Subject: Re: Problem with draft-sheffer-emu-eap-eke

From: Yaron Sheffer <[email-masked]>
Date: Tue, 16 Nov 2010 17:49:25 +0200

Hi Bernard,

Thanks for reviewing our document.

In fact both ID_S and ID_P are authenticated in EAP-EKE, not just 
asserted, so they can be used as RFC 5247 identities. See for example 
http://tools.ietf.org/html/draft-sheffer-emu-eap-eke-09#section-5.1.

A more detailed response will follow once we've hashed out the details 
of Session-ID.

Thanks,
	Yaron

> Date: Mon, 15 Nov 2010 20:43:46 -0800
> From: Bernard Aboba<[email-masked]>
> Subject: Problem with draft-sheffer-emu-eap-eke
> To:<[email-masked]>,<[email-masked]>
> Message-ID:<[email-masked]>
> Content-Type: text/plain; charset="iso-8859-1"
>
>
> I just took a look at the EAP EKE document recently approved by the IESG for publication as an Informational RFC:
> http://tools.ietf.org/html/draft-sheffer-emu-eap-eke-09
>
> The document does not define the following parameters required by RFC 5247:
>
> 1. Peer-Id
> 2. Server-Id
> 3. Session-Id
>
> In particular, the omission of the Session-Id is a significant problem, since this is required for EAP methods
> to be usable within IEEE 802.1X-2010.
>
> My suggestion is that ID_P be designated as the Peer-Id.  Since the Server identity is not authenticated (just asserted), it is not clear to me whether ID_S is suitable for use as the Server-Id.
>
> My suggestion is that the Session-Id be defined as follows:
> Session-Id = Type-Code || Nonce_P || Nonce_S
>
>

---

From: Yaron Sheffer <[email-masked]>
Date: Wed, 17 Nov 2010 13:13:42 +0200

Expanding on my previous response, I suggest to resolve Bernard's 
concern by adding the following text:

5.6 EAP Key Generation

EAP-EKE can be used for EAP key generation, as defined by [RFC 5247]. 
When used in this manner, the values required to establish the key 
hierarchy are defined as follows:

- Peer-Id is the EAP-EKE ID_P value.
- Server-Id is the EAP-EKE ID_S value.
- Session-Id is the concatenated Type | Nonce_P | Nonce_S, where Type is 
the method type defined for EAP-EKE in [Sec. 4.1], a single octet.

Thanks,
	Yaron

On 11/16/2010 05:49 PM, Yaron Sheffer wrote:
>> I just took a look at the EAP EKE document recently approved by the
>> IESG for publication as an Informational RFC:
>> In particular, the omission of the Session-Id is a significant
>> problem, since this is required for EAP methods
>> My suggestion is that ID_P be designated as the Peer-Id. Since the
>> Server identity is not authenticated (just asserted), it is not clear
>> to me whether ID_S is suitable for use as the Server-Id.
>>

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 17 Nov 2010 19:01:25 +0700

Looks OK to me.

Hope this helps.

 ~gwz

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Yaron Sheffer
> Sent: Wednesday, November 17, 2010 6:14 PM
> To: [email-masked]
> Subject: Re: Problem with draft-sheffer-emu-eap-eke
> 
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf