST support per-packet authentication, 2525 integrity and replay protection. 2527 [c] After completion of the EAP conversation, where lower layer 2528 security services such as per-packet confidentiality, 2529 authentication, integrity and replay protection will be enabled, 2530 a secure association protocol SHOULD be run between the peer and 2531 authenticator in order to provide mutual authentication between 2532 the peer and authenticator; guarantee liveness of transient 2533 session keys; provide protected ciphersuite and capabilities 2534 negotiation for subsequent data; and synchronize key usage. 2536 [d] A AAA-Key derived from the MSK and/or EMSK negotiated between the 2537 peer and authentication server MAY be transmitted to the 2538 authenticator. Therefore a mechanism needs to be provided to 2539 transmit the AAA-Key from the authentication server to the 2540 authenticator that needs it. The specification of the AAA-key 2541 derivation, transport and wrapping mechanisms is outside the 2542 scope of this document. Further details on AAA-Key Derivation 2543 are provided within [KEYFRAME]. 2545 7.14 Cleartext Passwords 2547 This specification does not define a mechanism for cleartext password 2548 authentication. The omission is intentional. Use of cleartext 2549 passwords would allow the password to be captured by an attacker with 2550 access a link over which EAP packets are transmitted. 2552 Since protocols encapsulating EAP, such as RADIUS [RFC3579], may not 2553 provide confidentiality, EAP packets may be subsequently encapsulated 2554 for transport over the Internet where they may be captured by an 2555 attacker. 2557 As a result, cleartext passwords cannot be securely used within EAP, 2558 except where encapsulated within a protected tunnel with server 2559 authentication. Some of the same risks apply to EAP methods without 2560 dictionary attack resistance, as defined in Section 7.2.1. For 2561 details, see Section 7.6. 2563 7.15 Channel binding 2565 It is possible for a compromised or poorly implemented EAP 2566 authenticator to communicate incorrect information to the EAP peer 2567 and/or server. This may enable an authenticator to impersonate 2568 another authenticator or communicate incorrect information via 2569 out-of-band mechanisms (such as via a AAA or lower layer protocol). 2571 Where EAP is used in pass-through mode, the EAP peer typically does 2572 not verify the identity of the pass-through authenticator, it only 2573 verifies that the pass-through authenticator is trusted by the EAP 2574 server. This creates a potential security vulnerability. 2576 Section 4.3.7 of [RFC3579] describes how an EAP pass-through 2577 authenticator acting as a AAA client can be detected if it attempts 2578 to impersonate another authenticator (such by sending incorrect 2579 NAS-Identifier [RFC2865], NAS-IP-Address [RFC2865] or 2580 NAS-IPv6-Address [RFC3162] attributes via the AAA protocol). 2581 However, it is possible for a pass-through authenticator acting as a 2582 AAA client to provide correct information to the AAA server while 2583 communicating misleading information to the EAP peer via a lower 2584 layer protocol. 2586 For example, it is possible for a compromised authenticator to 2587 utilize another authenticator's Called-Station-Id or NAS-Identifier 2588 in communicating with the EAP peer via a lower layer protocol, or for 2589 a pass-through authenticator acting as a AAA client to provide an 2590 incorrect peer Calling-Station-Id [RFC2865][RFC3580] to the AAA 2591 server via the AAA protocol. 2593 In order to address this vulnerability, EAP methods may support a 2594 protected exchange of channel properties such as endpoint 2595 identifiers, including (but not limited to): Called-Station-Id 2596 [RFC2865][RFC3580], Calling-Station-Id [RFC2865][RFC3580], 2597 NAS-Identifier [RFC2865], NAS-IP-Address [RFC2865], and 2598 NAS-IPv6-Address [RFC3162]. 2600 Using such a protected exchange, it is possible to match the channel 2601 properties provided by the authenticator via out-of-band mechanisms 2602 against those exchanged within the EAP method. Where discrepancies 2603 are found, these SHOULD be logged; additional actions MAY also be 2604 taken, such as denying access. 2606 7.16 Protected Result Indications 2608 Within EAP, Success and Failure packets are neither acknowledged nor 2609 integrity protected. Result indications improve resilience to loss 2610 of Success and Failure packets when EAP is run over lower layers 2611 which do not support retransmission or synchronization of the 2612 authentication state. In media such as IEEE 802.11, which provides 2613 for retransmission, as well as synchronization of authentication 2614 state via the 4-way handshake defined in [IEEE-802.11i], additional 2615 resilience is typically of marginal benefit. 2617 Depending on the method and circumstances, result indications can be 2618 spoofable by an attacker. A method is said to provide protected 2619 result indications if it supports result indications as well as the 2620 "integrity protection" and "replay protection" claims. A method 2621 supporting protected result indications MUST indicate which result 2622 indications are protected, and which are not. 2624 Protected result indications are not required to protect against 2625 rogue authenticators. Within a mutually authenticating method, 2626 requiring that the server authenticate to the peer before the peer 2627 will accept a Success packet prevents an attacker from acting as a 2628 rogue authenticator. 2630 However, it is possible for an attacker to forge a Success packet 2631 after the server has authenticated to the peer, but before the peer 2632 has authenticated to the server. If the peer were to accept the 2633 forged Success packet and attempt to access the network when it had 2634 not yet successfully authenticated to the server, a denial of service 2635 attack could be mounted against the peer. After such an attack, if 2636 the lower layer supports failure indications, the authenticator can 2637 synchronize state with the peer by providing a lower layer failure 2638 indication. See Section 7.12 for details. 2640 If a server were to authenticate the peer and send a Success packet 2641 prior to determining whether the peer has authenticated the 2642 authenticator, an idle timeout can occur if the authenticator is not 2643 authenticated by the peer. Where supported by the lower layer, an 2644 authenticator sensing the absence of the peer can free resources. 2646 In a method supporting result indications, a peer that has 2647 authenticated the server does not consider the authentication 2648 successful until it receives an indication that the server 2649 successfully authenticated it. Similarly, a server that has 2650 successfully authenticated the peer does not consider the 2651 authentication successful until it receives an indication that the 2652 peer has authenticated the server. 2654 In order to avoid synchronization problems, prior to sending a 2655 success result indication, it is desirable for the sender to verify 2656 that sufficient authorization exists for granting access, though as 2657 discussed below this is not always possible. 2659 While result indications may enable synchronization of the 2660 authentication result between the peer and server, this does not 2661 guarantee that the peer and authenticator will be synchronized in 2662 terms of their authorization or that timeouts will not occur. For 2663 example, the EAP server may not be aware of an authorization decision 2664 made by a AAA proxy; the AAA server may check authorization only 2665 after authentication has completed successfully, only to discover 2666 that authorization cannot be granted; or the AAA server may grant 2667 access but the authenticator may be unable to provide it due to a 2668 temporary lack of resources. In these situations, synchronization 2669 may only be achieved via lower layer result indications. 2671 Success indications may be explicit or implicit. For example, where 2672 a method supports error messages, an implicit success indication may 2673 be defined as the reception of a specific message without a preceding 2674 error message. Failures are typically indicated explicitly. As 2675 described in Section 4.2, a peer silently discards a Failure packet 2676 received at a point where the method does not explicitly permit this 2677 to be sent. For example, a method providing its own error messages 2678 might require the peer to receive an error message prior to accepting 2679 a Failure packet. 2681 Per-packet authentication, integrity and replay protection of result 2682 indications protects against spoofing. Since protected result 2683 indications require use of a key for per-packet authentication and 2684 integrity protection, methods supporting protected result indications 2685 MUST also support the "key derivation", "mutual authentication" 2686 "integrity protection" and "replay protection" claims. 2688 Protected result indications address some denial-of-service 2689 vulnerabilities due to spoofing of Success and Failure packets, 2690 though not all. EAP methods can typically provide protected result 2691 indications only in some circumstances. For example, errors can occur 2692 prior to key derivation, and so it may not be possible to protect all 2693 failure indications. It is also possible that result indications may 2694 not be supported in both directions or that synchronization may not 2695 be achieved in all modes of operation. 2697 For example, within EAP-TLS [RFC2716], in the client authentication 2698 handshake the server authenticates the peer, but does not receive a 2699 protected indication of whether the peer has authenticated it. In 2700 contrast, the peer authenticates the server and is aware of whether 2701 the server has authenticated it. In the session resumption 2702 handshake, the peer authenticates the server, but does not receive a 2703 protected indication of whether the server has authenticated it. In 2704 this mode, the server authenticates the peer and is aware of whether 2705 the peer has authenticated it. 2707 8. Acknowledgments 2709 This protocol derives much of its inspiration from Dave Carrel's AHA 2710 draft as well as the PPP CHAP protocol [RFC1994]. Valuable feedback 2711 was provided by Yoshihiro Ohba of Toshiba America Research, Jari 2712 Arkko of Ericsson, Sachin Seth of Microsoft, Glen Zorn of Cisco 2713 Systems, Jesse Walker of Intel, Bill Arbaugh, Nick Petroni and Bryan 2714 Payne of the University of Maryland, Steve Bellovin of AT&T Research, 2715 Paul Funk of Funk Software, Pasi Eronen of Nokia, Joseph Salowey of 2716 Cisco and Paul Congdon of HP and members of the EAP working group. 2718 The use of Security Claims sections for EAP methods, as required by 2719 Section 7.2 and specified for each EAP method described in this 2720 document, was inspired by Glen Zorn through [EAP-EVAL]. 2722 Normative References 2724 [RFC1661] Simpson, W., "The Point-to-Point Protocol (PPP)", STD 51, 2725 RFC 1661, July 1994. 2727 [RFC1994] Simpson, W., "PPP Challenge Handshake Authentication 2728 Protocol (CHAP)", RFC 1994, August 1996. 2730 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 2731 Requirement Levels", BCP 14, RFC 2119, March 1997. 2733 [RFC2243] Metz, C., "OTP Extended Responses", RFC 2243, November 2734 1997. 2736 [RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO 2737 10646", RFC 2279, January 1998. 2739 [RFC2289] Haller, N., Metz, C., Nesser, P. and M. Straw, "A One-Time 2740 Password System", RFC 2289, February 1998. 2742 [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an 2743 IANA Considerations Section in RFCs", BCP 26, RFC 2434, 2744 October 1998. 2746 [RFC2988] Paxson, V. and M. Allman, "Computing TCP's Retransmission 2747 Timer", RFC 2988, November 2000. 2749 [IEEE-802] 2750 Institute of Electrical and Electronics Engineers, "Local 2751 and Metropolitan Area Networks: Overview and 2752 Architecture", IEEE Standard 802, 1990. 2754 [IEEE-802.1X] 2755 Institute of Electrical and Electronics Engineers, "Local 2756 and Metropolitan Area Networks: Port-Based Network Access 2757 Control", IEEE Standard 802.1X, September 2001. 2759 Informative References 2761 [RFC793] Postel, J., "Transmission Control Protocol", STD 7, RFC 2762 793, September 1981. 2764 [RFC1510] Kohl, J. and B. Neuman, "The Kerberos Network 2765 Authentication Service (V5)", RFC 1510, September 1993. 2767 [RFC1750] Eastlake, D., Crocker, S. and J. Schiller, "Randomness 2768 Recommendations for Security", RFC 1750, December 1994. 2770 [RFC2222] Myers, J., "Simple Authentication and Security Layer 2771 (SASL)", RFC 2222, October 1997. 2773 [RFC2246] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0", 2774 RFC 2246, January 1999. 2776 [RFC2284] Blunk, L. and J. Vollbrecht, "PPP Extensible 2777 Authentication Protocol (EAP)", RFC 2284, March 1998. 2779 [RFC2486] Aboba, B. and M. Beadles, "The Network Access Identifier", 2780 RFC 2486, January 1999. 2782 [RFC2401] Kent, S. and R. Atkinson, "Security Architecture for the 2783 Internet Protocol", RFC 2401, November 1998. 2785 [RFC2408] Maughan, D., Schneider, M. and M. Schertler, "Internet 2786 Security Association and Key Management Protocol 2787 (ISAKMP)", RFC 2408, November 1998. 2789 [RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange 2790 (IKE)", RFC 2409, November 1998. 2792 [RFC2433] Zorn, G. and S. Cobb, "Microsoft PPP CHAP Extensions", RFC 2793 2433, October 1998. 2795 [RFC2607] Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy 2796 Implementation in Roaming", RFC 2607, June 1999. 2798 [RFC2661] Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, G. 2799 and B. Palter, "Layer Two Tunneling Protocol "L2TP"", RFC 2800 2661, August 1999. 2802 [RFC2716] Aboba, B. and D. Simon, "PPP EAP TLS Authentication 2803 Protocol", RFC 2716, October 1999. 2805 [RFC2743] Linn, J., "Generic Security Service Application Program 2806 Interface Version 2, Update 1", RFC 2743, January 2000. 2808 [RFC2865] Rigney, C., Willens, S., Rubens, A. and W. Simpson, 2809 "Remote Authentication Dial In User Service (RADIUS)", RFC 2810 2865, June 2000. 2812 [RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C., 2813 Schwarzbauer, H., Taylor, T., Rytina, I., Kalla, M., 2814 Zhang, L. and V. Paxson, "Stream Control Transmission 2815 Protocol", RFC 2960, October 2000. 2817 [RFC3162] Aboba, B., Zorn, G. and D. Mitton, "RADIUS and IPv6", RFC 2818 3162, August 2001. 2820 [RFC3454] Hoffman, P. and M. Blanchet, "Preparation of 2821 Internationalized Strings ("stringprep")", RFC 3454, 2822 December 2002. 2824 [RFC3579] Aboba, B. and P. Calhoun, "RADIUS (Remote Authentication 2825 Dial In User Service) Support For Extensible 2826 Authentication Protocol (EAP)", RFC 3579, September 2003. 2828 [RFC3580] Congdon, P., Aboba, B., Smith, A., Zorn, G. and J. Roese, 2829 "IEEE 802.1X Remote Authentication Dial In User Service 2830 (RADIUS) Usage Guidelines", RFC 3580, September 2003. 2832 [DECEPTION] 2833 Slatalla, M. and J. Quittner, "Masters of Deception", 2834 Harper-Collins , New York, 1995. 2836 [KRBATTACK] 2837 Wu, T., "A Real-World Analysis of Kerberos Password 2838 Security", Proceedings of the 1999 ISOC Network and 2839 Distributed System Security Symposium, http:// 2840 www.isoc.org/isoc/conferences/ndss/99/proceedings/papers/ 2841 wu.pdf. 2843 [KRBLIM] Bellovin, S. and M. Merrit, "Limitations of the Kerberos 2844 authentication system", Proceedings of the 1991 Winter 2845 USENIX Conference, pp. 253-267, 1991. 2847 [KERB4WEAK] 2848 Dole, B., Lodin, S. and E. Spafford, "Misplaced trust: 2849 Kerberos 4 session keys", Proceedings of the Internet 2850 Society Network and Distributed System Security Symposium, 2851 pp. 60-70, March 1997. 2853 [PIC] Aboba, B., Krawczyk, H. and Y. Sheffer, "PIC, A Pre-IKE 2854 Credential Provisioning Protocol", draft-ietf-ipsra-pic-06 2855 (work in progress), October 2002. 2857 [IKEv2] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", 2858 draft-ietf-ipsec-ikev2-12 (work in progress), January 2859 2004. 2861 [PPTPv1] Schneier, B. and Mudge, "Cryptanalysis of Microsoft's 2862 Point-to- Point Tunneling Protocol", Proceedings of the 2863 5th ACM Conference on Communications and Computer 2864 Security, ACM Press, November 1998. 2866 [IEEE-802.3] 2867 Institute of Electrical and Electronics Engineers, 2868 "Information technology - Telecommunications and 2869 information exchange between systems - Local and 2870 metropolitan area networks - Specific requirements - Part 2871 3: Carrier sense multiple access with collision detection 2872 (CSMA/CD) access method and physical layer 2873 specifications"", IEEE Standard 802.3, September 1998. 2875 [IEEE-802.11] 2876 Institute of Electrical and Electronics Engineers, 2877 "Wireless LAN Medium Access Control (MAC) and Physical 2878 Layer (PHY) Specifications", IEEE Standard 802.11, 1999. 2880 [SILVERMAN] 2881 Silverman, Robert D., "A Cost-Based Security Analysis of 2882 Symmetric and Asymmetric Key Lengths", RSA Laboratories 2883 Bulletin 13, April 2000 (Revised November 2001), http:// 2884 www.rsasecurity.com/rsalabs/bulletins/bulletin13.html. 2886 [IANA-EXP] 2887 Narten, T., "Assigning Experimental and Testing Numbers 2888 Considered Useful", 2889 draft-narten-iana-experimental-allocations-05 (work in 2890 progress), November 2003. 2892 [KEYFRAME] 2893 Aboba, B., "EAP Key Management Framework", 2894 draft-ietf-eap-keying-01 (work in progress), October 2003. 2896 [SASLPREP] 2897 Zeilenga, K., "SASLprep: Stringprep profile for user names 2898 and passwords", draft-ietf-sasl-saslprep-04 (work in 2899 progress), October 2003. 2901 [IEEE-802.11i] 2902 Institute of Electrical and Electronics Engineers, 2903 "Unapproved Draft Supplement to Standard for 2904 Telecommunications and Information Exchange Between 2905 Systems - LAN/MAN Specific Requirements - Part 11: 2906 Wireless LAN Medium Access Control (MAC) and Physical 2907 Layer (PHY) Specifications: Specification for Enhanced 2908 Security", IEEE Draft 802.11i (work in progress), 2003. 2910 [DIAM-EAP] 2911 Eronen, P., Hiller, T. and G. Zorn, "Diameter Extensible 2912 Authentication Protocol (EAP) Application", 2913 draft-ietf-aaa-eap-03 (work in progress), October 2003. 2915 [EAP-EVAL] 2916 Zorn, G., "Specifying Security Claims for EAP 2917 Authentication Types", draft-zorn-eap-eval-00 (work in 2918 progress), October 2002. 2920 [BINDING] Puthenkulam, J., "The Compound Authentication Binding 2921 Problem", draft-puthenkulam-eap-binding-04 (work in 2922 progress), October 2003. 2924 [MITM] Asokan, N., Niemi, V. and K. Nyberg, "Man-in-the-Middle in 2925 Tunnelled Authentication Protocols", IACR ePrint Archive 2926 Report 2002/163, October 2002, . 2929 [IEEE-802.11i-req] 2930 Stanley, D., et al., "EAP Method Requirements for Wireless 2931 LANs", draft-walker-ieee802-req-00.txt (work in progress), 2932 February 2004. 2934 Authors' Addresses 2936 Larry J. Blunk 2937 Merit Network, Inc 2938 4251 Plymouth Rd., Suite 2000 2939 Ann Arbor, MI 48105-2785 2940 USA 2942 Phone: +1 734-647-9563 2943 Fax: +1 734-647-3185 2944 EMail: ljb@merit.edu 2946 John R. Vollbrecht 2947 Vollbrecht Consulting LLC 2948 9682 Alice Hill Drive 2949 Dexter, MI 48130 2950 USA 2952 Phone: 2953 EMail: jrv@umich.edu 2955 Bernard Aboba 2956 Microsoft Corporation 2957 One Microsoft Way 2958 Redmond, WA 98052 2959 USA 2961 Phone: +1 425 706 6605 2962 Fax: +1 425 936 6605 2963 EMail: bernarda@microsoft.com 2965 James Carlson 2966 Sun Microsystems, Inc 2967 1 Network Drive 2968 Burlington, MA 01803-2757 2969 USA 2971 Phone: +1 781 442 2084 2972 Fax: +1 781 442 1677 2973 EMail: james.d.carlson@sun.com 2974 Henrik Levkowetz 2975 ipUnplugged AB 2976 Arenavagen 33 2977 Stockholm S-121 28 2978 SWEDEN 2980 Phone: +46 708 32 16 08 2981 EMail: henrik@levkowetz.com 2983 Appendix A. Changes from RFC 2284 2985 This section lists the major changes between [RFC2284] and this 2986 document. Minor changes, including style, grammar, spelling and 2987 editorial changes are not mentioned here. 2989 o The Terminology section (Section 1.2) has been expanded, defining 2990 more concepts and giving more exact definitions. 2992 o The concepts of Mutual Authentication, Key Derivation and 2993 Protected Result Indications are introduced and discussed 2994 throughout the document where appropriate. 2996 o In Section 2, it is explicitly specified that more than one 2997 exchange of Request and Response packets may occur as part of the 2998 EAP authentication exchange. How this may and may not be used is 2999 specified in detail in Section 2.1. 3001 o Also in Section 2, some requirements on the authenticator when 3002 acting in pass-through mode has been made explicit. 3004 o An EAP multiplexing model (Section 2.2) has been added, to 3005 illustrate a typical implementation of EAP. There is no 3006 requirement that an implementation conforms to this model, as long 3007 as the on-the-wire behavior is consistent with it. 3009 o As EAP is now in use with a variety of lower layers, not just PPP 3010 for which it was first designed, Section 3 on lower layer behavior 3011 has been added. 3013 o In the description of the EAP Request and Response interaction 3014 (Section 4.1), it has been more exactly specified when packets 3015 should be silently discarded, and also the behavior on receiving 3016 duplicate requests. The implementation notes in this section has 3017 been substantially expanded. 3019 o In Section 4.2, it has been clarified that Success and Failure 3020 packets must not contain additional data, and the implementation 3021 note has been expanded. A subsection giving requirements on 3022 processing of success and failure packets has been added. 3024 o Section 5 on EAP Request/Response Types lists two new Type values: 3025 the Expanded Type (Section 5.7), which is used to expand the Type 3026 value number space, and the Experimental Type. In the Expanded 3027 Type number space, the new Expanded Nak (Section 5.3.2) Type has 3028 been added. Clarifications have been made in the description of 3029 most of the existing Types. Security claims summaries have been 3030 added for authentication methods. 3032 o In Section 5, Section 5.1 and Section 5.2, requirements has been 3033 added that fields with displayable messages should contain UTF-8 3034 encoded ISO 10646 characters. 3036 o The null character is forbidden in the Type-Data field of an 3037 Identity Response message, as it is in RFC 2284. However, this 3038 rule has been relaxed for Identity Requests, and it is now 3039 required in Section 5.1 that if the Type-Data field of an Identity 3040 Request contains a null character, only the part before the null 3041 is displayed. 3043 o In Section 5.5, support for OTP Extended Responses [RFC2243] has 3044 been added to EAP OTP. 3046 o An IANA Considerations section (Section 6) has been added, giving 3047 registration policies for the numbering spaces defined for EAP. 3049 o The Security Considerations (Section 7) have been greatly 3050 expanded, aiming at giving a much more comprehensive coverage of 3051 possible threats and other security considerations. 3053 o In Section 7.5, text has been added on method-specific behavior, 3054 providing guidance on how EAP method-specific integrity checks 3055 should be processed. Where possible, it is desirable for a 3056 method-specific MIC to be computed over the entire EAP packet, 3057 including the EAP layer header (Code, Identifier, Length) and EAP 3058 method layer header (Type, Type-Data). 3060 o In Section 7.14 the security risks involved in use of cleartext 3061 passwords with EAP are described. 3063 o In Section 7.15 text has been added relating to detection of rogue 3064 NAS behavior. 3066 Appendix B. Open issues 3068 (This section should be removed by the RFC editor before publication) 3069 Open issues relating to this specification are tracked on the 3070 following web site: 3072 http://www.drizzle.com/~aboba/EAP/eapissues.html 3074 The current working documents for this draft are available at this 3075 web site: 3077 http://www.levkowetz.com/pub/ietf/drafts/eap/rfc2284bis/ 3079 Intellectual Property Statement 3081 The IETF takes no position regarding the validity or scope of any 3082 intellectual property or other rights that might be claimed to 3083 pertain to the implementation or use of the technology described in 3084 this document or the extent to which any license under such rights 3085 might or might not be available; neither does it represent that it 3086 has made any effort to identify any such rights. Information on the 3087 IETF's procedures with respect to rights in standards-track and 3088 standards-related documentation can be found in BCP-11. Copies of 3089 claims of rights made available for publication and any assurances of 3090 licenses to be made available, or the result of an attempt made to 3091 obtain a general license or permission for the use of such 3092 proprietary rights by implementors or users of this specification can 3093 be obtained from the IETF Secretariat. 3095 The IETF invites any interested party to bring to its attention any 3096 copyrights, patents or patent applications, or other proprietary 3097 rights which may cover technology that may be required to practice 3098 this standard. Please address the information to the IETF Executive 3099 Director. 3101 Full Copyright Statement 3103 Copyright (C) The Internet Society (2004). All Rights Reserved. 3105 This document and translations of it may be copied and furnished to 3106 others, and derivative works that comment on or otherwise explain it 3107 or assist in its implementation may be prepared, copied, published 3108 and distributed, in whole or in part, without restriction of any 3109 kind, provided that the above copyright notice and this paragraph are 3110 included on all such copies and derivative works. However, this 3111 document itself may not be modified in any way, such as by removing 3112 the copyright notice or references to the Internet Society or other 3113 Internet organizations, except as needed for the purpose of 3114 developing Internet standards in which case the procedures for 3115 copyrights defined in the Internet Standards process must be 3116 followed, or as required to translate it into languages other than 3117 English. 3119 The limited permissions granted above are perpetual and will not be 3120 revoked by the Internet Society or its successors or assignees. 3122 This document and the information contained herein is provided on an 3123 "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING 3124 TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 3125 BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION 3126 HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF 3127 MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 3129 Acknowledgment 3131 Funding for the RFC Editor function is currently provided by the 3132 Internet Society.