idnits 2.17.1 draft-ietf-pppext-rfc2284bis-10.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Looks like you're using RFC 2026 boilerplate. This must be updated to follow RFC 3978/3979, as updated by RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- ** The document seems to lack a 1id_guidelines paragraph about Internet-Drafts being working documents -- however, there's a paragraph with a matching beginning. Boilerplate error? ** The document seems to lack a 1id_guidelines paragraph about 6 months document validity -- however, there's a paragraph with a matching beginning. Boilerplate error? == No 'Intended status' indicated for this document; assuming Proposed Standard == The page length should not exceed 58 lines per page, but there was 39 longer pages, the longest (page 2) being 60 lines == It seems as if not all pages are separated by form feeds - found 0 form feeds but 40 pages Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- -- The abstract seems to indicate that this document obsoletes RFC2284, but the header doesn't have an 'Obsoletes:' line to match this. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year == Line 1108 has weird spacing: '...pe-Data field...' == Line 1571 has weird spacing: '...o as to demon...' -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- Couldn't find a document date in the document -- date freshness check skipped. Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'IEEE802lX' is mentioned on line 140, but not defined -- Looks like a reference, but probably isn't: '1' on line 1665 -- Looks like a reference, but probably isn't: '2' on line 1668 -- Looks like a reference, but probably isn't: '3' on line 1672 -- Looks like a reference, but probably isn't: '4' on line 1675 -- Looks like a reference, but probably isn't: '5' on line 1679 == Missing Reference: 'RFC 2243' is mentioned on line 1143, but not defined -- Looks like a reference, but probably isn't: '6' on line 1682 -- Looks like a reference, but probably isn't: '7' on line 1398 -- Looks like a reference, but probably isn't: '8' on line 1401 == Missing Reference: 'RFC2409' is mentioned on line 1661, but not defined ** Obsolete undefined reference: RFC 2409 (Obsoleted by RFC 4306) == Unused Reference: 'RFC2243' is defined on line 1710, but no explicit reference was found in the text == Unused Reference: 'RFC2401' is defined on line 1747, but no explicit reference was found in the text ** Obsolete normative reference: RFC 2279 (Obsoleted by RFC 3629) ** Obsolete normative reference: RFC 2434 (Obsoleted by RFC 5226) ** Obsolete normative reference: RFC 2988 (Obsoleted by RFC 6298) -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE802' -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE8021X' -- Obsolete informational reference (is this intentional?): RFC 1510 (Obsoleted by RFC 4120, RFC 6649) -- Obsolete informational reference (is this intentional?): RFC 2246 (Obsoleted by RFC 4346) -- Obsolete informational reference (is this intentional?): RFC 2486 (Obsoleted by RFC 4282) -- Obsolete informational reference (is this intentional?): RFC 2401 (Obsoleted by RFC 4301) -- Obsolete informational reference (is this intentional?): RFC 2408 (Obsoleted by RFC 4306) -- Obsolete informational reference (is this intentional?): RFC 2716 (Obsoleted by RFC 5216) == Outdated reference: A later version (-07) exists of draft-ietf-ipsra-pic-06 Summary: 7 errors (**), 0 flaws (~~), 12 warnings (==), 19 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 EAP Working Group L. Blunk 3 INTERNET-DRAFT Merit Networks, Inc. 4 Expires: July 2003 J. Vollbrecht 5 Vollbrecht Consulting LLC 6 22 January 2003 B. Aboba 7 Microsoft 8 J. Carlson 9 Sun Microsystems, Inc. 11 Extensible Authentication Protocol (EAP) 13 This document is an Internet-Draft and is in full conformance with all 14 provisions of Section 10 of RFC 2026. 16 Internet-Drafts are working documents of the Internet Engineering Task 17 Force (IETF), its areas, and its working groups. Note that other groups 18 may also distribute working documents as Internet- Drafts. 20 Internet-Drafts are draft documents valid for a maximum of six months 21 and may be updated, replaced, or obsoleted by other documents at any 22 time. It is inappropriate to use Internet Drafts as reference material 23 or to cite them other than as "work in progress." 25 The list of current Internet-Drafts can be accessed at 26 http://www.ietf.org/ietf/1id-abstracts.txt 28 The list of Internet-Draft Shadow Directories can be accessed at 29 http://www.ietf.org/shadow.html. 31 Copyright Notice 33 Copyright (C) The Internet Society (2003). All Rights Reserved. 35 Abstract 37 This document defines the Extensible Authentication Protocol (EAP), an 38 authentication framework which supports multiple authentication 39 mechanisms. EAP typically runs directly over the link layer without 40 requiring IP, but is reliant on lower layer ordering guarantees as in 41 PPP and IEEE 802. EAP does provide its own support for duplicate 42 elimination and retransmission. Fragmentation is not supported within 43 EAP itself; however, individual EAP methods may support this. While EAP 44 was originally developed for use with PPP, it is also now in use with 45 IEEE 802. 47 This document obsoletes RFC 2284. 49 Table of Contents 51 1. Introduction .......................................... 3 52 1.1 Specification of Requirements ................... 3 53 1.2 Terminology ..................................... 3 54 2. Extensible Authentication Protocol (EAP) .............. 6 55 2.1 Support for sequences ........................... 7 56 2.2 EAP multiplexing model .......................... 8 57 3. Lower layer behavior .................................. 10 58 3.1 Lower layer requirements ........................ 10 59 3.2 EAP usage within PPP ............................ 11 60 3.3 EAP usage within IEEE 802 ....................... 12 61 3.4 Link layer indications .......................... 13 62 4. EAP Packet Format ..................................... 13 63 4.1 Request and Response ............................ 14 64 4.2 Success and Failure ............................. 17 65 5. Initial EAP Request/Response Types .................... 19 66 5.1 Identity ........................................ 20 67 5.2 Notification .................................... 21 68 5.3 Nak ............................................. 22 69 5.4 MD5-Challenge ................................... 23 70 5.5 One-Time Password ............................... 24 71 5.6 Generic Token Card .............................. 25 72 5.7 Vendor-specific ................................. 26 73 6. IANA Considerations ................................... 28 74 6.1 Definition of Terms ............................. 28 75 6.2 Recommended Registration Policies ............... 28 76 7. Security considerations ............................... 29 77 7.1 Threat model .................................... 29 78 7.2 Security claims ................................. 30 79 7.3 Identity protection ............................. 31 80 7.4 Man-in-the-middle attacks ....................... 31 81 7.5 Packet modification attacks ..................... 32 82 7.6 Dictionary attacks .............................. 32 83 7.7 Connection to an untrusted network .............. 33 84 7.8 Negotiation attacks ............................. 33 85 7.9 Implementation idiosyncrasies ................... 33 86 7.10 Key derivation .................................. 34 87 7.11 Weak ciphersuites ............................... 36 88 8. Normative references .................................. 36 89 9. Informative references ................................ 37 90 ACKNOWLEDGMENTS .............................................. 38 91 AUTHORS' ADDRESSES ........................................... 38 92 Intellectual Property Notices ................................ 39 93 Full Copyright Statement ..................................... 40 94 1. Introduction 96 This document defines the Extensible Authentication Protocol (EAP), an 97 authentication framework which supports multiple authentication 98 mechanisms. EAP typically runs directly over the link layer without 99 requiring IP, but is reliant on lower layer ordering guarantees as in 100 PPP and IEEE 802. EAP does provide its own support for duplicate 101 elimination and retransmission. Fragmentation is not supported within 102 EAP itself; however, individual EAP methods may support this. 104 EAP may be used on dedicated links as well as switched circuits, and 105 wired as well as wireless links. To date, EAP has been implemented with 106 hosts and routers that connect via switched circuits or dial-up lines 107 using PPP [RFC1661]. It has also been implemented with switches and 108 access points using IEEE 802 [IEEE802]. EAP encapsulation on IEEE 802 109 wired media is described in [IEEE8021X]. 111 One of the advantages of the EAP architecture is its flexibility. EAP 112 is used to select a specific authentication mechanism, typically after 113 the authenticator requests more information in order to determine the 114 specific authentication mechanism(s) to be used. Rather than requiring 115 the authenticator to be updated to support each new authentication 116 method, EAP permits the use of a backend authentication server which may 117 implement some or all authentication methods, with the authenticator 118 acting as a pass-through for some or all methods and users. 120 Within this document, authenticator requirements apply regardless of 121 whether the authenticator is operating as a pass-through. Where the 122 requirement is meant to apply to either the authenticator or backend 123 authentication server, depending on where the EAP authentication is 124 terminated, the term "EAP server" will be used. 126 1.1. Specification of Requirements 128 In this document, several words are used to signify the requirements of 129 the specification. These words are often capitalized. The key words 130 "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD 131 NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be 132 interpreted as described in [RFC2119]. 134 1.2. Terminology 136 This document frequently uses the following terms: 138 authenticator 139 The end of the link requiring the authentication. This 140 terminology is also used in [IEEE802lX], and has the same 141 meaning in this document. 143 peer The other end of the point-to-point link (PPP), point-to-point 144 LAN segment (IEEE 802 wired media) or 802.11 wireless link, 145 which being authenticated by the authenticator. In 146 [IEEE8021X], this end is known as the Supplicant. 148 backend authentication server 149 A backend authentication server is an entity that provides an 150 authentication service to an authenticator. This service 151 verifies from the credentials provided by the peer, the claim 152 of identity made by the peer. This terminology is also used in 153 [IEEE8021X]. 155 Displayable Message 156 This is interpreted to be a human readable string of 157 characters, and MUST NOT affect operation of the protocol. 158 The message encoding MUST follow the UTF-8 transformation 159 format [RFC2279]. 161 EAP server 162 The entity that terminates the EAP authentication with the 163 peer. In the case where there is no backend authentication 164 server, this term refers to the authenticator. Where the 165 authenticator operates in pass-through, it refers to the 166 backend authentication server. 168 Silently Discard 169 This means the implementation discards the packet without 170 further processing. The implementation SHOULD provide the 171 capability of logging the event, including the contents of the 172 silently discarded packet, and SHOULD record the event in a 173 statistics counter. 175 Security claims (see Section 7.2): 177 Mutual authentication 178 This refers to an EAP method in which, within an interlocked 179 exchange, the authenticator authenticates the peer and the 180 peer authenticates the authenticator. Two one-way 181 conversations, running in opposite directions do not provide 182 mutual authentication as defined here. 184 Integrity protection 185 This refers to per-packet authentication and integrity 186 protection of EAP packets, including EAP Requests and 187 Responses, and method-specific success and failure 188 indications. When making this claim, a method specification 189 MUST describe the fields within the EAP packet that are 190 protected. 192 Replay protection 193 This refers to protection against replay of EAP messages, 194 including EAP Requests and Responses, and method-specific 195 success and failure indications. 197 Confidentiality 198 This refers to encryption of EAP messages, including EAP 199 Requests and Responses, and method-specific success and 200 failure indications. A method making this claim MUST support 201 identity protection. 203 Key derivation 204 This refers to the ability of the EAP method to derive a 205 Master Key which is not exported, as well as a ciphersuite- 206 independent Master Session Keys. Both the Master Key and 207 Master Session Keys are used only for further key derivation, 208 not directly for protection of the EAP conversation or 209 subsequent data. 211 Key strength 212 This refers to the effective entropy of the derived Master 213 Session Keys, independent of their physical length. For 214 example, a 128-bit key derived from a password might have an 215 effective entropy much less than 128 bits. 217 Dictionary attack resistance 218 Where password authentication is used, users are notoriously 219 prone to selection of poor passwords. A method may be said to 220 be dictionary attack resistant if, when there is a weak 221 password in the secret, the method does not allow an attack 222 more efficient than brute force. 224 Fast reconnect 225 The ability, in the case where a security association has been 226 previously established, to create a new or refreshed security 227 association in a smaller number of round-trips. 229 Man-in-the-Middle resistance 230 The ability for the peer to demonstrate to the authenticator 231 that it has acted as the peer for each method within a 232 sequence of methods or tunnel. Similarly, the authenticator 233 demonstrates to the peer that it has acted as the 234 authenticator for each method within the sequence or tunnel. 235 If this is not possible, then the authentication sequence or 236 tunnel may be vulnerable to a man-in-the-middle attack. 238 Acknowledged result indications 239 The ability of the authenticator to provide the peer with an 240 indication of whether the peer has successfully authenticated 241 to it, and for the peer to acknowledge receipt, as well as 242 providing an indication of whether the authenticator has 243 successfully authenticated to the peer. Since EAP Success and 244 Failure packets are neither acknowledged nor integrity 245 protected, this claim requires implementation of a method- 246 specific result exchange that is integrity protected. 248 2. Extensible Authentication Protocol (EAP) 250 The EAP authentication exchange proceeds as follows: 252 [1] The authenticator sends a Request to authenticate the peer. The 253 Request has a type field to indicate what is being requested. 254 Examples of Request types include Identity, MD5-challenge, etc. 255 The MD5-challenge type corresponds closely to the CHAP 256 authentication protocol [RFC1994]. Typically, the authenticator 257 will send an initial Identity Request; however, an initial Identity 258 Request is not required, and MAY be bypassed. For example, the 259 identity may not be required where it is determined by the port to 260 which the peer has connected (leased lines, dedicated switch or 261 dial-up ports); or where the identity is obtained in another 262 fashion (via calling station identity or MAC address, in the Name 263 field of the MD5-Challenge Response, etc.). 265 [2] The peer sends a Response packet in reply to a valid Request. As 266 with the Request packet, the Response packet contains a Type field 267 which corresponds to the Type field of the Request. 269 [3] The authenticator sends an additional Request packet, and the peer 270 replies with a Response. The sequence of Requests and Responses 271 continues as long as needed. 273 [4] The conversation continues until the authenticator cannot 274 authenticate the peer (unacceptable Responses to one or more 275 Requests), in which case the authenticator implementation MUST 276 transmit an EAP Failure. Alternatively, the authentication 277 conversation can continue until the authenticator determines that 278 successful authentication has occurred, in which case the 279 authenticator MUST transmit an EAP Success. 281 Since EAP is a peer-to-peer protocol, an independent and simultaneous 282 authentication may take place in the reverse direction. Both peers may 283 act as authenticators and authenticatees at the same time. 285 Advantages 287 The EAP protocol can support multiple authentication mechanisms 288 without having to pre-negotiate a particular one. 290 Devices (e.g. a NAS, switch or access point) do not have to 291 understand each authentication method and MAY act as a pass-through 292 agent for a backend authentication server. Support for pass-through 293 is optional. An authenticator MAY authenticate local users while at 294 the same time acting as a pass-through for non-local users and 295 authentication methods it does not implement locally. 297 For sessions in which the authenticator acts as a pass-through, it 298 MUST determine the outcome of the authentication solely based on the 299 Accept/Reject indication sent by the backend authentication server; 300 the outcome MUST NOT be determined by the contents of an EAP packet 301 sent along with the Accept/Reject indication, or the absence of such 302 an encapsulated EAP packet. 304 Separation of the authenticator from the backend authentication 305 server simplifies credentials management and policy decision making. 307 Disadvantages 309 For use in PPP, EAP does require the addition of a new authentication 310 type to PPP LCP and thus PPP implementations will need to be modified 311 to use it. It also strays from the previous PPP authentication model 312 of negotiating a specific authentication mechanism during LCP. 313 Similarly, switch or access point implementations need to support 314 [IEEE8021X] in order to use EAP. 316 Where the authenticator is separate from the backend authentication 317 server, this complicates the security analysis and, if needed, key 318 distribution. 320 2.1. Support for sequences 322 An EAP conversation MAY utilize a sequence of methods. A common example 323 of this is an Identity request followed by a single EAP authentication 324 method such as an MD5-Challenge. However, within or associated with each 325 EAP server, it is not anticipated that a particular named peer will 326 utilize multiple authentication methods (Type 4 or greater), either by 327 supporting a choice of methods or by using multiple methods in sequence. 328 This would make the peer vulnerable to attacks that negotiate the least 329 secure method from among a set (negotiation attacks, described in 330 Section 7.8) or man-in-the-middle attacks (described in Section 7.4). 331 Instead, for each named peer there SHOULD be an indication of exactly 332 one method used to authenticate that peer name. If a peer needs to make 333 use of different authentication methods under different circumstances, 334 then distinct identities SHOULD be employed, each of which identifies 335 exactly one authentication method. 337 If additional authentication methods are required beyond the initial 338 one, the authenticator MAY send a Request packet for a subsequent 339 authentication method, or it MAY send another Identity request. If the 340 peer does not support additional methods, it SHOULD respond with a Nak, 341 indicating no acceptable alternative, as described in Section 5.3. 342 However, peer implementations MAY not respond at all, in which case a 343 timeout will result and authentication will fail. Since the 344 authenticator presumably requires successful completion of the sequence 345 in order to grant access, authentication failure is the correct result. 346 Therefore, it is not necessary for the authenticator to determine that 347 the peer supports sequences prior to sending a Request for a subsequent 348 authentication method. 350 The above prescription also applies in the situation where an 351 authenticator sends a message of a different Type prior to completion of 352 the final round of a given method. If the peer wishes to continue 353 authenticating with the method in progress, it SHOULD send a Nak in 354 response to such a Request, indicating the Type in progress as the 355 alternative. Otherwise it MAY send a Response with the same Type as the 356 Request. Since an EAP packet with a different Type may be sent by an 357 attacker, an authenticator receiving a Nak including a preference for 358 the Type in progress SHOULD log the event, but otherwise not take any 359 action. 361 Once a peer has sent a Response of the same Type as a Request, some 362 existing peer implementations might expect the method to run to 363 completion. As a result, these implementations silently discard EAP 364 Requests of a Type different from the method in progress, despite the 365 requirement for a Response in section 4.1. For this reason, EAP 366 authenticators that must interoperate with these peers are discouraged 367 from switching methods before the final round of a given method has 368 completed. 370 2.2. EAP multiplexing model 372 Conceptually, EAP implementations consist of the following components: 374 [a] Lower layer. The lower layer is responsible for transmitting and 375 receiving EAP frames between the peer and authenticator. EAP has 376 been run over a variety of lower layers including PPP; wired IEEE 377 802 LANs [IEEE8021X]; IEEE 802.11 wireless LANs [IEEE80211]; UDP 378 (L2TP [RFC2661] and ISAKMP [PIC]); and TCP [PIC]. Lower layer 379 behavior is discussed in Section 3. 381 [b] EAP layer. The EAP layer receives and transmits EAP packets via the 382 lower layer, implements the EAP state machine, and delivers and 383 receives EAP messages to and from EAP methods. 385 [c] EAP method. EAP methods implement the authentication algorithms and 386 receive and transmit EAP messages via the EAP layer. Since 387 fragmentation support is not provided by EAP itself, this is the 388 responsibility of EAP methods, which are discussed in Section 5. 390 The EAP multiplexing model is illustrated in figure 1 on the next page. 391 Note that there is no requirement that an implementation conform to this 392 model, as long as the on-the-wire behavior is consistent with it. 394 Within EAP, the Type field functions much like a port number in UDP or 395 TCP. With the exception of Types handled by the EAP layer, it is 396 assumed that the EAP layer multiplexes incoming EAP packets according to 397 their Type, and delivers them only to the EAP method corresponding to 398 that Type code, with one exception. 400 Since EAP methods may wish to access the Identity, the Identity Response 401 can be assumed to be stored within the EAP layer so as to be available 402 to methods of Types other than 1 (Identity). The Identity Type is 403 discussed in Section 5.1. 405 +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+ 406 | | | | | | 407 | EAP method| EAP method| | EAP method| EAP method| 408 | Type = X | Type = Y | | Type = X | Type = Y | 409 | ! | | | ^ | | 410 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 411 | ! | | ! | 412 | EAP ! Layer | | EAP ! Layer | 413 | ! | | ! | 414 | (Nak, ! Success, | | (Nak, ! Success, | 415 | ! Failure, | | ! Failure, | 416 | ! Notification, | | ! Notification, | 417 | ! Identity) | | ! Identity) | 418 | ! | | ! | 419 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 420 | ! | | ! | 421 | Lower ! Layer | | Lower ! Layer | 422 | ! | | ! | 423 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+ 424 ! ! 425 +------------>-------------+ 427 Figure 1. EAP Multiplexing Model 429 A Notification Response is only used as confirmation that the peer 430 received the Notification Request, not that it has processed it, or 431 displayed the message to the user. It cannot be assumed that the 432 contents of the Notification Request or Response is available to another 433 method. The Notification Type is discussed in Section 5.2. 435 The Nak method is utilized for the purposes of method negotiation. 436 Peers MUST respond to an EAP Request for an unacceptable Type with a Nak 437 Response. It cannot be assumed that the contents of the Nak Response is 438 available to another method. The Nak Type is discussed in Section 5.3. 440 EAP packets with codes of Success or Failure do not include a Type, and 441 therefore are not delivered to an EAP method. Success and Failure are 442 discussed in Section 4.2. 444 Given these considerations, the Success, Failure, Nak Response and 445 Notification Request/Response messages MUST NOT used to carry data 446 destined for delivery to other EAP methods. 448 3. Lower layer behavior 450 3.1. Lower layer requirements 452 EAP makes the following assumptions about lower layers: 454 [1] Lower layer CRC or checksum. In EAP, the authenticator retransmits 455 Requests that have not yet received Responses, so that EAP does not 456 assume that lower layers are reliable. Since EAP defines its own 457 retransmission behavior, when run over a reliable lower layer, it 458 is possible (though undesirable) for retransmission to occur both 459 in the lower layer and the EAP layer. 461 If lower layers exhibit a high loss rate, then retransmissions are 462 likely, and since EAP Success and Failure are not retransmitted, 463 timeouts are also likely to result. EAP methods such as EAP TLS 464 [RFC2716] include a message integrity check (MIC) and regard MIC 465 errors as fatal. Therefore if a checksum or CRC is not provided by 466 the lower layer, then some methods may not behave well. 468 [2] Lower layer data security. After EAP authentication is complete, 469 the peer will typically transmit data to the network, through the 470 authenticator. In order to provide assurance that the peer 471 transmitting data is the one that successfully completed EAP 472 authentication, it is necessary for the lower layer to provide per- 473 packet integrity, authentication and replay protection that is 474 bound to the original EAP authentication, or for the lower layer to 475 be physically secure. Otherwise it is possible for subsequent data 476 traffic to be hijacked, or replayed. 478 As a result of these considerations, EAP SHOULD be used only when 479 lower layers provide physical security for data (e.g. wired PPP or 480 IEEE 802 links), or for insecure links, where per-packet 481 authentication, integrity and replay protection is provided. Where 482 keying material for the lower layer ciphersuite is itself provided 483 by EAP, typically the lower layer ciphersuite cannot be enabled 484 until late in the EAP conversation, after key derivation has 485 completed. Thus it may only be possible to use the lower layer 486 ciphersuite to protect a portion of the EAP conversation, such as 487 the EAP Success or Failure packet. 489 [3] Known MTU. The EAP layer does not support fragmentation and 490 reassembly. However, EAP methods SHOULD be capable of handling 491 fragmentation and reassembly. As a result, EAP is capable of 492 functioning across a range of MTU sizes, as long as the MTU is 493 known. 495 [4] Possible duplication. Where the lower layer is reliable, it will 496 provide the EAP layer with a non-duplicated stream of packets. 497 However, while it is desirable that lower layers provide for non- 498 duplication, this is not a requirement. The Identifier field 499 provides both the peer and authenticator with the ability to detect 500 duplicates. 502 [5] Ordering guarantees. EAP does not require the Identifier to be 503 monotonically increasing, and so is reliant on lower layer ordering 504 guarantees for correct operation. Also, EAP was originally defined 505 to run on PPP and [RFC1661] Section 1 has an ordering requirement: 507 "The Point-to-Point Protocol is designed for simple links which 508 transport packets between two peers. These links provide full- 509 duplex simultaneous bi-directional operation, and are assumed to 510 deliver packets in order." 512 Lower lower transports for EAP MUST preserve ordering between a 513 source and destination, at a given priority level (the level of 514 ordering guarantee provided by [IEEE802]). 516 3.2. EAP usage within PPP 518 In order to establish communications over a point-to-point link, each 519 end of the PPP link must first send LCP packets to configure the data 520 link during Link Establishment phase. After the link has been 521 established, PPP provides for an optional Authentication phase before 522 proceeding to the Network-Layer Protocol phase. 524 By default, authentication is not mandatory. If authentication of the 525 link is desired, an implementation MUST specify the Authentication- 526 Protocol Configuration Option during Link Establishment phase. 528 The server can use the identification of the connecting host or router 529 in the selection of options for network layer negotiations. 531 When implemented within PPP, EAP does not select a specific 532 authentication mechanism at PPP Link Control Phase, but rather postpones 533 this until the Authentication Phase. This allows the authenticator to 534 request more information before determining the specific authentication 535 mechanism. This also permits the use of a "back-end" server which 536 actually implements the various mechanisms while the PPP authenticator 537 merely passes through the authentication exchange. The PPP Link 538 Establishment and Authentication phases, and the Authentication-Protocol 539 Configuration Option, are defined in The Point-to-Point Protocol (PPP) 540 [RFC1661]. 542 3.2.1. PPP Configuration Option Format 544 A summary of the PPP Authentication-Protocol Configuration Option format 545 to negotiate the EAP Authentication Protocol is shown below. The fields 546 are transmitted from left to right. 548 Exactly one EAP packet is encapsulated in the Information field of a PPP 549 Data Link Layer frame where the protocol field indicates type hex C227 550 (PPP EAP). 552 0 1 2 3 553 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 554 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 555 | Type | Length | Authentication-Protocol | 556 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 558 Type 560 3 562 Length 564 4 566 Authentication-Protocol 568 C227 (Hex) for PPP Extensible Authentication Protocol (EAP) 570 3.3. EAP usage within IEEE 802 572 The encapsulation of EAP over IEEE 802 is defined in [IEEE8021X]. The 573 IEEE 802 encapsulation of EAP does not involve PPP, and IEEE 802.1X does 574 not include support for link or network layer negotiations. As a result, 575 within IEEE 802.1X it is not possible to negotiate non-EAP 576 authentication mechanisms, such as PAP or CHAP [RFC1994]. 578 3.4. Link layer indications 580 The reliability and security of link layer indications is dependent on 581 the medium. Link layer failure indications accepted by the link layer 582 and provided to EAP MUST be processed. However, link layer success 583 indications MUST NOT result in an EAP implementation concluding that 584 authentication has succeeded, since these indications are typically 585 unauthenticated. 587 In PPP, link layer indications are not authenticated and are therefore 588 subject to spoofing, provided that the attacker can gain access to the 589 physical medium. This includes LCP-Terminate (a link failure 590 indication), NCP (a link success indication), and "link down" (a link 591 failure indication). 593 In IEEE 802 wired networks, the IEEE 802.1X EAPOL-Start and EAPOL-Logoff 594 frames are not authenticated or integrity protected, whereas within 595 802.11, authentication and integrity protection is possible depending on 596 when they are sent and the ciphersuite that has been negotiated. 597 Therefore, depending on the circumstances, EAPOL-Start and EAPOL-Logoff 598 frames may or may not be subject to authenticated and integrity 599 protected. 601 In 802.11 a "link down" indication is an unreliable indication of link 602 failure, since wireless signal strength can come and go and may be 603 influenced by radio frequency interference generated by an attacker. In 604 802.11, control and management frames are not authenticated and an 605 attacker within range can gain access to the physical medium. Link layer 606 indications include Disassociate and Deauthenticate frames (link failure 607 indications), and Association and Reassociation Response frames (link 608 success indications). 610 4. EAP Packet format 612 A summary of the EAP packet format is shown below. The fields are 613 transmitted from left to right. 615 0 1 2 3 616 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 617 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 618 | Code | Identifier | Length | 619 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 620 | Data ... 621 +-+-+-+-+ 623 Code 624 The Code field is one octet and identifies the type of EAP packet. 625 EAP Codes are assigned as follows: 627 1 Request 628 2 Response 629 3 Success 630 4 Failure 632 Since EAP only defines Codes 1-4, EAP packets with other codes MUST 633 be silently discarded by both authenticators and peers. 635 Identifier 637 The Identifier field is one octet and aids in matching Responses with 638 Requests. 640 Length 642 The Length field is two octets and indicates the length of the EAP 643 packet including the Code, Identifier, Length and Data fields. 644 Octets outside the range of the Length field should be treated as 645 Data Link Layer padding and should be ignored on reception. 647 Data 649 The Data field is zero or more octets. The format of the Data field 650 is determined by the Code field. 652 4.1. Request and Response 654 Description 656 The Request packet (Code field set to 1) MUST be sent by the 657 authenticator to the peer; the peer MUST NOT send Request packets to 658 the authenticator. Each Request has a Type field which serves to 659 indicate what is being requested. Additional Request packets MUST be 660 sent until a valid Response packet is received, or an optional retry 661 counter expires. In [IEEE8021X], the retry counter is effectively set 662 to zero, so that retransmission never occurs, and instead the peer 663 times out and authentication is restarted. 665 Retransmitted Requests MUST be sent with the same Identifier value in 666 order to distinguish them from new Requests. The contents of the data 667 field is dependent on the Request type. The peer MUST send a 668 Response packet in reply to a valid Request packet. Responses MUST 669 only be sent in reply to a valid Request and never retransmitted on a 670 timer. 672 The Identifier field of the Response MUST match that of the Request; 673 if it does not match, then the Response MUST be silently discarded. 674 Authenticators receiving a Response with a Type other than Nak, for 675 which the authenticator has no outstanding Request MUST silently 676 discard the Response. 678 The authenticator MUST NOT send a new Request until a valid Response 679 is received to an outstanding Request. Since the authenticator can 680 retransmit before receiving a valid Response from the peer, the 681 authenticator can receive duplicate Responses. The authenticator MUST 682 silently discard these duplicate Responses. 684 If a Message Integrity Check (MIC) is employed within an EAP method, 685 then implementations MUST silently discard any message that fails 686 this check. In this document, the descriptions of EAP message 687 handling assume that MIC validation is effectively performed as 688 though it occurs before examining any of the EAP message fields (such 689 as 'Code'). 691 Implementation Note: These obligations apply regardless of whether 692 pass-through is implemented. The authenticator is responsible for 693 retransmitting Request messages. If the Request message is 694 obtained from elsewhere (such as from a backend authentication 695 server), then the authenticator will need to save a copy of the 696 Request in order to accomplish this. The authenticator is also 697 responsible for discarding Response messages with the wrong 698 Identifier value before acting on them in any way, including 699 passing them on to the backend authentication server for 700 verification. Similarly, the peer is responsible for detecting and 701 handling duplicate Request messages before processing them in any 702 way, including passing them on to an outside party. 704 Because the authentication process will often involve user input, 705 some care must be taken when deciding upon retransmission 706 strategies and authentication timeouts. By default, where EAP is 707 run over an unreliable lower layer, the EAP retransmission timer 708 (EAP_RTO) SHOULD be computed as described in [RFC2988]. This 709 includes use of Karn's algorithm to filter RTT estimates resulting 710 from retransmissions. A maximum of 3-5 retransmissions is 711 suggested. 713 When run over a reliable lower layer (e.g. EAP over ISAKMP/TCP, as 714 within [PIC]), the EAP retransmission timer SHOULD be set to an 715 infinite value, so that retransmissions do not occur at the EAP 716 layer. 718 Where the authentication process requires user input, the measured 719 round trip times are largely be determined by user responsiveness 720 rather than network characteristics, so that RTO estimation is not 721 helpful. Instead, the retransmission timers SHOULD be set so as 722 to provide sufficient time for the user to respond, with longer 723 timeouts required in certain cases, such as where Token Cards are 724 involved. 726 In order to provide the EAP authenticator with guidance as to the 727 appropriate timeout value, a hint can be communicated to the 728 authenticator by the backend authentication server (such as via 729 the RADIUS Session-Timeout attribute). 731 A summary of the Request and Response packet format is shown below. 732 The fields are transmitted from left to right. 734 0 1 2 3 735 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 736 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 737 | Code | Identifier | Length | 738 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 739 | Type | Type-Data ... 740 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 742 Code 744 1 for Request 745 2 for Response 747 Identifier 749 The Identifier field is one octet. The Identifier field MUST be the 750 same if a Request packet is retransmitted due to a timeout while 751 waiting for a Response. Any new (non-retransmission) Requests MUST 752 modify the Identifier field. In order to avoid confusion between new 753 Requests and retransmissions, the Identifier value chosen for each 754 new Request need only be different from the previous Request, but 755 need not be unique within the conversation. One way to achieve this 756 is to start the Identifier at an initial value and increment it for 757 each new Request. Initializing the first Identifier with a random 758 number rather than starting from zero is recommended, since it makes 759 sequence attacks somewhat harder. 761 Since the Identifier space is unique to each session, authenticators 762 are not restricted to only 256 simultaneous authentication 763 conversations. Similarly, with re-authentication, an EAP conversation 764 might continue over a long period of time, and is not limited to only 765 256 roundtrips. 767 If a peer receives a valid duplicate Request for which it has already 768 sent a Response, it MUST resend its original Response. If a peer 769 receives a duplicate Request before it has sent a Response, but after 770 it has determined the initial Request to be valid (i.e. it is 771 waiting for user input), it MUST silently discard the duplicate 772 Request. An EAP message may be found invalid for a variety of 773 reasons: failed lower layer CRC or checksum, malformed EAP packet, 774 EAP method MIC failure, etc. 776 Length 778 The Length field is two octets and indicates the length of the EAP 779 packet including the Code, Identifier, Length, Type, and Type-Data 780 fields. Octets outside the range of the Length field should be 781 treated as Data Link Layer padding and should be ignored on 782 reception. 784 Type 786 The Type field is one octet. This field indicates the Type of 787 Request or Response. A single Type MUST be specified for each EAP 788 Request or Response. Normally, the Type field of the Response will 789 be the same as the Type of the Request. However, there is also a Nak 790 Response Type for indicating that a Request type is unacceptable to 791 the peer. An initial specification of Types follows in a later 792 section of this document. 794 Type-Data 796 The Type-Data field varies with the Type of Request and the 797 associated Response. 799 4.2. Success and Failure 801 The Success packet is sent by the authenticator to the peer to 802 acknowledge successful authentication. The authenticator MUST 803 transmit an EAP packet with the Code field set to 3 (Success). If 804 the authenticator cannot authenticate the peer (unacceptable 805 Responses to one or more Requests) then the implementation MUST 806 transmit an EAP packet with the Code field set to 4 (Failure). An 807 authenticator MAY wish to issue multiple Requests before sending a 808 Failure response in order to allow for human typing mistakes. 809 Success and Failure packets MUST NOT contain additional data. 811 Implementation Note: Because the Success and Failure packets are 812 not acknowledged, the authenticator cannot know whether they have 813 been received. As a result, these packets are not retransmitted by 814 the authenticator, and if they are lost, the peer will timeout. If 815 acknowledged success and failure indications are desired, these 816 MAY be implemented within individual EAP methods. 818 A summary of the Success and Failure packet format is shown below. 819 The fields are transmitted from left to right. 821 0 1 2 3 822 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 823 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 824 | Code | Identifier | Length | 825 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 827 Code 829 3 for Success 830 4 for Failure 832 Identifier 834 The Identifier field is one octet and aids in matching replies to 835 Responses. The Identifier field MUST match the Identifier field of 836 the Response packet that it is sent in response to. 838 Length 840 4 842 4.2.1. Processing of success and failure 844 Within EAP, success and failure indications consist of the EAP Success 845 and Failure messages, as well as method-specific indications. Within 846 EAP, these indications may be protected or unprotected. 848 EAP Success and Failure packets are considered unprotected indications 849 which may be spoofed, since as described in Section 4.2, they contain no 850 message integrity check (MIC). 852 In order to provide additional protection against tampering, EAP methods 853 MAY support a MIC that covers some or all of the EAP packet, including 854 headers. In addition, such a MIC MAY include coverage of previous 855 Request and Response messages, so as to enable protection of other 856 packets to that do not contain MICs, such as Identity Request/Response, 857 Notification Request/Response and Nak Response. 859 EAP methods also MAY include support for method-specific acknowledged 860 success and failure indications. This enables the authenticator to 861 indicate whether the peer has successfully authenticated, as well as for 862 the peer to acknowledge receipt of that indication, and respond with an 863 indication of whether the authenticator has successfully authenticated 864 to the peer. If a key has previously been derived, the result exchange 865 MAY be protected by a Message Integrity Check (MIC), and if so, then 866 this success/failure indication is considered protected. 868 In order to decrease vulnerability to spoofing of success and failure 869 indications, the following processing rules are recommended: 871 [a] Processing of protected success and failure indications. Where a 872 method-specific protected success/failure indication has been 873 received, the implementation MUST validate the EAP method MIC, with 874 a MIC failure handled via silent discard, as specified in Section 875 4.1. 877 [b] Receipt of EAP Success and Failure packets prior to method 878 completion. A peer EAP implementation receiving an EAP Success 879 packet prior to completion of the method in progress MUST silently 880 discard it. This ensures that a rogue authenticator will not be 881 able to bypass mutual authentication by sending an EAP Success 882 prior to conclusion of the EAP method conversation. A peer EAP 883 implementation receiving an EAP Failure packet prior to completion 884 of the method in progress MAY silently discard it. When using EAP 885 methods that provide their own (protected) error indications, 886 premature EAP Failure packets are unexpected, so that this 887 technique may be more readily employed. 889 [c] Authentication requirement. An EAP peer implementation that has 890 been configured to require authentication MUST silently discard a 891 "canned" EAP Success message (an EAP Success message sent 892 immediately upon connection). 894 [d] Contradictory indications. Where protected and unprotected result 895 indications are both available, protected indications take 896 precedence. For example, where an EAP method provides a protected 897 indication that authentication failure has occurred in either 898 direction, the implementation MUST silently discard subsequent EAP 899 Success packets. Similarly, where an EAP method provides a 900 protected indication that authentication has succeeded in both 901 directions, the EAP implementation MAY silently discard EAP Failure 902 packets. 904 [e] Processing of EAP Success and Failure in the absence of protected 905 indications. Subsequent to the completion of the EAP authentication 906 method (Types 4 and greater), and in the absence of protected 907 result indications, EAP Success and Failure packets MUST be 908 accepted and processed by the EAP implementation. 910 5. Initial EAP Request/Response Types 912 This section defines the initial set of EAP Types used in 913 Request/Response exchanges. More Types may be defined in follow-on 914 documents. The Type field is one octet and identifies the structure of 915 an EAP Request or Response packet. The first 3 Types are considered 916 special case Types. 918 The remaining Types define authentication exchanges. The Nak Type is 919 valid only for Response packets, it MUST NOT be sent in a Request. The 920 Nak Type MUST only be sent in response to a Request which uses an 921 authentication Type code (i.e., Type of 4 or greater). 923 All EAP implementations MUST support Types 1-4, which are defined in 924 this document, and SHOULD support Type 254. Follow-on RFCs MAY define 925 additional EAP Types. 927 1 Identity 928 2 Notification 929 3 Nak (Response only) 930 4 MD5-Challenge 931 5 One Time Password (OTP) 932 6 Generic Token Card (GTC) 933 254 Vendor-specific 934 255 Experimental use 936 5.1. Identity 938 Description 940 The Identity Type is used to query the identity of the peer. 941 Generally, the authenticator will issue this as the initial Request. 942 An optional displayable message MAY be included to prompt the peer in 943 the case where there expectation of interaction with a user. A 944 Response of Type 1 (Identity) SHOULD be sent in Response to a Request 945 with a Type of 1 (Identity). 947 Since Identity Requests and Responses are not protected, from a 948 security perspective, it may be preferable for protected method- 949 specific Identity exchanges to be used instead. 951 Implementation Note: The peer MAY obtain the Identity via user 952 input. It is suggested that the authenticator retry the Identity 953 Request in the case of an invalid Identity or authentication 954 failure to allow for potential typos on the part of the user. It 955 is suggested that the Identity Request be retried a minimum of 3 956 times before terminating the authentication phase with a Failure 957 reply. The Notification Request MAY be used to indicate an 958 invalid authentication attempt prior to transmitting a new 959 Identity Request (optionally, the failure MAY be indicated within 960 the message of the new Identity Request itself). 962 Type 964 1 966 Type-Data 968 This field MAY contain a displayable message in the Request, 969 containing UTF-8 encoded 10646 characters [RFC2279]. The Response 970 uses this field to return the Identity. If the Identity is unknown, 971 this field should be zero bytes in length. The field MUST NOT be 972 null terminated. The length of this field is derived from the Length 973 field of the Request/Response packet and hence a null is not 974 required. 976 5.2. Notification 978 Description 980 The Notification Type is optionally used to convey a displayable 981 message from the authenticator to the peer. An authenticator MAY send 982 a Notification Request to the peer at any time, The peer MUST respond 983 to a Notification Request with a Notification Response; a Nak 984 Response MUST NOT be sent. 986 The peer SHOULD display this message to the user or log it if it 987 cannot be displayed. The Notification Type is intended to provide an 988 acknowledged notification of some imperative nature, but it is not an 989 error indication, and therefore does not change the state of the 990 peer. Examples include a password with an expiration time that is 991 about to expire, an OTP sequence integer which is nearing 0, an 992 authentication failure warning, etc. In most circumstances, 993 Notification should not be required. 995 Type 997 2 999 Type-Data 1001 The Type-Data field in the Request contains a displayable message 1002 greater than zero octets in length, containing UTF-8 encoded 10646 1003 characters [RFC2279]. The length of the message is determined by 1004 Length field of the Request packet. The message MUST NOT be null 1005 terminated. A Response MUST be sent in reply to the Request with a 1006 Type field of 2 (Notification). The Type-Data field of the Response 1007 is zero octets in length. The Response should be sent immediately 1008 (independent of how the message is displayed or logged). 1010 5.3. Nak 1012 Description 1014 The Nak Type is valid only in Response messages. It is sent in reply 1015 to a Request where the desired authentication Type is unacceptable. 1016 Authentication Types are numbered 4 and above. The Response contains 1017 one or more authentication Types desired by the Peer. Type zero (0) 1018 is used to indicate that the sender has no viable alternatives. 1020 Since the Nak Type is only valid in Responses and has very limited 1021 functionality, it MUST NOT be used as a general purpose error 1022 indication, such as for communication of error messages, or 1023 negotiation of parameters specific to a particular EAP method. 1025 Code 1027 2 for Response. 1029 Identifier 1031 The Identifier field is one octet and aids in matching Responses with 1032 Requests. The Identifier field of a Nak Response MUST match the 1033 Identifier field of the Request packet that it is sent in response 1034 to. 1036 Length 1038 >=6 1040 Type 1042 3 1044 Type-Data 1046 Where the Request contains a Type within the original EAP Type space 1047 (1-253, 255), or the Request contains an expanded Type as defined in 1048 Section 5.7, but the peer does not support expanded Types, then the 1049 Type-Data field of the Nak Response MUST contain one or more octets 1050 indicating the desired authentication Type(s), one octet per Type, or 1051 the value zero (0) to indicate no proposed alternative. When the Nak 1052 Response includes as one of the Type(s) the value 254, this indicates 1053 an expanded Type of preference indicated by the relative order. If 1054 the authenticator can accomodate this preference, it will respond 1055 with a an expanded Type Request. 1057 If a peer supporting expanded Types receives an expanded Type 1058 Request, then the Type-Data field of the Nak Response, if sent, MUST 1059 contain one or more authentication Types, all of which MUST be in the 1060 format below (8 octets per Type). This includes the encoding of zero 1061 (0), to indicate no proposed alternative. See Section 5.7 for details 1062 on the Vendor-Id and Vendor-Type fields. If the peer does not 1063 support expanded Types, then the Type-Data field of the Nak Response 1064 MUST contain one or more authentication Type(s), one octet per Type, 1065 or the value zero (0) to indicate no proposed alternative. However, 1066 the value 254 MUST NOT be included as one of the preferred 1067 authentication Types. 1069 0 1 2 3 1070 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1071 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1072 | Type=254 | Vendor-Id | 1073 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1074 | Vendor-Type | 1075 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1077 5.4. MD5-Challenge 1079 Description 1081 The MD5-Challenge Type is analogous to the PPP CHAP protocol 1082 [RFC1994] (with MD5 as the specified algorithm). The Request 1083 contains a "challenge" message to the peer. A Response MUST be sent 1084 in reply to the Request. The Response MAY be either of Type 4 1085 (MD5-Challenge) or Type 3 (Nak). The Nak reply indicates the peer's 1086 desired authentication Type(s). EAP peer and EAP server 1087 implementations MUST support the MD5-Challenge mechanism. An 1088 authenticator that supports only pass-through MUST allow 1089 communication with a backend authentication server that is capable of 1090 supporting MD5-Challenge, although the EAP authenticator 1091 implementation need not support MD5-Challenge itself. However, if 1092 the EAP authenticator can be configured to authenticate peers via any 1093 non-pass-through mechanism, then the requirement applies. 1095 Note that the use of the Identifier field in the MD5-Challenge Type 1096 is different from that described in [RFC1994]. EAP allows for 1097 retransmission of MD5-Challenge Request packets while [RFC1994] 1098 states that both the Identifier and Challenge fields MUST change each 1099 time a Challenge (the CHAP equivalent of the MD5-Challenge Request 1100 packet) is sent. 1102 Type 1104 4 1106 Type-Data 1108 The contents of the Type-Data field is summarized below. For 1109 reference on the use of this fields see the PPP Challenge Handshake 1110 Authentication Protocol [RFC1994]. 1112 0 1 2 3 1113 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1114 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1115 | Value-Size | Value ... 1116 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1117 | Name ... 1118 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1120 Security Claims (see Section 7.3) 1122 Intended use: Wired networks, including PPP, PPPOE, and 1123 IEEE 802 wired media. Use over the Internet 1124 or with wireless media only when protected. 1125 Mechanism: Password or pre-shared key. 1126 Mutual authentication: No 1127 Integrity protection: No 1128 Replay protection: No 1129 Confidentiality: No 1130 Key Derivation: No 1131 Key strength: N/A 1132 Dictionary attack prot: No 1133 Key hierarchy: N/A 1134 Fast reconnect: No 1135 MiTM resistance: No 1136 Acknowledged S/F: No 1138 5.5. One-Time Password (OTP) 1140 Description 1142 The One-Time Password system is defined in "A One-Time Password 1143 System" [RFC2289] and "OTP Extended Responses" [RFC 2243]. The 1144 Request contains a displayable message containing an OTP challenge. 1145 A Response MUST be sent in reply to the Request. The Response MUST 1146 be of Type 5 (OTP) or Type 3 (Nak). The Nak Response indicates the 1147 peer's desired authentication Type(s). 1149 Type 1150 5 1152 Type-Data 1154 The Type-Data field contains the OTP "challenge" as a displayable 1155 message in the Request. In the Response, this field is used for the 6 1156 words from the OTP dictionary [RFC2289]. The messages MUST NOT be 1157 null terminated. The length of the field is derived from the Length 1158 field of the Request/Reply packet. 1160 Security Claims (see Section 7.3) 1162 Intended use: Wired networks, including PPP, PPPOE, and 1163 IEEE 802 wired media. Use over the Internet 1164 or with wireless media only when protected. 1165 Mechanism: One-Time Password 1166 Mutual authentication: No 1167 Integrity protection: No 1168 Replay protection: No 1169 Confidentiality: No 1170 Key Derivation: No 1171 Key strength: N/A 1172 Dictionary attack prot: No 1173 Key hierarchy: N/A 1174 Fast reconnect: No 1175 MiTM resistance: No 1176 Acknowledged S/F: No 1178 5.6. Generic Token Card (GTC) 1180 Description 1182 The Generic Token Card Type is defined for use with various Token 1183 Card implementations which require user input. The Request contains 1184 a displayable message and the Response contains the Token Card 1185 information necessary for authentication. Typically, this would be 1186 information read by a user from the Token card device and entered as 1187 ASCII text. A Response MUST be sent in reply to the Request. The 1188 Response MUST be of Type 6 (GTC) or Type 3 (Nak). The Nak Response 1189 indicates the peer's desired authentication Type(s). 1191 Type 1193 6 1195 Type-Data 1197 The Type-Data field in the Request contains a displayable message 1198 greater than zero octets in length. The length of the message is 1199 determined by Length field of the Request packet. The message MUST 1200 NOT be null terminated. A Response MUST be sent in reply to the 1201 Request with a Type field of 6 (Generic Token Card). The Response 1202 contains data from the Token Card required for authentication. The 1203 length is of the data is determined by the Length field of the 1204 Response packet. 1206 Security Claims (See Section 7.3) 1208 Intended use: Wired networks, including PPP, PPPOE, and 1209 IEEE 802 wired media. Use over the Internet 1210 wireless media only when protected. 1211 Mechanism: Hardware token. 1212 Mutual authentication: No 1213 Integrity protection: No 1214 Replay protection: No 1215 Confidentiality: No 1216 Key Derivation: No 1217 Key strength: N/A 1218 Dictionary attack prot: No 1219 Key hierarchy: N/A 1220 Fast reconnect: No 1221 MiTM resistance: No 1222 Acknowledged S/F: No 1224 5.7. Vendor-specific 1226 Description 1228 Due to EAP's popularity, the original Method Type space, which only 1229 provides for 255 values, is being allocated at a pace, which if 1230 continued, would result in exhaustion within a few years. Since many 1231 of the existing uses of EAP are vendor-specific, the Vendor-Specific 1232 Method Type is available to allow vendors to support their own 1233 extended Types not suitable for general usage. 1235 The Vendor-specific type is also used to expand the global Method 1236 Type space beyond the original 255 values. A Vendor-Id of 0 maps the 1237 original 255 possible types onto a namespace of 2^32-1 possible 1238 types, allowing for virtually unlimited expansion. (Note that type 0 1239 is never used.) 1241 An implementation that supports the Vendor-specific attribute MUST 1242 treat EAP types that are less than 256 equivalently whether they 1243 appear as a single octet or as the 32-bit Vendor-Type within a 1244 Vendor-specific type where Vendor-Id is 0. Peers not equipped to 1245 interpret the Vendor-specific Type MUST send a Nak as described in 1246 Section 5.3, and negotiate a more suitable authentication method. 1248 A summary of the Vendor-specific Type format is shown below. The 1249 fields are transmitted from left to right. 1251 0 1 2 3 1252 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1253 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1254 | Type | Vendor-Id | 1255 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1256 | Vendor-Type | 1257 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1258 | Vendor data... 1259 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1261 Type 1263 254 for Vendor-specific 1265 Vendor-Id 1267 The Vendor-Id is 3 octets and represents the SMI Network Management 1268 Private Enterprise Code of the Vendor in network byte order, as 1269 allocated by IANA. A Vendor-Id of zero is reserved for use by the 1270 IETF in providing an expanded global EAP Type space. 1272 Vendor-Type 1274 The Vendor-Type field is four octets and represents the vendor- 1275 specific Method Type. 1277 If Vendor-Id is zero, the Vendor-Type field is an extension and 1278 superset of the existing namespace for EAP types. The first 256 types 1279 are reserved for compatibility with single-octet EAP types that have 1280 already been assigned or may be assigned in the future. Thus, EAP 1281 types from 0 through 255 are semantically identical whether they 1282 appear as single octet EAP types or as Vendor-Types when Vendor-Id is 1283 zero. 1285 Vendor-Data 1287 The Vendor-Data field is defined by the vendor. Where a Vendor-Id of 1288 zero is present, the Vendor-Data field will be used for transporting 1289 the contents of EAP methods of Types defined by the IETF. 1291 6. IANA Considerations 1293 This section provides guidance to the Internet Assigned Numbers 1294 Authority (IANA) regarding registration of values related to the EAP 1295 protocol, in accordance with BCP 26, [RFC2434]. 1297 There are two name spaces in EAP that require registration: Packet Codes 1298 and Method Types. 1300 EAP is not intended as a general-purpose protocol, and allocations 1301 SHOULD NOT be made for purposes unrelated to authentication. 1303 6.1. Definition of Terms 1305 The following terms are used here with the meanings defined in BCP 26: 1306 "name space", "assigned value", "registration". 1308 The following policies are used here with the meanings defined in BCP 1309 26: "Private Use", "First Come First Served", "Expert Review", 1310 "Specification Required", "IETF Consensus", "Standards Action". 1312 6.2. Recommended Registration Policies 1314 For registration requests where a Designated Expert should be consulted, 1315 the responsible IESG area director should appoint the Designated Expert. 1316 For Designated Expert with Specification Required, the request is posted 1317 to the EAP WG mailing list (or, if it has been disbanded, a successor 1318 designated by the Area Director) for comment and review, and MUST 1319 include a pointer to a public specification. Before a period of 30 days 1320 has passed, the Designated Expert will either approve or deny the 1321 registration request and publish a notice of the decision to the EAP WG 1322 mailing list or its successor. A denial notice must be justified by an 1323 explanation and, in the cases where it is possible, concrete suggestions 1324 on how the request can be modified so as to become acceptable. 1326 For registration requests requiring Expert Review, the EAP mailing list 1327 should be consulted. If the EAP mailing list is no longer operational, 1328 an alternative mailing list may be designated by the responsible IESG 1329 Area Director. 1331 Packet Codes have a range from 1 to 255, of which 1-4 have been 1332 allocated. Because a new Packet Code has considerable impact on 1333 interoperability, a new Packet Code requires Standards Action, and 1334 should be allocated starting at 5. 1336 The original EAP Method Type space has a range from 1 to 255, and is the 1337 scarcest resource in EAP, and thus must be allocated with care. Method 1338 Types 1-36 have been allocated, with 20 available for re-use. Method 1339 Types 37-191 may be allocated following Designated Expert, with 1340 Specification Required. 1342 Release of blocks of Method Types (more than one for a given purpose) 1343 should require IETF Consensus. EAP Type Values 192-253 are reserved and 1344 allocation requires Standards Action. 1346 Method Type 254 is allocated for the Vendor-Specific Type. Where the 1347 Vendor-Id field is non-zero, the Vendor-Specific Type is used for 1348 functions specific only to one vendor's implementation of EAP, where no 1349 interoperability is deemed useful. When used with a Vendor-Id of zero, 1350 Method Type 254 can also be used to provide for an expanded Method Type 1351 space. Method Type values 256-4294967295 may be allocated after Type 1352 values 1-191 have been allocated. 1354 Method Type 255 is allocated for Experimental use, such as testing of 1355 new EAP methods before a permanent Type code is allocated. 1357 7. Security Considerations 1359 EAP was designed for use with dialup PPP [RFC1661] and wired [IEEE802] 1360 networks such as Ethernet [IEEE8023]. On these networks, an attacker 1361 would need to gain physical access to the telephone or switch 1362 infrastructure in order to mount an attack. While such attacks have been 1363 documented, such as in [DECEPTION], they are assumed to be rare. 1365 However, subsequently EAP has been proposed for use on wireless 1366 networks, and over the Internet, where physical security cannot be 1367 assumed. On such networks, the security vulnerabilities are greater, as 1368 are the requirements for EAP security. 1370 This section defines the threat model and security terms and describes 1371 the security claims section required in EAP method specifications. We 1372 then discuss threat mitigation. 1374 7.1. Threat model 1376 On physically insecure networks, it is possible for an attacker to gain 1377 access to the physical medium. This enables a range of attacks, 1378 including the following: 1380 [1] An adversary may try to discover user identities by snooping 1381 authentication traffic. 1383 [2] An adversary may try to modify or spoof EAP packets. 1385 [3] An adversary may launch denial of service attacks by spoofing layer 1386 2 indications or EAP layer success/failure indications, replaying 1387 EAP packets, or generating packets with overlapping Identifiers. 1389 [4] An adversary might attempt to recover the pass-phrase by mounting 1390 an offline dictionary attack. 1392 [5] An adversary may attempt to convince the peer to connect to an 1393 untrusted network, by mounting a man-in-the-middle attack. 1395 [6] An adversary may attempt to disrupt the EAP negotiation in order to 1396 weaken the authentication. 1398 [7] An attacker may attempt to recover the key by taking advantage of 1399 weak key derivation techniques used within EAP methods. 1401 [8] An attacker may attempt to take advantage of weak ciphersuites 1402 subsequently used after the EAP conversation is complete. 1404 Where EAP is used over wireless networks, an attacker needs to be within 1405 the coverage area of the wireless medium in order to carry out these 1406 attacks. However, where EAP is used over the Internet, no such 1407 restrictions apply. 1409 7.2. Security claims 1411 In order to clearly articulate the security provided by an EAP method, 1412 EAP method specifications MUST include a Security Claims section 1413 including the following declarations: 1415 [a] Intended use. This includes a statement of whether the method is 1416 intended for use over a physically secure or insecure network, as 1417 well as a statement of the applicable media. 1419 [b] Mechanism. This is a statement of the authentication technology: 1420 certificates, pre-shared keys, passwords, token cards, etc. 1422 [c] Security claims. This is a statement of the claimed security 1423 properties of the method, using terms defined in Section 1.2: 1424 mutual authentication, integrity protection, replay protection, 1425 confidentiality, key derivation, key strength, dictionary attack 1426 resistance, fast reconnect, man-in-the-middle resistance, 1427 acknowledged result indications. The Security Claims section 1428 SHOULD include references to proof, or the proof itself (preferably 1429 in an Appendix). 1431 [d] Key strength. If the method derives keys, then the effective key 1432 strength MUST be estimated. 1434 [e] Description of key hierarchy. EAP methods deriving keys MUST either 1435 provide a reference to a key hierarchy specification, or describe 1436 how keys used for authentication/integrity, encryption and IVs are 1437 to be derived from the provided keying material, and how 1438 cryptographic separation is maintained between keys used for 1439 different purposes. 1441 [f] Indication of vulnerabilities. In addition to the security claims 1442 that are made, the specification MUST indicate which of the 1443 security claims detailed in Section 1.2 are NOT being made, and 1444 discuss the security implications. 1446 7.3. Identity protection 1448 An Identity exchange is an optional within the EAP conversation. 1449 Therefore, it is possible to omit the Identity exchange entirely, or to 1450 postpone it until later in the conversation once a protected channel has 1451 been established. 1453 However, where roaming is supported as described in [RFC2607], it may be 1454 necessary to locate the appropriate backend authentication server before 1455 the authentication conversation can proceed. The realm portion of the 1456 Network Access Identifier (NAI) [RFC2486] is typically included within 1457 the Identity-Response in order to enable the authentication exchange to 1458 be routed to the appropriate backend authentication server. Therefore 1459 while the peer-name portion of the NAI may be omitted in the Identity- 1460 Response, where proxies or relays are present, the realm portion may be 1461 required. 1463 7.4. Man-in-the-middle attacks 1465 Where a sequence of methods is utilized for authentication or EAP is 1466 tunneled within another protocol that omits peer authentication, there 1467 exists a potential vulnerability to man-in-the-middle attack. 1469 Where a sequence of EAP methods is utilized for authentication, the peer 1470 might not have proof that a single entity has acted as the authenticator 1471 for all EAP methods within the sequence. For example, an authenticator 1472 might terminate one EAP method, then forward the next method in the 1473 sequence to another party without the peer's knowledge or consent. 1474 Similarly, the authenticator might not have proof that a single entity 1475 has acted as the peer for all EAP methods within the sequence. 1477 This enables an attack by a rogue EAP authenticator tunneling EAP to a 1478 legitimate server. Where the tunneling protocol is used for key 1479 establishment but does not require peer authentication, an attacker 1480 convincing a legitimate peer to connect to it will be able to tunnel EAP 1481 packets to a legitimate server, successfully authenticating and 1482 obtaining the key. This allows the attacker to successfully establish 1483 itself as a man-in-the-middle, gaining access to the network, as well as 1484 the ability to decrypt data traffic between the legitimate peer and 1485 server. 1487 This attack may be mitigated by the following measures: 1489 [a] Requiring mutual authentication within EAP tunneling mechanisms. 1491 [b] Requiring cryptographic binding between EAP methods executed within 1492 a sequence or between the EAP tunneling protocol and the tunneled 1493 EAP methods. Where cryptographic binding is supported, a mechanism 1494 is also needed to protect against downgrade attacks that would 1495 bypass it. 1497 [c] Limiting the EAP methods authorized for use without protection, 1498 based on peer and authenticator policy. 1500 [d] Avoiding the use of sequences or tunnels when a single, strong 1501 method is available. 1503 7.5. Packet modification attacks 1505 While individual EAP methods may support per-packet data origin 1506 authentication, integrity and replay protection, EAP itself does not 1507 provide built-in support for this. 1509 Since the Identifier is only a single octet, it is easy to guess, 1510 allowing an attacker to successfully inject or replay EAP packets. An 1511 attacker may also modify EAP headers within EAP packets where the header 1512 is unprotected. This could cause packets to be inappropriately discarded 1513 or misinterpreted. 1515 In the case of PPP and IEEE 802 wired links, it is assumed that such 1516 attacks are restricted to attackers who can gain access to the physical 1517 link. However, where EAP is run over physically insecure lower layers 1518 such as IEEE 802.11 or the Internet (such as within protocols supporting 1519 PPP, EAP or Ethernet Tunneling), this assumption is no longer valid and 1520 the vulnerability to attack is greater. 1522 To protect EAP messages sent over physically insecure lower layers, 1523 methods providing mutual authentication and key derivation, as well as 1524 per-packet origin authentication, integrity and replay protection SHOULD 1525 be used. Method-specific MICs may be used to provide protection. Since 1526 EAP messages of Types Identity, Notification, and Nak do not include 1527 their own MIC, it may be desirable for the EAP method MIC to cover 1528 information contained within these messages, as well as the header of 1529 each EAP message. 1531 To provide protection, EAP also may be encapsulated within a protected 1532 channel created by protocols such as ISAKMP [RFC2408] as is done in 1533 [PIC] or within TLS [RFC2246]. However, as noted in Section 7.4, EAP 1534 tunneling may result in a man-in-the-middle vulnerability. 1536 7.6. Dictionary attacks 1538 Password authentication algorithms such as EAP-MD5, MS-CHAPv1 [RFC2433] 1539 and Kerberos V [RFC1510] are known to be vulnerable to dictionary 1540 attacks. MS-CHAPv1 vulnerabilities are documented in [PPTPv1]; Kerberos 1541 vulnerabilities are described in [KRBATTACK], [KRBLIM], and [KERB4WEAK]. 1543 In order to protect against dictionary attacks, an authentication 1544 algorithm resistant to dictionary attack (as defined in Section 7.2) may 1545 be used. This is particularly important when EAP runs over media which 1546 are not physically secure. 1548 If an authentication algorithm is used that is known to be vulnerable to 1549 dictionary attack, then the conversation may be tunneled within a 1550 protected channel, in order to provide additional protection. However, 1551 as noted in Section 7.4, EAP tunneling may result in a man-in-the-middle 1552 vulnerability, and therefore dictionary attack resistant methods are 1553 preferred. 1555 7.7. Connection to an untrusted network 1557 With EAP methods supporting one-way authentication, such as EAP-MD5, the 1558 authenticator's identity is not verified. Where the lower layer is not 1559 physically secure (such as where EAP runs over wireless media or IP), 1560 this enables the peer to connect to a rogue authenticator. As a result, 1561 where the lower layer is not physically secure, a method supporting 1562 mutual authentication is recommended. 1564 In EAP there is no requirement that authentication be full duplex or 1565 that the same protocol be used in both directions. It is perfectly 1566 acceptable for different protocols to be used in each direction. This 1567 will, of course, depend on the specific protocols negotiated. However, 1568 in general, completing a single unitary mutual authentication is 1569 preferable to two one-way authentications, one in each direction. This 1570 is because separate authentications that are not bound cryptographically 1571 so as to demonstrate they are part of the same session are subject to 1572 man-in-the-middle attacks, as discussed in Section 7.4. 1574 7.8. Negotiation attacks 1576 In a negotiation attack, the attacker attempts to convince the peer and 1577 authenticator to negotiate a less secure EAP method. EAP does not 1578 provide protection for the Nak packet, although it is possible for a 1579 method to include coverage of Nak Responses within a method-specific 1580 MIC. 1582 To avoid negotiation attacks in situations where EAP runs over 1583 physically insecure media, for each named peer there SHOULD be an 1584 indication of exactly one method used to authenticate that peer name, as 1585 described in Section 2.1. 1587 7.9. Implementation idiosyncrasies 1589 The interaction of EAP with lower layer transports such as PPP and IEEE 1590 802 are highly implementation dependent. 1592 For example, upon failure of authentication, some PPP implementations do 1593 not terminate the link, instead limiting traffic in Network-Layer 1594 Protocols to a filtered subset, which in turn allows the peer the 1595 opportunity to update secrets or send mail to the network administrator 1596 indicating a problem. Similarly, while in IEEE 802.1X an authentication 1597 failure will result in denied access to the controlled port, limited 1598 traffic may be permitted on the uncontrolled port. 1600 In EAP there is no provision for retries of failed authentication. 1601 However, in PPP the LCP state machine can renegotiate the authentication 1602 protocol at any time, thus allowing a new attempt. Similarly, in IEEE 1603 802.1X the Supplicant or Authenticator can re-authenticate at any time. 1604 It is recommended that any counters used for authentication failure not 1605 be reset until after successful authentication, or subsequent 1606 termination of the failed link. 1608 7.10. Key derivation 1610 It is possible for the peer and EAP server to mutually authenticate, and 1611 derive a Master Key (MK). The MK is unique to the peer and EAP server 1612 and MUST NOT be exported by the EAP method, or used directly to protect 1613 the EAP conversation or subsequent data. As a result, possession of the 1614 MK represents proof of a successful authentication, and this is 1615 potentially useful in enabling features such as fast reconnect, or fast 1616 handoff. 1618 In order to provide keying material for use in a subsequently negotiated 1619 ciphersuite, the EAP method exports a Master Session Key (MSK). Like the 1620 EAP Master Key, EAP Master Session Keys are also not used directly to 1621 protect data; however, they are of sufficient size to enable subsequent 1622 derivation of Transient Session Keys (TSKs) for use with the selected 1623 ciphersuite. 1625 EAP methods provide Master Session Keys and not Transient Session Keys 1626 so as to allow EAP methods to be ciphersuite and media independent. 1628 Depending on the lower layer, EAP methods may run before or after 1629 ciphersuite negotiation, so that the selected ciphersuite may not be 1630 known to the EAP method. By providing keying material usable with any 1631 ciphersuite, EAP methods can used with a wide range of ciphersuites and 1632 media. Since the peer and EAP client reside on the same machine, TSKs 1633 can be provided to the lower layer security module without needing to 1634 leave the machine. 1636 In the case where the backend authentication server and authenticator 1637 reside on different machines, there are several implications for 1638 security: 1640 [a] Mutual authentication may occur between the peer and the backend 1641 authentication server, if the negotiated EAP method supports this. 1642 However, where the authenticator and backend authentication server 1643 are separate, the peer and authenticator do not mutually 1644 authenticate within EAP. However, subsequent to completion of the 1645 EAP conversation, the lower layer may support mutual authentication 1646 between the peer and authenticator. For example, IEEE 802.11i 1647 includes a Transient Session Key derivation protocol known as the 1648 4-way handshake, which guarantees liveness of the TSKs, provides 1649 for mutual authentication between the peer and authenticator, 1650 replay protection, and protected ciphersuite negotiation. 1652 [b] The MSK negotiated between the peer and backend authentication 1653 server will need to be transmitted to the authenticator. The 1654 specification of this transit mechanism is outside the scope of 1655 this document. 1657 This specification does not provide detailed guidance on how EAP methods 1658 are to derive the MK and MSK. Key derivation is an art that is best 1659 practiced by professionals; rather than inventing new key derivation 1660 algorithms, reuse of existing algorithms such as those specified in IKE 1661 [RFC2409], or TLS [RFC2246] is recommended. 1663 However, some general guidelines can be provided: 1665 [1] The MK is for use only by the EAP authenticator and peer and MUST 1666 NOT be exported by the EAP method or provided to a third party. 1668 [2] Since the MSK is exported by the EAP method, while the MK is not, 1669 possession of the MSK MUST NOT provide information useful in 1670 determining the MK. 1672 [3] The MSK and TSKs MUST be fresh. Otherwise it is infeasible to 1673 detect messages replayed from prior sessions. 1675 [4] TSKs MUST be cryptographically independent from each other so that 1676 if an attacker obtains one of them, it will not have gained 1677 information useful in determining the other ones. 1679 [5] There MUST be a way to determine whether TSKs belong to this or to 1680 some other session. 1682 [6] The MSK derived by EAP methods MUST be bound to the peers as well 1683 as to the authentication method, so as to avoid a man-in-the-middle 1684 attack (see Section 7.4). 1686 7.11. Weak ciphersuites 1688 If after the initial EAP authentication, data packets are sent without 1689 per-packet authentication, integrity, replay protection, an attacker 1690 with access to the media can inject packets, "flip bits" within existing 1691 packets, replay packets, or even hijack the session completely. Without 1692 per-packet confidentiality, it is possible to snoop data packets. 1694 As a result, as noted in Section 3.1, where EAP is used over a 1695 physically insecure lower layer, per-packet authentication, integrity 1696 and replay protection SHOULD be used, and per-packet confidentiality is 1697 also recommended. 1699 8. Normative references 1701 [RFC1661] Simpson, W., "The Point-to-Point Protocol (PPP)", STD 51, 1702 RFC 1661, July 1994. 1704 [RFC1994] Simpson, W., "PPP Challenge Handshake Authentication 1705 Protocol (CHAP)", RFC 1994, August 1996. 1707 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1708 Requirement Levels", RFC 2119, March 1997.] 1710 [RFC2243] Metz, C., "OTP Extended Responses", RFC 2243, November 1711 1997. 1713 [RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO 1714 10646", RFC 2279, January 1998. 1716 [RFC2289] Haller, N., Metz, C., Nesser, P., and Straw M., "A One- 1717 Time Password System", RFC 2289, February 1998. 1719 [RFC2434] Alvestrand, H. and Narten, T., "Guidelines for Writing an 1720 IANA Considerations Section in RFCs", BCP 26, RFC 2434, 1721 October 1998. 1723 [RFC2988] Paxson, V., Allman, M., "Computing TCP's Retransmission 1724 Timer", RFC 2988, November 2000. 1726 [IEEE802] IEEE Standards for Local and Metropolitan Area Networks: 1727 Overview and Architecture, ANSI/IEEE Std 802, 1990. 1729 [IEEE8021X] IEEE Standards for Local and Metropolitan Area Networks: 1730 Port based Network Access Control, IEEE Std 802.1X-2001, 1731 June 2001. 1733 9. Informative references 1735 [DECEPTION] Slatalla, M., and Quittner, J., "Masters of Deception." 1736 HarperCollins, New York, 1995. 1738 [RFC1510] Kohl, J., Neuman, C., "The Kerberos Network 1739 Authentication Service (V5)", RFC 1510, September 1993. 1741 [RFC2246] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0", 1742 RFC 2246, November 1998. 1744 [RFC2486] Beadles, M., Aboba, B., "The Network Access Identifier", 1745 RFC 2486, January 1999. 1747 [RFC2401] Atkinson, R., Kent, S., "Security Architecture for the 1748 Internet Protocol", RFC 2401, November 1998. 1750 [RFC2408] Maughan, D., Schertler, M., Schneider, M., Turner, J., 1751 "Internet Security Association and Key Management 1752 Protocol (ISAKMP)", RFC 2408, November 1998. 1754 [RFC2433] Zorn, G., Cobb, S., "Microsoft PPP CHAP Extensions", RFC 1755 2433, October 1998. 1757 [RFC2607] Aboba, B., Vollbrecht, J., "Proxy Chaining and Policy 1758 Implementation in Roaming", RFC 2607, June 1999. 1760 [RFC2661] Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, 1761 G., and Palter, B., "Layer Two Tunneling Protocol L2TP", 1762 RFC 2661, August 1999. 1764 [RFC2716] Aboba, B., Simon, D.,"PPP EAP TLS Authentication 1765 Protocol", RFC 2716, October 1999. 1767 [KRBATTACK] Wu, T., "A Real-World Analysis of Kerberos Password 1768 Security", Stanford University Computer Science 1769 Department, http://theory.stanford.edu/~tjw/krbpass.html 1771 [KRBLIM] Bellovin, S.M., Merritt, M., "Limitations of the Kerberos 1772 authentication system", Proceedings of the 1991 Winter 1773 USENIX Conference, pp. 253-267, 1991. 1775 [KERB4WEAK] Dole, B., Lodin, S., and Spafford, E., "Misplaced trust: 1776 Kerberos 4 session keys", Proceedings of the Internet 1777 Society Network and Distributed System Security 1778 Symposium, pp. 60-70, March 1997. 1780 [PIC] Sheffer, Y., Krawczyk, H., Aboba, B., "PIC, A Pre-IKE 1781 Credential Provisioning Protocol", Internet draft (work 1782 in progress), draft-ietf-ipsra-pic-06.txt, October 2002. 1784 [PPTPv1] Schneier, B, Mudge, "Cryptanalysis of Microsoft's Point- 1785 to- Point Tunneling Protocol", Proceedings of the 5th ACM 1786 Conference on Communications and Computer Security, ACM 1787 Press, November 1998. 1789 [IEEE8023] ISO/IEC 8802-3 Information technology - 1790 Telecommunications and information exchange between 1791 systems - Local and metropolitan area networks - Common 1792 specifications - Part 3: Carrier Sense Multiple Access 1793 with Collision Detection (CSMA/CD) Access Method and 1794 Physical Layer Specifications, (also ANSI/IEEE Std 802.3- 1795 1996), 1996. 1797 [IEEE80211] Information technology - Telecommunications and 1798 information exchange between systems - Local and 1799 metropolitan area networks - Specific Requirements Part 1800 11: Wireless LAN Medium Access Control (MAC) and 1801 Physical Layer (PHY) Specifications, IEEE Std. 1802 802.11-1999, 1999. 1804 Acknowledgments 1806 This protocol derives much of its inspiration from Dave Carrel's AHA 1807 draft as well as the PPP CHAP protocol [RFC1994]. Valuable feedback was 1808 provided by Yoshihiro Ohba of Toshiba America Research, Jari Arkko of 1809 Ericsson, Sachin Seth of Microsoft, and Glen Zorn of Cisco Systems. 1811 Authors' Addresses 1813 Larry J. Blunk 1814 Merit Network, Inc. 1815 4251 Plymouth Rd., Suite 2000 1816 Ann Arbor, MI 48105-2785 1818 EMail: ljb@merit.edu 1819 Phone: 734-647-9563 1820 Fax: 734-647-3185 1822 John R. Vollbrecht 1823 Vollbrecht Consulting LLC 1824 9682 Alice Hill Drive 1825 Dexter, MI 48130 1827 EMail: jrv@umich.edu 1829 Bernard Aboba 1830 Microsoft Corporation 1831 One Microsoft Way 1832 Redmond, WA 98052 1834 EMail: bernarda@microsoft.com 1835 Phone: +1 425 706 6605 1836 Fax: +1 425 936 6605 1838 James Carlson 1839 Sun Microsystems, Inc. 1840 1 Network Drive 1841 Burlington MA 01803-2757 1843 EMail: james.d.carlson@sun.com 1844 Phone: +1 781 442 2084 1845 Fax: +1 781 442 1677 1847 Intellectual Property Notices 1849 The IETF takes no position regarding the validity or scope of any 1850 intellectual property or other rights that might be claimed to pertain 1851 to the implementation or use of the technology described in this 1852 document or the extent to which any license under such rights might or 1853 might not be available; neither does it represent that it has made any 1854 effort to identify any such rights. Information on the IETF's 1855 procedures with respect to rights in standards-track and standards- 1856 related documentation can be found in BCP-11. Copies of claims of 1857 rights made available for publication and any assurances of licenses to 1858 be made available, or the result of an attempt made to obtain a general 1859 license or permission for the use of such proprietary rights by 1860 implementors or users of this specification can be obtained from the 1861 IETF Secretariat. 1863 The IETF invites any interested party to bring to its attention any 1864 copyrights, patents or patent applications, or other proprietary rights 1865 which may cover technology that may be required to practice this 1866 standard. Please address the information to the IETF Executive 1867 Director. 1869 Full Copyright Statement 1871 Copyright (C) The Internet Society (2003). All Rights Reserved. 1872 This document and translations of it may be copied and furnished to 1873 others, and derivative works that comment on or otherwise explain it or 1874 assist in its implementation may be prepared, copied, published and 1875 distributed, in whole or in part, without restriction of any kind, 1876 provided that the above copyright notice and this paragraph are included 1877 on all such copies and derivative works. However, this document itself 1878 may not be modified in any way, such as by removing the copyright notice 1879 or references to the Internet Society or other Internet organizations, 1880 except as needed for the purpose of developing Internet standards in 1881 which case the procedures for copyrights defined in the Internet 1882 Standards process must be followed, or as required to translate it into 1883 languages other than English. The limited permissions granted above are 1884 perpetual and will not be revoked by the Internet Society or its 1885 successors or assigns. This document and the information contained 1886 herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE 1887 INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR 1888 IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE 1889 INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 1890 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." 1892 Open issues 1894 Open issues relating to this specification are tracked on the following 1895 web site: 1897 http://www.drizzle.com/~aboba/EAP/eapissues.html 1899 Expiration Date 1901 This memo is filed as , and 1902 expires August 24, 2003.