[RFCs/IDs] [Plain Text] [Tracker] [WG] [Email] [Diff1] [Diff2] [Nits]
Versions: (RFC 2284) 00 01 02 03 04 05 06 07
08 09 RFC 3748
EAP Working Group L. Blunk
Internet-Draft Merit Network, Inc
Obsoletes: 2284 (if approved) J. Vollbrecht
Expires: May 27, 2004 Vollbrecht Consulting LLC
B. Aboba
Microsoft
J. Carlson
Sun
H. Levkowetz, Ed.
ipUnplugged
November 27, 2003
Extensible Authentication Protocol (EAP)
<draft-ietf-eap-rfc2284bis-07.txt>
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that other
groups may also distribute working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress".
The list of current Internet-Drafts can be accessed at http://
www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html
This Internet-Draft will expire on May 27, 2004.
Copyright Notice
Copyright (C) The Internet Society (2003). All Rights Reserved.
Abstract
This document defines the Extensible Authentication Protocol (EAP),
an authentication framework which supports multiple authentication
methods. EAP typically runs directly over data link layers such as
PPP or IEEE 802, without requiring IP. EAP provides its own support
for duplicate elimination and retransmission, but is reliant on lower
Blunk, et al. Expires May 27, 2004 [Page 1]
Internet-Draft EAP November 2003
layer ordering guarantees. Fragmentation is not supported within EAP
itself; however, individual EAP methods may support this.
This document obsoletes RFC 2284. A summary of the changes between
this document and RFC 2284 is available in Appendix A.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4
1.1 Specification of Requirements . . . . . . . . . . . . 4
1.2 Terminology . . . . . . . . . . . . . . . . . . . . . 4
1.3 Applicability . . . . . . . . . . . . . . . . . . . . 6
2. Extensible Authentication Protocol (EAP) . . . . . . . . . . 7
2.1 Support for sequences . . . . . . . . . . . . . . . . 9
2.2 EAP multiplexing model . . . . . . . . . . . . . . . . 10
2.3 Pass-through behavior . . . . . . . . . . . . . . . . 12
2.4 Peer-to-Peer Operation . . . . . . . . . . . . . . . . 14
3. Lower layer behavior . . . . . . . . . . . . . . . . . . . . 15
3.1 Lower layer requirements . . . . . . . . . . . . . . . 15
3.2 EAP usage within PPP . . . . . . . . . . . . . . . . . 17
3.2.1 PPP Configuration Option Format . . . . . . . . 18
3.3 EAP usage within IEEE 802 . . . . . . . . . . . . . . 19
3.4 Lower layer indications . . . . . . . . . . . . . . . 19
4. EAP Packet format . . . . . . . . . . . . . . . . . . . . . 20
4.1 Request and Response . . . . . . . . . . . . . . . . . 21
4.2 Success and Failure . . . . . . . . . . . . . . . . . 23
4.3 Retransmission Behavior . . . . . . . . . . . . . . . 26
5. Initial EAP Request/Response Types . . . . . . . . . . . . . 27
5.1 Identity . . . . . . . . . . . . . . . . . . . . . . . 28
5.2 Notification . . . . . . . . . . . . . . . . . . . . . 29
5.3 Nak . . . . . . . . . . . . . . . . . . . . . . . . . 31
5.3.1 Legacy Nak . . . . . . . . . . . . . . . . . . . 31
5.3.2 Expanded Nak . . . . . . . . . . . . . . . . . . 32
5.4 MD5-Challenge . . . . . . . . . . . . . . . . . . . . 35
5.5 One-Time Password (OTP) . . . . . . . . . . . . . . . 37
5.6 Generic Token Card (GTC) . . . . . . . . . . . . . . . 38
5.7 Expanded Types . . . . . . . . . . . . . . . . . . . . 39
5.8 Experimental . . . . . . . . . . . . . . . . . . . . . 40
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . 41
6.1 Packet Codes . . . . . . . . . . . . . . . . . . . . . 42
6.2 Method Types . . . . . . . . . . . . . . . . . . . . . 42
7. Security Considerations . . . . . . . . . . . . . . . . . . 42
7.1 Threat model . . . . . . . . . . . . . . . . . . . . . 43
7.2 Security claims . . . . . . . . . . . . . . . . . . . 44
7.2.1 Security claims terminology for EAP methods . . 45
7.3 Identity protection . . . . . . . . . . . . . . . . . 47
7.4 Man-in-the-middle attacks . . . . . . . . . . . . . . 48
7.5 Packet modification attacks . . . . . . . . . . . . . 49
Blunk, et al. Expires May 27, 2004 [Page 2]
Internet-Draft EAP November 2003
7.6 Dictionary attacks . . . . . . . . . . . . . . . . . . 50
7.7 Connection to an untrusted network . . . . . . . . . . 50
7.8 Negotiation attacks . . . . . . . . . . . . . . . . . 51
7.9 Implementation idiosyncrasies . . . . . . . . . . . . 51
7.10 Key derivation . . . . . . . . . . . . . . . . . . . . 51
7.11 Weak ciphersuites . . . . . . . . . . . . . . . . . . 53
7.12 Link layer . . . . . . . . . . . . . . . . . . . . . . 54
7.13 Separation of authenticator and backend authentication
server . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
7.14 Cleartext Passwords . . . . . . . . . . . . . . . . . 56
7.15 Channel binding . . . . . . . . . . . . . . . . . . . 56
8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . 57
Normative References . . . . . . . . . . . . . . . . . . . . 57
Informative References . . . . . . . . . . . . . . . . . . . 58
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 62
A. Changes from RFC 2284 . . . . . . . . . . . . . . . . . . . 63
B. Open issues . . . . . . . . . . . . . . . . . . . . . . . . 64
Intellectual Property and Copyright Statements . . . . . . . 66
Blunk, et al. Expires May 27, 2004 [Page 3]
Internet-Draft EAP November 2003
1. Introduction
This document defines the Extensible Authentication Protocol (EAP),
an authentication framework which supports multiple authentication
methods. EAP typically runs directly over data link layers such as
PPP or IEEE 802, without requiring IP. EAP provides its own support
for duplicate elimination and retransmission, but is reliant on lower
layer ordering guarantees. Fragmentation is not supported within EAP
itself; however, individual EAP methods may support this.
EAP may be used on dedicated links as well as switched circuits, and
wired as well as wireless links. To date, EAP has been implemented
with hosts and routers that connect via switched circuits or dial-up
lines using PPP [RFC1661]. It has also been implemented with
switches and access points using IEEE 802 [IEEE-802]. EAP
encapsulation on IEEE 802 wired media is described in [ Internet-Draft EAP November 2003 Control"'>IEEE-802.1X],
and encapsulation on IEEE wireless LANs in [ Internet-Draft EAP November 2003 Systems - LAN/MAN Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications: Specification for Enhanced Security"'>IEEE-802.11i].
One of the advantages of the EAP architecture is its flexibility. EAP
is used to select a specific authentication mechanism, typically
after the authenticator requests more information in order to
determine the specific authentication method to be used. Rather than
requiring the authenticator to be updated to support each new
authentication method, EAP permits the use of a backend
authentication server which may implement some or all authentication
methods, with the authenticator acting as a pass-through for some or
all methods and peers.
Within this document, authenticator requirements apply regardless of
whether the authenticator is operating as a pass-through or not.
Where the requirement is meant to apply to either the authenticator
or backend authentication server, depending on where the EAP
authentication is terminated, the term "EAP server" will be used.
1.1 Specification of Requirements
In this document, several words are used to signify the requirements
of the specification. These words are often capitalized. The key
words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD",
"SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document
are to be interpreted as described in [RFC2119].
1.2 Terminology
This document frequently uses the following terms:
Blunk, et al. Expires May 27, 2004 [Page 4]
Internet-Draft EAP November 2003
authenticator
The end of the link initiating EAP authentication. The term
Authenticator is used in [ Internet-Draft EAP November 2003 Control"'>IEEE-802.1X], and authenticator
has the same meaning in this document.
peer
The end of the link that responds to the authenticator. In
[ Internet-Draft EAP November 2003 Control"'>IEEE-802.1X], this end is known as the Supplicant.
backend authentication server
A backend authentication server is an entity that provides
an authentication service to an authenticator. When used,
this server typically executes EAP methods for the
authenticator. This terminology is also used in
[ Internet-Draft EAP November 2003 Control"'>IEEE-802.1X].
AAA
Authentication, Authorization and Accounting. AAA
protocols with EAP support include RADIUS [RFC3579] and
Diameter [DIAM-EAP]. In this document, the terms "AAA
server" and "backend authentication server" are used
interchangeably.
Displayable Message
This is interpreted to be a human readable string of
characters. The message encoding MUST follow the UTF-8
transformation format [RFC2279].
EAP server
The entity that terminates the EAP authentication method
with the peer. In the case where no backend authentication
server is used, the EAP server is part of the
authenticator. In the case where the authenticator
operates in pass-through mode, the EAP server is located on
the backend authentication server.
Silently Discard
This means the implementation discards the packet without
further processing. The implementation SHOULD provide the
capability of logging the event, including the contents of
the silently discarded packet, and SHOULD record the event
in a statistics counter.
Successful authentication
In the context of this document, "successful
authentication" is an exchange of EAP messages, as a result
of which the authenticator decides to allow access by the
peer, and the peer decides to use this access. The
Blunk, et al. Expires May 27, 2004 [Page 5]
Internet-Draft EAP November 2003
authenticator's decision typically involves both
authentication and authorization aspects; the peer may
successfully authenticate to the authenticator but access
may be denied by the authenticator due to policy reasons.
Message Integrity Check (MIC)
A keyed hash function used for authentication and integrity
protection of data. This is usually called a Message
Authentication Code (MAC), but IEEE 802 specifications (and
this document) use the acronym MIC to avoid confusion with
Medium Access Control.
Cryptographic separation
Two keys (x and y) are "cryptographically separate" if an
adversary that knows all messages exchanged in the protocol
cannot compute x from y or y from x without "breaking" some
cryptographic assumption. In particular, this definition
allows that the adversary has the knowledge of all nonces
sent in cleartext as well as all predictable counter values
used in the protocol. Breaking a cryptographic assumption
would typically require inverting a one-way function or
predicting the outcome of a cryptographic pseudo-random
number generator without knowledge of the secret state. In
other words, if the keys are cryptographically separate,
there is no shortcut to compute x from y or y from x, but
the work an adversary must do to perform this computation
is equivalent to performing exhaustive search for the
secret state value.
Master Session Key (MSK)
Keying material that is derived between the EAP peer and
server and exported by the EAP method. The MSK is at least
64 octets in length. In existing implementations a AAA
server acting as an EAP server transports the MSK to the
authenticator.
Extended Master Session Key (EMSK)
Additional keying material derived between the EAP client
and server that is exported by the EAP method. The EMSK is
at least 64 octets in length. The EMSK is reserved for
future uses that are not defined yet and is not provided to
a third party.
1.3 Applicability
EAP is an authentication framework primarily for use in situations
such as network access, in which IP layer connectivity may not be
Blunk, et al. Expires May 27, 2004 [Page 6]
Internet-Draft EAP November 2003
available.
Since the goal of EAP is to support authentication without requiring
IP connectivity, it provides just enough support for the reliable
transport of authentication protocols, and no more. EAP is a
lock-step protocol and does not support an efficient reliable
transport service as in TCP [RFC793] or SCTP [RFC2960]. While EAP
provides support for retransmission, it assumes ordering guarantees
provided by the lower layer, so that out of order reception is not
supported.
As noted in Section 3.1, EAP does not support fragmentation and
reassembly as in IP, although EAP methods may provide support for
this. As a result, authentication protocols generating payloads
larger than the EAP MTU will need to be modified in order to provide
fragmentation support.
EAP authentication is initiated by the authenticator, whereas many
authentication protocols are initiated by the client (peer). As a
result, it may be necessary for an algorithm to add 0.5 - 1
additional roundtrips between the client and authenticator in order
to run over EAP.
As a result, an authentication algorithm will typically require more
round-trips when run over EAP than when run directly over IP.
Additionally, certificate-based authentication algorithms using long
certificate chains can result in many round-trips due to
fragmentation.
Where EAP runs over a lower layer in which significant packet loss is
experienced, or where the connection between the authenticator and
authentication server experiences significant packet loss, EAP
methods requiring many round-trips may experience difficulties. In
these situations, use of EAP methods with fewer round trips is
advisable.
Where transport efficiency is a consideration, and IP transport is
available, it may be preferable to expose an artificially high EAP
MTU to EAP and allow fragmentation to take place in IP.
Alternatively, it is possible to choose other security mechanisms
such as TLS [RFC2246] or IKE [RFC2409] or an alternative
authentication framework such as SASL [RFC2222] or GSS-API [RFC2743].
2. Extensible Authentication Protocol (EAP)
The EAP authentication exchange proceeds as follows:
Blunk, et al. Expires May 27, 2004 [Page 7]
Internet-Draft EAP November 2003
[1] The authenticator sends a Request to authenticate the peer. The
Request has a Type field to indicate what is being requested.
Examples of Request Types include Identity, MD5-challenge, etc.
The MD5-challenge Type corresponds closely to the CHAP
authentication protocol [RFC1994]. Typically, the authenticator
will send an initial Identity Request; however, an initial
Identity Request is not required, and MAY be bypassed. For
example, the identity may not be required where it is determined
by the port to which the peer has connected (leased lines,
dedicated switch or dial-up ports); or where the identity is
obtained in another fashion (via calling station identity or MAC
address, in the Name field of the MD5-Challenge Response, etc.).
[2] The peer sends a Response packet in reply to a valid Request. As
with the Request packet the Response packet contains a Type
field, which corresponds to the Type field of the Request.
[3] The authenticator sends an additional Request packet, and the
peer replies with a Response. The sequence of Requests and
Responses continues as long as needed. EAP is a 'lock step'
protocol, so that other than the initial Request, a new Request
cannot be sent prior to receiving a valid Response. The
authenticator is responsible for retransmitting requests as
described in Section 4.1. After a suitable number of
retransmissions, the authenticator SHOULD end the EAP
conversation. The authenticator MUST NOT send a Success or
Failure packet when retransmitting or when it fails to get a
response from the peer.
[4] The conversation continues until the authenticator cannot
authenticate the peer (unacceptable Responses to one or more
Requests), in which case the authenticator implementation MUST
transmit an EAP Failure (Code 4). Alternatively, the
authentication conversation can continue until the authenticator
determines that successful authentication has occurred, in which
case the authenticator MUST transmit an EAP Success (Code 3).
Advantages:
o The EAP protocol can support multiple authentication mechanisms
without having to pre-negotiate a particular one.
o Network Access Server (NAS) devices (e.g., a switch or access
point) do not have to understand each authentication method and
MAY act as a pass-through agent for a backend authentication
server. Support for pass-through is optional. An authenticator
MAY authenticate local peers while at the same time acting as a
pass-through for non-local peers and authentication methods it
Blunk, et al. Expires May 27, 2004 [Page 8]
Internet-Draft EAP November 2003
does not implement locally.
o Separation of the authenticator from the backend authentication
server simplifies credentials management and policy decision
making.
Disadvantages:
o For use in PPP, EAP does require the addition of a new
authentication Type to PPP LCP and thus PPP implementations will
need to be modified to use it. It also strays from the previous
PPP authentication model of negotiating a specific authentication
mechanism during LCP. Similarly, switch or access point
implementations need to support [ Internet-Draft EAP November 2003 Control"'>IEEE-802.1X] in order to use EAP.
o Where the authenticator is separate from the backend
authentication server, this complicates the security analysis and,
if needed, key distribution.
2.1 Support for sequences
An EAP conversation MAY utilize a sequence of methods. A common
example of this is an Identity request followed by a single EAP
authentication method such as an MD5-Challenge. However the peer and
authenticator MUST utilize only one authentication method (Type 4 or
greater) within an EAP conversation, after which the authenticator
MUST send a Success or Failure packet.
Once a peer has sent a Response of the same Type as the initial
Request, an authenticator MUST NOT send a Request of a different Type
prior to completion of the final round of a given method (with the
exception of a Notification-Request) and MUST NOT send a Request for
an additional method of any Type after completion of the initial
authentication method; a peer receiving such Requests MUST treat them
as invalid, and silently discard them. As a result, Identity Requery
is not supported.
A peer MUST NOT send a Nak (legacy or expanded) in reply to a
Request, after an initial non-Nak Response has been sent. Since
spoofed EAP Request packets may be sent by an attacker, an
authenticator receiving an unexpected Nak SHOULD discard it and log
the event.
Multiple authentication methods within an EAP conversation are not
supported due to their vulnerability to man-in-the-middle attacks
(see Section 7.4) and incompatibility with existing implementations.
Blunk, et al. Expires May 27, 2004 [Page 9]
Internet-Draft EAP November 2003
Where a single EAP authentication method is utilized, but other
methods are run within it (a "tunneled" method) the prohibition
against multiple authentication methods does not apply. Such
"tunneled" methods appear as a single authentication method to EAP.
Backward compatibility can be provided, since a peer not supporting a
"tunneled" method can reply to the initial EAP-Request with a Nak
(legacy or expanded). To address security vulnerabilities,
"tunneled" methods MUST support protection against man-in-the-middle
attacks.
2.2 EAP multiplexing model
Conceptually, EAP implementations consist of the following
components:
[a] Lower layer. The lower layer is responsible for transmitting and
receiving EAP frames between the peer and authenticator. EAP has
been run over a variety of lower layers including PPP; wired IEEE
802 LANs [ Internet-Draft EAP November 2003 Control"'>IEEE-802.1X] ; IEEE 802.11 wireless LANs [IEEE-802.11];
UDP ( L2TP [RFC2661] and IKEv2 [IKEv2]); and TCP [PIC]. Lower
layer behavior is discussed in Section 3.
[b] EAP layer. The EAP layer receives and transmits EAP packets via
the lower layer, implements duplicate detection and
retransmission, and delivers and receives EAP messages to and
from the EAP peer and authenticator layers.
[c] EAP peer and authenticator layers. Based on the Code field, the
EAP layer demultiplexes incoming EAP packets to the EAP peer and
authenticator layers. Typically an EAP implementation on a given
host will support either peer or authenticator functionality, but
it is possible for a host to act as both an EAP peer and
authenticator. In such an implementation both EAP peer and
authenticator layers will be present.
[d] EAP method layers. EAP methods implement the authentication
algorithms and receive and transmit EAP messages via the EAP peer
and authenticator layers. Since fragmentation support is not
provided by EAP itself, this is the responsibility of EAP
methods, which are discussed in Section 5.
The EAP multiplexing model is illustrated in Figure 1 below. Note
that there is no requirement that an implementation conform to this
model, as long as the on-the-wire behavior is consistent with it.
Blunk, et al. Expires May 27, 2004 [Page 10]
Internet-Draft EAP November 2003
+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+
| | | | | |
| EAP method| EAP method| | EAP method| EAP method|
| Type = X | Type = Y | | Type = X | Type = Y |
| V | | | ^ | |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
| ! | | ! |
| EAP ! Peer layer | | EAP ! Auth. layer |
| ! | | ! |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
| ! | | ! |
| EAP ! layer | | EAP ! layer |
| ! | | ! |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
| ! | | ! |
| Lower ! layer | | Lower ! layer |
| ! | | ! |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
! !
! Peer ! Authenticator
+------------>-------------+
Figure 1: EAP Multiplexing Model
Within EAP, the Code field functions much like a protocol number in
IP. It is assumed that the EAP layer demultiplexes incoming EAP
packets according to the Code field. Received EAP packets with
Code=1 (Request), 3 (Success) and 4 (Failure) are delivered by the
EAP layer to the EAP peer layer, if implemented. EAP packets with
Code=2 (Response) are delivered to the EAP authenticator layer, if
implemented.
Within EAP, the Type field functions much like a port number in UDP
or TCP. It is assumed that the EAP peer and authenticator layers
demultiplex incoming EAP packets according to their Type, and deliver
them only to the EAP method corresponding to that Type. An EAP
method implementation on a host may register to receive packets from
the peer or authenticator layers, or both, depending on which role(s)
it supports.
Since EAP authentication methods may wish to access the Identity,
implementations SHOULD make the Identity Request and Response
accessible to authentication methods (Types 4 or greater) in addition
to the Identity method. The Identity Type is discussed in Section
5.1.
A Notification Response is only used as confirmation that the peer
received the Notification Request, not that it has processed it, or
Blunk, et al. Expires May 27, 2004 [Page 11]
Internet-Draft EAP November 2003
displayed the message to the user. It cannot be assumed that the
contents of the Notification Request or Response is available to
another method. The Notification Type is discussed in Section 5.2.
Nak (Type 3) or Expanded Nak (Type 254) are utilized for the purposes
of method negotiation. Peers respond to an initial EAP Request for
an unacceptable Type with a Nak Response (Type 3) or Expanded Nak
Response (Type 254). It cannot be assumed that the contents of the
Nak Response(s) are available to another method. The Nak Type(s) are
discussed in Section 5.3.
EAP packets with Codes of Success or Failure do not include a Type
field, and are not delivered to an EAP method. Success and Failure
are discussed in Section 4.2.
Given these considerations, the Success, Failure, Nak Response(s) and
Notification Request/Response messages MUST NOT be used to carry data
destined for delivery to other EAP methods.
2.3 Pass-through behavior
When operating as a "pass-through authenticator", an authenticator
performs checks on the Code, Identifier and Length fields as
described in Section 4.1. It forwards EAP packets received from the
peer and destined to its authenticator layer to the backend
authentication server; packets received from the backend
authentication server destined to the peer are forwarded to it.
A host receiving an EAP packet may only do one of three things with
it: act on it, drop it, or forward it. The forwarding decision is
typically based only on examination of the Code, Identifier and
Length fields. A pass-through authenticator implementation MUST be
capable of forwarding to the backend authentication server EAP
packets received from the peer with Code=2 (Response). It also MUST
be capable of receiving EAP packets from the backend authentication
server and forwarding EAP packets of Code=1 (Request), Code=3
(Success), and Code=4 (Failure) to the peer.
Unless the authenticator implements one or more authentication
methods locally which support the authenticator role, the EAP method
layer header fields (Type, Type-Data) are not examined as part of the
forwarding decision. Where the authenticator supports local
authentication methods, it MAY examine the Type field to determine
whether to act on the packet itself or forward it. Compliant
pass-through authenticator implementations MUST by default forward
EAP packets of any Type.
EAP packets received with Code=1 (Request), Code=3 (Success), and
Blunk, et al. Expires May 27, 2004 [Page 12]
Internet-Draft EAP November 2003
Code=4 (Failure) are demultiplexed by the EAP layer and delivered to
the peer layer. Therefore unless a host implements an EAP peer layer,
these packets will be silently discarded. Similarly, EAP packets
received with Code=2 (Response) are demultiplexed by the EAP layer
and delivered to the authenticator layer. Therefore unless a host
implements an EAP authenticator layer, these packets will be silently
discarded. The behavior of a "pass-through peer" is undefined within
this specification, and is unsupported by AAA protocols such as
RADIUS [RFC3579] and Diameter [DIAM-EAP].
The forwarding model is illustrated in Figure 2.
Peer Pass-through Authenticator Authentication
Server
+-+-+-+-+-+-+ +-+-+-+-+-+-+
| | | |
|EAP method | |EAP method |
| V | | ^ |
+-+-+-!-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-!-+-+-+
| ! | |EAP | EAP | | | ! |
| ! | |Peer | Auth.| EAP Auth. | | ! |
|EAP ! peer| | | +-----------+ | |EAP !Auth.|
| ! | | | ! | ! | | ! |
+-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
| ! | | ! | ! | | ! |
|EAP !layer| | EAP !layer| EAP !layer | |EAP !layer|
| ! | | ! | ! | | ! |
+-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
| ! | | ! | ! | | ! |
|Lower!layer| | Lower!layer| AAA ! /IP | | AAA ! /IP |
| ! | | ! | ! | | ! |
+-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
! ! ! !
! ! ! !
+-------->--------+ +--------->-------+
Figure 2: Pass-through Authenticator
For sessions in which the authenticator acts as a pass-through, it
MUST determine the outcome of the authentication solely based on the
Accept/Reject indication sent by the backend authentication server;
the outcome MUST NOT be determined by the contents of an EAP packet
sent along with the Accept/Reject indication, or the absence of such
an encapsulated EAP packet.
Blunk, et al. Expires May 27, 2004 [Page 13]
Internet-Draft EAP November 2003
2.4 Peer-to-Peer Operation
Since EAP is a peer-to-peer protocol, an independent and simultaneous
authentication may take place in the reverse direction (depending on
the capabilities of the lower layer). Both peers may act as
authenticators and authenticatees at the same time, in which case it
is necessary for both peers to implement EAP authenticator and peer
layers. In addition, the EAP method implementations on both peers
must support both authenticator and peer functionality.
Although EAP supports peer-to-peer operation, some EAP
implementations, methods, AAA protocols and link layers may not
support this. Some EAP methods may support asymmetric
authentication, with one type of credential being required for the
peer and another type for the authenticator. Hosts supporting
peer-to-peer operation with such a method would need to be
provisioned with both types of credentials.
For example, EAP-TLS [RFC2716] is a client-server protocol with a
different certificate profile for the client and server. This
implies that a host supporting peer-to-peer authentication with
EAP-TLS would need to implement both the EAP peer and authenticator
layers; support both peer and authenticator roles in the EAP-TLS
implementation; and provision two distinct certificates, one
appropriate for each role.
AAA protocols such as RADIUS/EAP [RFC3579] and Diameter EAP
[DIAM-EAP] only support "passthrough authenticator" operation. As
noted in [RFC3579] Section 2.6.2, a RADIUS server responds to an
Access-Request encapsulating an EAP-Request, Success or Failure
packet with an Access-Reject. There is therefore no support for
"passthrough peer" operation.
Even where a method is used which supports mutual authentication and
protected result indications, several considerations may dictate that
two EAP authentications, (one in each direction) are required. These
include:
[1] Support for bi-directional session key derivation in the lower
layer. Lower layers such as IEEE 802.11 may only support
uni-directional derivation and transport of transient session
keys. For example, the group-key handshake defined in
[ Internet-Draft EAP November 2003 Systems - LAN/MAN Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications: Specification for Enhanced Security"'>IEEE-802.11i] is uni-directional, since in IEEE 802.11
infrastructure mode only the Access Point (AP) sends multicast/
broadcast traffic. In IEEE 802.11 ad-hoc mode where either peer
may send multicast/broadcast traffic, two uni-directional
group-key exchanges are required. Due to limitations of the
design, this also implies the need for unicast key derivations
Blunk, et al. Expires May 27, 2004 [Page 14]
Internet-Draft EAP November 2003
and EAP method exchanges to occur in each direction.
[2] Support for tie-breaking in the lower layer. Lower layers such
as IEEE 802.11 adhoc do not support "tie breaking" wherein two
hosts initiating authentication with each other will only go
forward with a single authentication. This implies that even if
802.11 were to support a bi-directional group-key handshake, then
two authentications, one in each direction, might still occur.
[3] Peer policy satisfaction. EAP methods may support protected
result indications, enabling the peer to indicate to the EAP
server that it successfully authenticated the EAP server.
However, a pass-through authenticator will not be aware that the
peer has accepted the credentials offered by the EAP server,
unless this information is provided to the authenticator via the
AAA protocol. As a result, two authentications, one in each
direction, may still be needed.
It is also possible that the EAP peer's access policy was not
satisfied during the EAP method exchange. For example, the
authenticator may not have successfully authenticated to the
peer, or may not have demonstrated authorization to act in both
peer and server roles. For example, in EAP-TLS [RFC2716], the
authenticator may have authenticated using a valid TLS server
certificate, but not using a valid TLS client certificate. As a
result, the peer may require an additional authentication in the
reverse direction, even if the peer provided a protected result
indication to the EAP server indicating that the server had
successfully authenticated to it.
3. Lower layer behavior
3.1 Lower layer requirements
EAP makes the following assumptions about lower layers:
[1] Unreliable transport. In EAP, the authenticator retransmits
Requests that have not yet received Responses, so that EAP does
not assume that lower layers are reliable. Since EAP defines its
own retransmission behavior, it is possible (though undesirable)
for retransmission to occur both in the lower layer and the EAP
layer when EAP is run over a reliable lower layer.
Note that EAP Success and Failure packets are not retransmitted.
Without a reliable lower layer, and a non-negligible error rate,
these packets can be lost, resulting in timeouts. It is therefore
desirable for implementations to improve their resilience to loss
Blunk, et al. Expires May 27, 2004 [Page 15]
Internet-Draft EAP November 2003
of EAP Success or Failure packets, as described in Section 4.2.
[2] Lower layer error detection. While EAP does not assume that the
lower layer is reliable, it does rely on lower layer error
detection (e.g., CRC, Checksum, MIC, etc.). EAP methods may not
include a MIC, or if they do, it may not be computed over all the
fields in the EAP packet, such as the Code, Identifier, Length or
Type fields. As a result, without lower layer error detection,
undetected errors could creep into the EAP layer or EAP method
layer header fields, resulting in authentication failures.
For example, EAP TLS [RFC2716], which computes its MIC over the
Type-Data field only, regards MIC validation failures as a fatal
error. Without lower layer error detection, this method and
others like it will not perform reliably.
[3] Lower layer security. EAP assumes that lower layers either
provide physical security (e.g., wired PPP or IEEE 802 links) or
support per-packet authentication, integrity and replay
protection. EAP SHOULD NOT be used on physically insecure links
(e.g., wireless or the Internet) where subsequent data is not
protected by per-packet authentication, integrity and replay
protection.
[4] Minimum MTU. EAP is capable of functioning on lower layers that
provide an EAP MTU size of 1020 octets or greater.
EAP does not support path MTU discovery, and fragmentation and
reassembly is not supported by EAP, nor by the methods defined in
this specification: the Identity (1), Notification (2), Nak
Response (3), MD5-Challenge (4), One Time Password (5), Generic
Token Card (6) and expanded Nak Response (254) Types.
Typically, the EAP peer obtains information on the EAP MTU from
the lower layers and sets the EAP frame size to an appropriate
value. Where the authenticator operates in pass-through mode,
the authentication server does not have a direct way of
determining the EAP MTU, and therefore relies on the
authenticator to provide it with this information, such as via
the Framed-MTU attribute, as described in [RFC3579], Section 2.4.
While methods such as EAP-TLS [RFC2716] support fragmentation and
reassembly, EAP methods originally designed for use within PPP
where a 1500 octet MTU is guaranteed for control frames (see
[RFC1661], Section 6.1) may lack fragmentation and reassembly
features.
EAP methods can assume a minimum EAP MTU of 1020 octets, in the
Blunk, et al. Expires May 27, 2004 [Page 16]
Internet-Draft EAP November 2003
absence of other information. EAP methods SHOULD include support
for fragmentation and reassembly if their payloads can be larger
than this minimum EAP MTU.
EAP is a lock-step protocol, which implies a certain inefficiency
when handling fragmentation and reassembly. Therefore if the
lower layer supports fragmentation and reassembly (such as where
EAP is transported over IP), it may be preferable for
fragmentation and reassembly to occur in the lower layer rather
than in EAP. This can be accomplished by providing an
artificially large EAP MTU to EAP, causing fragmentation and
reassembly to be handled within the lower layer.
[5] Possible duplication. Where the lower layer is reliable, it will
provide the EAP layer with a non-duplicated stream of packets.
However, while it is desirable that lower layers provide for
non-duplication, this is not a requirement. The Identifier field
provides both the peer and authenticator with the ability to
detect duplicates.
[6] Ordering guarantees. EAP does not require the Identifier to be
monotonically increasing, and so is reliant on lower layer
ordering guarantees for correct operation. EAP was originally
defined to run on PPP, and [RFC1661] Section 1 has an ordering
requirement:
"The Point-to-Point Protocol is designed for simple links
which transport packets between two peers. These links
provide full-duplex simultaneous bi-directional operation, and
are assumed to deliver packets in order."
Lower layer transports for EAP MUST preserve ordering between a
source and destination, at a given priority level (the ordering
guarantee provided by [IEEE-802]).
Reordering, if it occurs, will typically result in an EAP
authentication failure, causing EAP authentication to be rerun.
In an environment in which reordering is likely, it is therefore
expected that EAP authentication failures will be common. It is
RECOMMENDED that EAP only be run over lower layers that provide
ordering guarantees; running EAP over raw IP or UDP transport is
NOT RECOMMENDED. Encapsulation of EAP within RADIUS [RFC3579]
satisfies ordering requirements, since RADIUS is a "lockstep"
protocol that delivers packets in order.
Blunk, et al. Expires May 27, 2004 [Page 17]
Internet-Draft EAP November 2003
3.2 EAP usage within PPP
In order to establish communications over a point-to-point link, each
end of the PPP link must first send LCP packets to configure the data
link during Link Establishment phase. After the link has been
established, PPP provides for an optional Authentication phase before
proceeding to the Network-Layer Protocol phase.
By default, authentication is not mandatory. If authentication of
the link is desired, an implementation MUST specify the
Authentication Protocol Configuration Option during Link
Establishment phase.
If the identity of the peer has been established in the
Authentication phase, the server can use that identity in the
selection of options for the following network layer negotiations.
When implemented within PPP, EAP does not select a specific
authentication mechanism at PPP Link Control Phase, but rather
postpones this until the Authentication Phase. This allows the
authenticator to request more information before determining the
specific authentication mechanism. This also permits the use of a
"backend" server which actually implements the various mechanisms
while the PPP authenticator merely passes through the authentication
exchange. The PPP Link Establishment and Authentication phases, and
the Authentication Protocol Configuration Option, are defined in The
Point-to-Point Protocol (PPP) [RFC1661].
3.2.1 PPP Configuration Option Format
A summary of the PPP Authentication Protocol Configuration Option
format to negotiate EAP is shown below. The fields are transmitted
from left to right.
Exactly one EAP packet is encapsulated in the Information field of a
PPP Data Link Layer frame where the protocol field indicates type hex
C227 (PPP EAP).
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Authentication Protocol |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Blunk, et al. Expires May 27, 2004 [Page 18]
Internet-Draft EAP November 2003
Type
3
Length
4
Authentication Protocol
C227 (Hex) for Extensible Authentication Protocol (EAP)
3.3 EAP usage within IEEE 802
The encapsulation of EAP over IEEE 802 is defined in [ Internet-Draft EAP November 2003 Control"'>IEEE-802.1X].
The IEEE 802 encapsulation of EAP does not involve PPP, and IEEE
802.1X does not include support for link or network layer
negotiations. As a result, within IEEE 802.1X it is not possible to
negotiate non-EAP authentication mechanisms, such as PAP or CHAP
[RFC1994].
3.4 Lower layer indications
The reliability and security of lower layer indications is dependent
on the lower layer. Since EAP is media independent, the presence or
absence of lower layer security is not taken into account in the
processing of EAP messages.
To improve reliability, if a peer receives a lower layer success
indication as defined in Section 7.2, it MAY conclude that a Success
packet has been lost, and behave as if it had actually received a
Success packet. This includes choosing to ignore the Success in some
circumstances as described in Section 4.2.
A discussion of some reliability and security issues with lower layer
indications in PPP, IEEE 802 wired networks and IEEE 802.11 wireless
LANs can be found in the Security Considerations, Section 7.12.
After EAP authentication is complete, the peer will typically
transmit data to the network via the authenticator. In order to
provide assurance that the peer transmitting data is the same entity
that successfully completed EAP authentication, the lower layer needs
to bind per-packet integrity, authentication and replay protection to
the original EAP authentication, using keys derived during EAP
authentication. Alternatively, the lower layer needs to be
physically secure. Otherwise it is possible for subsequent data
traffic to be hijacked or replayed.
Blunk, et al. Expires May 27, 2004 [Page 19]
Internet-Draft EAP November 2003
As a result of these considerations, EAP SHOULD be used only when
lower layers provide physical security for data (e.g., wired PPP or
IEEE 802 links), or for insecure links, where per-packet
authentication, integrity and replay protection is provided.
Where keying material for the lower layer ciphersuite is itself
provided by EAP, ciphersuite negotiation and key activation is
controlled by the lower layer. In PPP, ciphersuites are negotiated
within ECP so that it is not possible to use keys derived from EAP
authentication until the completion of ECP. Therefore an initial EAP
exchange cannot protected by a PPP ciphersuite, although EAP
re-authentication can be protected.
In IEEE 802 media, initial key activation also typically occurs after
completion of EAP authentication. Therefore an initial EAP exchange
typically cannot be protected by the lower layer ciphersuite,
although an EAP re-authentication or pre-authentication exchange can
be protected.
4. EAP Packet format
A summary of the EAP packet format is shown below. The fields are
transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code | Identifier | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data ...
+-+-+-+-+
Code
The Code field is one octet and identifies the Type of EAP packet.
EAP Codes are assigned as follows:
1 Request
2 Response
3 Success
4 Failure
Since EAP only defines Codes 1-4, EAP packets with other codes
MUST be silently discarded by both authenticators and peers.
Blunk, et al. Expires May 27, 2004 [Page 20]
Internet-Draft EAP November 2003
Identifier
The Identifier field is one octet and aids in matching Responses
with Requests.
Length
The Length field is two octets and indicates the length of the EAP
packet including the Code, Identifier, Length and Data fields.
Octets outside the range of the Length field should be treated as
Data Link Layer padding and MUST be ignored on reception. A
message with the Length field set to a value larger than the
number of received octets MUST be silently discarded.
Data
The Data field is zero or more octets. The format of the Data
field is determined by the Code field.
4.1 Request and Response
Description
The Request packet (Code field set to 1) is sent by the
authenticator to the peer. Each Request has a Type field which
serves to indicate what is being requested. Additional Request
packets MUST be sent until a valid Response packet is received, or
an optional retry counter expires.
Retransmitted Requests MUST be sent with the same Identifier value
in order to distinguish them from new Requests. The content of the
data field is dependent on the Request Type. The peer MUST send a
Response packet in reply to a valid Request packet. Responses
MUST only be sent in reply to a valid Request and never
retransmitted on a timer.
If a peer receives a valid duplicate Request for which it has
already sent a Response, it MUST resend its original Response
without reprocessing the Request. Requests MUST be processed in
the order that they are received, and MUST be processed to their
completion before inspecting the next Request.
A summary of the Request and Response packet format is shown below.
The fields are transmitted from left to right.
0 1 2 3
Blunk, et al. Expires May 27, 2004 [Page 21]
Internet-Draft EAP November 2003
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code | Identifier | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Type-Data ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
Code
1 for Request
2 for Response
Identifier
The Identifier field is one octet. The Identifier field MUST be
the same if a Request packet is retransmitted due to a timeout
while waiting for a Response. Any new (non-retransmission)
Requests MUST modify the Identifier field.
The Identifier field of the Response MUST match that of the
currently outstanding Request. An authenticator receiving a
Response whose Identifier value does not match that of the
currently outstanding Request MUST silently discard the Response.
In order to avoid confusion between new Requests and
retransmissions, the Identifier value chosen for each new Request
need only be different from the previous Request, but need not be
unique within the conversation. One way to achieve this is to
start the Identifier at an initial value and increment it for each
new Request. Initializing the first Identifier with a random
number rather than starting from zero is recommended, since it
makes sequence attacks somewhat harder.
Since the Identifier space is unique to each session,
authenticators are not restricted to only 256 simultaneous
authentication conversations. Similarly, with re-authentication,
an EAP conversation might continue over a long period of time, and
is not limited to only 256 roundtrips.
Implementation Note: The authenticator is responsible for
retransmitting Request messages. If the Request message is
obtained from elsewhere (such as from a backend authentication
server), then the authenticator will need to save a copy of the
Request in order to accomplish this. The peer is responsible
for detecting and handling duplicate Request messages before
processing them in any way, including passing them on to an
outside party. The authenticator is also responsible for
discarding Response messages with a non-matching Identifier
Blunk, et al. Expires May 27, 2004 [Page 22]
Internet-Draft EAP November 2003
value before acting on them in any way, including passing them
on to the backend authentication server for verification.
Since the authenticator can retransmit before receiving a
Response from the peer, the authenticator can receive multiple
Responses, each with a matching Identifier. Until a new Request
is received by the authenticator, the Identifier value is not
updated, so that the authenticator forwards Responses to the
backend authentication server, one at a time.
Length
The Length field is two octets and indicates the length of the EAP
packet including the Code, Identifier, Length, Type, and Type-Data
fields. Octets outside the range of the Length field should be
treated as Data Link Layer padding and MUST be ignored on
reception. A message with the Length field set to a value larger
than the number of received octets MUST be silently discarded.
Type
The Type field is one octet. This field indicates the Type of
Request or Response. A single Type MUST be specified for each EAP
Request or Response. An initial specification of Types follows in
Section 5 of this document.
The Type field of a Response MUST either match that of the
Request, or correspond to a legacy or Expanded Nak (see Section
5.3) indicating that a Request Type is unacceptable to the peer.
A peer MUST NOT send a Nak (legacy or expanded) in response to a
Request, after an initial non-Nak Response has been sent. An EAP
server receiving a Response not meeting these requirements MUST
silently discard it.
Type-Data
The Type-Data field varies with the Type of Request and the
associated Response.
4.2 Success and Failure
The Success packet is sent by the authenticator to the peer after
completion of an EAP authentication method (Type 4 or greater), to
indicate that the peer has authenticated successfully to the
authenticator. The authenticator MUST transmit an EAP packet with
the Code field set to 3 (Success). If the authenticator cannot
authenticate the peer (unacceptable Responses to one or more
Requests) then after unsuccessful completion of the EAP method in
Blunk, et al. Expires May 27, 2004 [Page 23]
Internet-Draft EAP November 2003
progress, the implementation MUST transmit an EAP packet with the
Code field set to 4 (Failure). An authenticator MAY wish to issue
multiple Requests before sending a Failure response in order to allow
for human typing mistakes. Success and Failure packets MUST NOT
contain additional data.
Success and Failure packets MUST NOT be sent by an EAP authenticator
if the specification of the given method does not explicitly permit
the method to finish at that point. A peer EAP implementation
receiving a Success or Failure packet where sending one is not
explicitly permitted MUST silently discard it. By default, an EAP
peer MUST silently discard a "canned" Success packet (a Success
packet sent immediately upon connection). This ensures that a rogue
authenticator will not be able to bypass mutual authentication by
sending a Success packet prior to conclusion of the EAP method
conversation.
Implementation Note: Because the Success and Failure packets are
not acknowledged, they are not retransmitted by the authenticator,
and may be potentially lost. A peer MUST allow for this
circumstance as described in this note. See also Section 3.4 for
guidance on the processing of lower layer success and failure
indications.
As described in Section 2.1, only a single EAP authentication
method is allowed within an EAP conversation. EAP methods MAY
implement protected result indications. After the authenticator
sends a method-specific failure indication to the peer, regardless
of the response from the peer, it MUST subsequently send a Failure
packet. After the authenticator sends a method-specific success
indication to the peer, and receives a method-specific success
indication from the peer, it MUST subsequently send a Success
packet.
On the peer, once the method completes unsuccessfully (that is,
either the authenticator sends a method-specific failure
indication, or the peer decides that it does want to continue the
conversation, possibly after sending a method-specific failure
indication), the peer MUST terminate the conversation and indicate
failure to the lower layer. The peer MUST silently discard
Success packets and MAY silently discard Failure packets. As a
result, loss of a Failure packet need not result in a timeout.
On the peer, after protected successful result indications have
been exchanged by both sides, a Failure packet MUST be silently
discarded. The peer MAY, in the event that an EAP Success is not
received, conclude that the EAP Success packet was lost and that
authentication concluded successfully.
Blunk, et al. Expires May 27, 2004 [Page 24]
Internet-Draft EAP November 2003
A mutually authenticating method (such as EAP-TLS [RFC2716]) that
provides authorization error messages provides protected result
indications for the purpose of this specification. Within
EAP-TLS, the peer always authenticates the authenticator, and may
send a TLS-alert message in the event of an authentication
failure. An authenticator may use the "access denied" TLS alert
after successfully authenticating the peer to indicate that a
valid certificate was received from the peer, but when access
control was applied, the authenticator decided not to proceed. If
a method provides authorization error messages, the authenticator
SHOULD use them so as to ensure consistency with the final access
decision and avoid lengthy timeouts.
If the authenticator has not sent a method-specific result
indication, and the peer is willing to continue the conversation,
once the method completes the peer waits for a Success or Failure
packet and MUST NOT silently discard either of them. In the event
that neither a Success nor Failure packet is received, the peer
SHOULD terminate the conversation to avoid lengthy timeouts in
case the lost packet was an EAP Failure.
If the peer attempts to authenticate to the authenticator and
fails to do so, the authenticator MUST send a Failure packet and
MUST NOT grant access by sending a Success packet. However, an
authenticator MAY omit having the peer authenticate to it in
situations where limited access is offered (e.g., guest access).
In this case the authenticator MUST send a Success packet.
Where the peer authenticates successfully to the authenticator,
but the authenticator does not send a method-specific result
indication the authenticator MAY deny access by sending a Failure
packet where the peer is not currently authorized for network
access.
A summary of the Success and Failure packet format is shown below.
The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code | Identifier | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Code
3 for Success
4 for Failure
Blunk, et al. Expires May 27, 2004 [Page 25]
Internet-Draft EAP November 2003
Identifier
The Identifier field is one octet and aids in matching replies to
Responses. The Identifier field MUST match the Identifier field
of the Response packet that it is sent in response to.
Length
4
4.3 Retransmission Behavior
Because the authentication process will often involve user input,
some care must be taken when deciding upon retransmission strategies
and authentication timeouts. By default, where EAP is run over an
unreliable lower layer, the EAP retransmission timer SHOULD be
dynamically estimated. A maximum of 3-5 retransmissions is
suggested.
When run over a reliable lower layer (e.g., EAP over ISAKMP/TCP, as
within [PIC]), the authenticator retransmission timer SHOULD be set
to an infinite value, so that retransmissions do not occur at the EAP
layer. The peer may still maintain a timeout value so as to avoid
waiting indefinitely for a Request.
Where the authentication process requires user input, the measured
round trip times may be determined by user responsiveness rather than
network characteristics, so that dynamic RTO estimation may not be
helpful. Instead, the retransmission timer SHOULD be set so as to
provide sufficient time for the user to respond, with longer timeouts
required in certain cases, such as where Token Cards (see Section
5.6) are involved.
In order to provide the EAP authenticator with guidance as to the
appropriate timeout value, a hint can be communicated to the
authenticator by the backend authentication server (such as via the
RADIUS Session-Timeout attribute).
In order to dynamically estimate the EAP retransmission timer, the
algorithms for estimation of SRTT, RTTVAR and RTO described in
[RFC2988] are RECOMMENDED, including use of Karn's algorithm, with
the following potential modifications:
[a] In order to avoid synchronization behaviors that can occur with
fixed timers among distributed systems, the retransmission timer
is calculated with a jitter by using the RTO value and randomly
adding a value drawn between -RTOmin/2 and RTOmin/2. Alternative
Blunk, et al. Expires May 27, 2004 [Page 26]
Internet-Draft EAP November 2003
calculations to create jitter MAY be used. These MUST be
pseudo-random, generated by a PRNG seeded as per [RFC1750].
[b] When EAP is transported over a single link (as opposed to over
the Internet), smaller values of RTOinitial, RTOmin and RTOmax
MAY be used. Recommended values are RTOinitial=1 second,
RTOmin=200ms, RTOmax=20 seconds.
[c] When EAP is transported over a single link (as opposed to over
the Internet), estimates MAY be done on a per-authenticator
basis, rather than a per-session basis. This enables the
retransmission estimate to make the most use of information on
link-layer behavior.
[d] An EAP implementation MAY clear SRTT and RTTVAR after backing off
the timer multiple times as it is likely that the current SRTT
and RTTVAR are bogus in this situation. Once SRTT and RTTVAR are
cleared they should be initialized with the next RTT sample taken
as described in [RFC2988] equation 2.2.
5. Initial EAP Request/Response Types
This section defines the initial set of EAP Types used in Request/
Response exchanges. More Types may be defined in follow-on
documents. The Type field is one octet and identifies the structure
of an EAP Request or Response packet. The first 3 Types are
considered special case Types.
The remaining Types define authentication exchanges. Nak (Type 3) or
Expanded Nak (Type 254) are valid only for Response packets, they
MUST NOT be sent in a Request.
All EAP implementations MUST support Types 1-4, which are defined in
this document, and SHOULD support Type 254. Implementations MAY
support other Types defined here or in future RFCs.
1 Identity
2 Notification
3 Nak (Response only)
4 MD5-Challenge
5 One Time Password (OTP)
6 Generic Token Card (GTC)
254 Expanded Types
255 Experimental use
EAP methods MAY support authentication based on shared secrets. If
Blunk, et al. Expires May 27, 2004 [Page 27]
Internet-Draft EAP November 2003
the shared secret is a passphrase entered by the user,
implementations MAY support entering passphrases with non-ASCII
characters. In this case, the input should be processed using an
appropriate stringprep [RFC3454] profile, and encoded in octets using
UTF-8 encoding [RFC2279]. A preliminary version of a possible
stringprep profile is described in [SASLPREP].
5.1 Identity
Description
The Identity Type is used to query the identity of the peer.
Generally, the authenticator will issue this as the initial
Request. An optional displayable message MAY be included to
prompt the peer in the case where there is an expectation of
interaction with a user. A Response of Type 1 (Identity) SHOULD
be sent in Response to a Request with a Type of 1 (Identity).
Some EAP implementations piggy-back various options into the
Identity Request after a NUL-character. By default an EAP
implementation SHOULD NOT assume that an Identity Request or
Response can be larger than 1020 octets.
It is RECOMMENDED that the Identity Response be used primarily for
routing purposes and selecting which EAP method to use. EAP
Methods SHOULD include a method-specific mechanism for obtaining
the identity, so that they do not have to rely on the Identity
Response. Identity Requests and Responses are not protected, so
from a privacy perspective it is preferable for an EAP method to
include its own protected identity exchange. The Identity
Response may not be the appropriate identity for the method; it
may have been truncated or obfuscated so as to provide privacy; or
it may have been decorated for routing purposes. Where the peer
is configured to only accept authentication methods supporting
protected identity exchanges, the peer MAY provide an abbreviated
Identity Response (such as omitting the peer-name portion of the
NAI [RFC2486]). For further discussion of identity protection,
see Section 7.3.
Implementation Note: The peer MAY obtain the Identity via user
input. It is suggested that the authenticator retry the
Identity Request in the case of an invalid Identity or
authentication failure to allow for potential typos on the part
of the user. It is suggested that the Identity Request be
retried a minimum of 3 times before terminating the
authentication. The Notification Request MAY be used to
indicate an invalid authentication attempt prior to
transmitting a new Identity Request (optionally, the failure
Blunk, et al. Expires May 27, 2004 [Page 28]
Internet-Draft EAP November 2003
MAY be indicated within the message of the new Identity Request
itself).
Type
1
Type-Data
This field MAY contain a displayable message in the Request,
containing UTF-8 encoded ISO 10646 characters [RFC2279]. Where
the Request contains a null, only the portion of the field prior
to the null is displayed. If the Identity is unknown, the
Identity Response field should be zero bytes in length. The
Identity Response field MUST NOT be null terminated. In all
cases, the length of the Type-Data field is derived from the
Length field of the Request/Response packet.
Security Claims (see Section 7.2):
Intended use: Physically secure lower layers;
vulnerable to attack when used with
wireless or over the Internet.
Auth. mechanism: None
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: N/A
Fast reconnect: No
Crypt. binding: N/A
Protected success/failure: No
Session independence: N/A
Fragmentation: No
Channel binding: No
5.2 Notification
Description
The Notification Type is optionally used to convey a displayable
message from the authenticator to the peer. An authenticator MAY
send a Notification Request to the peer at any time when there is
no outstanding Request, prior to completion of an EAP
Blunk, et al. Expires May 27, 2004 [Page 29]
Internet-Draft EAP November 2003
authentication method. The peer MUST respond to a Notification
Request with a Notification Response unless the EAP authentication
method specification prohibits the use of Notification message.
In any case, a Nak Response MUST NOT be sent in response to a
Notification Request. Note that the default maximum length of a
Notification Request is 1020 octets. By default, this leaves at
most 1015 octets for the human readable message.
An EAP method MAY indicate within its specification that
Notification messages must not be sent during that method. In this
case, the peer MUST silently discard Notification Requests from
the point where an initial Request for that Type is answered with
a Response of the same Type.
The peer SHOULD display this message to the user or log it if it
cannot be displayed. The Notification Type is intended to provide
an acknowledged notification of some imperative nature, but it is
not an error indication, and therefore does not change the state
of the peer. Examples include a password with an expiration time
that is about to expire, an OTP sequence integer which is nearing
0, an authentication failure warning, etc. In most circumstances,
Notification should not be required.
Type
2
Type-Data
The Type-Data field in the Request contains a displayable message
greater than zero octets in length, containing UTF-8 encoded ISO
10646 characters [RFC2279]. The length of the message is
determined by Length field of the Request packet. The message
MUST NOT be null terminated. A Response MUST be sent in reply to
the Request with a Type field of 2 (Notification). The Type-Data
field of the Response is zero octets in length. The Response
should be sent immediately (independent of how the message is
displayed or logged).
Blunk, et al. Expires May 27, 2004 [Page 30]
Internet-Draft EAP November 2003
Security Claims (see Section 7.2):
Intended use: Physically secure lower layers;
vulnerable to attack when used with
wireless or over the Internet.
Auth. mechanism: None
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: N/A
Fast reconnect: No
Crypt. binding: N/A
Protected success/failure: No
Session independence: N/A
Fragmentation: No
Channel binding: No
5.3 Nak
5.3.1 Legacy Nak
Description
The legacy Nak Type is valid only in Response messages. It is
sent in reply to a Request where the desired authentication Type
is unacceptable. Authentication Types are numbered 4 and above.
The Response contains one or more authentication Types desired by
the Peer. Type zero (0) is used to indicate that the sender has
no viable alternatives, and therefore the authenticator SHOULD NOT
send another Request after receiving a Nak Response containing a
zero value.
Since the legacy Nak Type is valid only in Responses and has very
limited functionality, it MUST NOT be used as a general purpose
error indication, such as for communication of error messages, or
negotiation of parameters specific to a particular EAP method.
Code
2 for Response.
Blunk, et al. Expires May 27, 2004 [Page 31]
Internet-Draft EAP November 2003
Identifier
The Identifier field is one octet and aids in matching Responses
with Requests. The Identifier field of a legacy Nak Response MUST
match the Identifier field of the Request packet that it is sent
in response to.
Length
>=6
Type
3
Type-Data
Where a peer receives a Request for an unacceptable authentication
Type (4-253,255), or a peer lacking support for Expanded Types
receives a Request for Type 254, a Nak Response (Type 3) MUST be
sent. The Type-Data field of the Nak Response (Type 3) MUST
contain one or more octets indicating the desired authentication
Type(s), one octet per Type, or the value zero (0) to indicate no
proposed alternative. A peer supporting Expanded Types that
receives a Request for an unacceptable authentication Type (4-253,
255) MAY include the value 254 in the Nak Response (Type 3) in
order to indicate the desire for an Expanded authentication Type.
If the authenticator can accommodate this preference, it will
respond with an Expanded Type Request (Type 254).
Security Claims (see Section 7.2):
Intended use: Physically secure lower layers;
vulnerable to attack when used with
wireless or over the Internet.
Auth. mechanism: None
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: N/A
Fast reconnect: No
Crypt. binding: N/A
Protected success/failure: No
Session independence: N/A
Blunk, et al. Expires May 27, 2004 [Page 32]
Internet-Draft EAP November 2003
Fragmentation: No
Channel binding: No
5.3.2 Expanded Nak
Description
The Expanded Nak Type is valid only in Response messages. It MUST
be sent only in reply to a Request of Type 254 (Expanded Type)
where the authentication Type is unacceptable. The Expanded Nak
Type uses the Expanded Type format itself, and the Response
contains one or more authentication Types desired by the peer, all
in Expanded Type format. Type zero (0) is used to indicate that
the sender has no viable alternatives. The general format of the
Expanded Type is described in Section 5.7.
Since the Expanded Nak Type is valid only in Responses and has
very limited functionality, it MUST NOT be used as a general
purpose error indication, such as for communication of error
messages, or negotiation of parameters specific to a particular
EAP method.
Code
2 for Response.
Identifier
The Identifier field is one octet and aids in matching Responses
with Requests. The Identifier field of an Expanded Nak Response
MUST match the Identifier field of the Request packet that it is
sent in response to.
Length
>=20
Type
254
Vendor-Id
0 (IETF)
Blunk, et al. Expires May 27, 2004 [Page 33]
Internet-Draft EAP November 2003
Vendor-Type
3 (Nak)
Vendor-Data
The Expanded Nak Type is only sent when the Request contains an
Expanded Type (254) as defined in Section 5.7. The Vendor-Data
field of the Nak Response MUST contain one or more authentication
Types (4 or greater), all in expanded format, 8 octets per Type,
or the value zero (0), also in Expanded Type format, to indicate
no proposed alternative. The desired authentication Types may
include a mixture of Vendor-Specific and IETF Types. For example,
an Expanded Nak Response indicating a preference for OTP (Type 5),
and an MIT (Vendor-Id=20) Expanded Type of 6 would appear as
follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 2 | Identifier | Length=28 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 (Nak) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 (OTP) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 20 (MIT) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
An Expanded Nak Response indicating a no desired alternative would
appear as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 2 | Identifier | Length=20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 (Nak) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
Blunk, et al. Expires May 27, 2004 [Page 34]
Internet-Draft EAP November 2003
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0 (No alternative) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Security Claims (see Section 7.2):
Intended use: Physically secure lower layers;
vulnerable to attack when used with
wireless or over the Internet.
Auth. mechanism: None
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: N/A
Fast reconnect: No
Crypt. binding: N/A
Protected success/failure: No
Session independence: N/A
Fragmentation: No
Channel binding: No
5.4 MD5-Challenge
Description
The MD5-Challenge Type is analogous to the PPP CHAP protocol
[RFC1994] (with MD5 as the specified algorithm). The Request
contains a "challenge" message to the peer. A Response MUST be
sent in reply to the Request. The Response MAY be either of Type
4 (MD5-Challenge), Nak (Type 3) or Expanded Nak (Type 254). The
Nak reply indicates the peer's desired authentication Type(s).
EAP peer and EAP server implementations MUST support the
MD5-Challenge mechanism. An authenticator that supports only
pass-through MUST allow communication with a backend
authentication server that is capable of supporting MD5-Challenge,
although the EAP authenticator implementation need not support
MD5-Challenge itself. However, if the EAP authenticator can be
configured to authenticate peers locally (e.g., not operate in
pass-through), then the requirement for support of the
MD5-Challenge mechanism applies.
Blunk, et al. Expires May 27, 2004 [Page 35]
Internet-Draft EAP November 2003
Note that the use of the Identifier field in the MD5-Challenge
Type is different from that described in [RFC1994]. EAP allows
for retransmission of MD5-Challenge Request packets while
[RFC1994] states that both the Identifier and Challenge fields
MUST change each time a Challenge (the CHAP equivalent of the
MD5-Challenge Request packet) is sent.
Note: [RFC1994] treats the shared secret as an octet string, and
does not specify how it is entered into the system (or if it is
handled by the user at all). EAP MD5-Challenge implementations MAY
support entering passphrases with non-ASCII characters. See
Section 5 for instructions how the input should be processed and
encoded into octets.
Type
4
Type-Data
The contents of the Type-Data field is summarized below. For
reference on the use of these fields see the PPP Challenge
Handshake Authentication Protocol [RFC1994].
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Value-Size | Value ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Name ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Blunk, et al. Expires May 27, 2004 [Page 36]
Internet-Draft EAP November 2003
Security Claims (see Section 7.2):
Intended use: Wired networks, including PPP, PPPOE,
and IEEE 802 wired media. Use over the
Internet or with wireless media only
when protected.
Auth. mechanism: Password or pre-shared key.
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: No
Fast reconnect: No
Crypt. binding: N/A
Protected success/failure: No
Session independence: N/A
Fragmentation: No
Channel binding: No
5.5 One-Time Password (OTP)
Description
The One-Time Password system is defined in "A One-Time Password
System" [RFC2289] and "OTP Extended Responses" [RFC2243]. The
Request contains an OTP challenge in the format described in
[RFC2289]. A Response MUST be sent in reply to the Request. The
Response MUST be of Type 5 (OTP), Nak (Type 3) or Expanded Nak
(Type 254). The Nak Response indicates the peer's desired
authentication Type(s). The EAP OTP method is intended for use
with the One-Time Password system only, and MUST NOT be used to
provide support for cleartext passwords.
Type
5
Type-Data
The Type-Data field contains the OTP "challenge" as a displayable
message in the Request. In the Response, this field is used for
the 6 words from the OTP dictionary [RFC2289]. The messages MUST
NOT be null terminated. The length of the field is derived from
the Length field of the Request/Reply packet.
Blunk, et al. Expires May 27, 2004 [Page 37]
Internet-Draft EAP November 2003
Note: [RFC2289] does not specify how the secret pass-phrase is
entered by the user, or how the pass-phrase is converted into
octets. EAP OTP implementations MAY support entering passphrases
with non-ASCII characters. See Section 5 for instructions how the
input should be processed and encoded into octets.
Security Claims (see Section 7.2):
Intended use: Wired networks, including PPP, PPPOE,
and IEEE 802 wired media. Use over the
Internet or with wireless media only
when protected.
Auth. mechanism: One-Time Password
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: Yes
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: No
Fast reconnect: No
Crypt. binding: N/A
Protected success/failure: No
Session independence: N/A
Fragmentation: No
Channel binding: No
5.6 Generic Token Card (GTC)
Description
The Generic Token Card Type is defined for use with various Token
Card implementations which require user input. The Request
contains a displayable message and the Response contains the Token
Card information necessary for authentication. Typically, this
would be information read by a user from the Token card device and
entered as ASCII text. A Response MUST be sent in reply to the
Request. The Response MUST be of Type 6 (GTC), Nak (Type 3) or
Expanded Nak (Type 254). The Nak Response indicates the peer's
desired authentication Type(s). The EAP GTC method is intended
for use with the Token Cards supporting challenge/response
authentication and MUST NOT be used to provide support for
cleartext passwords in the absence of a protected tunnel with
server authentication.
Blunk, et al. Expires May 27, 2004 [Page 38]
Internet-Draft EAP November 2003
Type
6
Type-Data
The Type-Data field in the Request contains a displayable message
greater than zero octets in length. The length of the message is
determined by the Length field of the Request packet. The message
MUST NOT be null terminated. A Response MUST be sent in reply to
the Request with a Type field of 6 (Generic Token Card). The
Response contains data from the Token Card required for
authentication. The length of the data is determined by the
Length field of the Response packet.
EAP GTC implementations MAY support entering a response with
non-ASCII characters. See Section 5 for instructions how the
input should be processed and encoded into octets.
Security Claims (see Section 7.2):
Intended use: Wired networks, including PPP, PPPOE,
and IEEE 802 wired media. Use over the
Internet or with wireless media only
when protected.
Auth. mechanism: Hardware token.
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: No
Fast reconnect: No
Crypt. binding: N/A
Protected success/failure: No
Session independence: N/A
Fragmentation: No
Channel binding: No
5.7 Expanded Types
Description
Since many of the existing uses of EAP are vendor-specific, the
Expanded method Type is available to allow vendors to support
Blunk, et al. Expires May 27, 2004 [Page 39]
Internet-Draft EAP November 2003
their own Expanded Types not suitable for general usage.
The Expanded Type is also used to expand the global Method Type
space beyond the original 255 values. A Vendor-Id of 0 maps the
original 255 possible Types onto a space of 2^32-1 possible Types.
(Type 0 is only used in a Nak Response, to indicate no acceptable
alternative)
An implementation that supports the Expanded attribute MUST treat
EAP Types that are less than 256 equivalently whether they appear
as a single octet or as the 32-bit Vendor-Type within a Expanded
Type where Vendor-Id is 0. Peers not equipped to interpret the
Expanded Type MUST send a Nak as described in Section 5.3.1, and
negotiate a more suitable authentication method.
A summary of the Expanded Type format is shown below. The fields
are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Vendor-Id |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Vendor-Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Vendor data...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
254 for Expanded Type
Vendor-Id
The Vendor-Id is 3 octets and represents the SMI Network
Management Private Enterprise Code of the Vendor in network byte
order, as allocated by IANA. A Vendor-Id of zero is reserved for
use by the IETF in providing an expanded global EAP Type space.
Vendor-Type
The Vendor-Type field is four octets and represents the
vendor-specific method Type.
If the Vendor-Id is zero, the Vendor-Type field is an extension
and superset of the existing namespace for EAP Types. The first
256 Types are reserved for compatibility with single-octet EAP
Types that have already been assigned or may be assigned in the
Blunk, et al. Expires May 27, 2004 [Page 40]
Internet-Draft EAP November 2003
future. Thus, EAP Types from 0 through 255 are semantically
identical whether they appear as single octet EAP Types or as
Vendor-Types when Vendor-Id is zero. There is one exception to
this rule: Expanded Nak and Legacy Nak packets share the same
Type, but must be treated differently because they have a
different format.
Vendor-Data
The Vendor-Data field is defined by the vendor. Where a Vendor-Id
of zero is present, the Vendor-Data field will be used for
transporting the contents of EAP methods of Types defined by the
IETF.
5.8 Experimental
Description
The Experimental Type has no fixed format or content. It is
intended for use when experimenting with new EAP Types. This Type
is intended for experimental and testing purposes. No guarantee
is made for interoperability between peers using this Type, as
outlined in [IANA-EXP].
Type
255
Type-Data
Undefined
6. IANA Considerations
This section provides guidance to the Internet Assigned Numbers
Authority (IANA) regarding registration of values related to the EAP
protocol, in accordance with BCP 26, [RFC2434].
There are two name spaces in EAP that require registration: Packet
Codes and method Types.
EAP is not intended as a general-purpose protocol, and allocations
SHOULD NOT be made for purposes unrelated to authentication.
The following terms are used here with the meanings defined in BCP
26: "name space", "assigned value", "registration".
Blunk, et al. Expires May 27, 2004 [Page 41]
Internet-Draft EAP November 2003
The following policies are used here with the meanings defined in BCP
26: "Private Use", "First Come First Served", "Expert Review",
"Specification Required", "IETF Consensus", "Standards Action".
For registration requests where a Designated Expert should be
consulted, the responsible IESG area director should appoint the
Designated Expert. The intention is that any allocation will be
accompanied by a published RFC. But in order to allow for the
allocation of values prior to the RFC being approved for publication,
the Designated Expert can approve allocations once it seems clear
that an RFC will be published. The Designated expert will post a
request to the EAP WG mailing list (or a successor designated by the
Area Director) for comment and review, including an Internet-Draft.
Before a period of 30 days has passed, the Designated Expert will
either approve or deny the registration request and publish a notice
of the decision to the EAP WG mailing list or its successor, as well
as informing IANA. A denial notice must be justified by an
explanation and, in the cases where it is possible, concrete
suggestions on how the request can be modified so as to become
acceptable.
6.1 Packet Codes
Packet Codes have a range from 1 to 255, of which 1-4 have been
allocated. Because a new Packet Code has considerable impact on
interoperability, a new Packet Code requires Standards Action, and
should be allocated starting at 5.
6.2 Method Types
The original EAP method Type space has a range from 1 to 255, and is
the scarcest resource in EAP, and thus must be allocated with care.
Method Types 1-41 have been allocated, with 20 available for re-use.
Method Types 42-191 may be allocated on the advice of a Designated
Expert, with Specification Required.
Allocation of blocks of method Types (more than one for a given
purpose) should require IETF Consensus. EAP Type Values 192-253 are
reserved and allocation requires Standards Action.
Method Type 254 is allocated for the Expanded Type. Where the
Vendor-Id field is non-zero, the Expanded Type is used for functions
specific only to one vendor's implementation of EAP, where no
interoperability is deemed useful. When used with a Vendor-Id of
zero, method Type 254 can also be used to provide for an expanded
IETF method Type space. Method Type values 256-4294967295 may be
allocated after Type values 1-191 have been allocated.
Blunk, et al. Expires May 27, 2004 [Page 42]
Internet-Draft EAP November 2003
Method Type 255 is allocated for Experimental use, such as testing of
new EAP methods before a permanent Type is allocated.
7. Security Considerations
EAP was designed for use with dialup PPP [RFC1661] and was later
adapted for use in wired IEEE 802 networks [IEEE-802] in
[ Internet-Draft EAP November 2003 Control"'>IEEE-802.1X]. On these networks, an attacker would need to gain
physical access to the telephone or switch infrastructure in order to
mount an attack. While such attacks have been documented, such as in
[DECEPTION], they are assumed to be rare.
However, subsequently EAP has been proposed for use on wireless
networks, and over the Internet, where physical security cannot be
assumed. On such networks, the security vulnerabilities are greater,
as are the requirements for EAP security.
This section defines the threat model and security terms and
describes the security claims section required in EAP method
specifications. We then discuss threat mitigation.
7.1 Threat model
On physically insecure networks, it is possible for an attacker to
gain access to the physical medium. This enables a range of attacks,
including the following:
[1] An attacker may try to discover user identities by snooping
authentication traffic.
[2] An attacker may try to modify or spoof EAP packets.
[3] An attacker may launch denial of service attacks by spoofing
lower layer indications or Success/Failure packets; by replaying
EAP packets; or by generating packets with overlapping
Identifiers.
[4] An attacker may attempt to recover the pass-phrase by mounting
an offline dictionary attack.
[5] An attacker may attempt to convince the peer to connect to an
untrusted network, by mounting a man-in-the-middle attack.
[6] An attacker may attempt to disrupt the EAP negotiation in order
cause a weak authentication method to be selected.
Blunk, et al. Expires May 27, 2004 [Page 43]
Internet-Draft EAP November 2003
[7] An attacker may attempt to recover keys by taking advantage of
weak key derivation techniques used within EAP methods.
[8] An attacker may attempt to take advantage of weak ciphersuites
subsequently used after the EAP conversation is complete.
[9] An attacker may attempt to perform downgrading attacks on lower
layer ciphersuite negotiation in order to ensure tha