Subject: [eap] Re: [issue 7] Ability to authentication with multiple methods

From: [email-masked] (Bernard Aboba)
Date: Thu, 4 Apr 2002 23:22:19 -0800 (PST)

Had an interesting question come up. What happens when, in
the middle of one EAP method, a Peer receives a Request for
a completely different EAP method. Does it silently discard
the packet? Call the new EAP method while leaving the
old one suspended? Nak the new method with the Type of
the previous one?

Any opinions?

Here are my thoughts:

a. I think that once an EAP Type Request is received by the Peer, that the
Peer requires that EAP method accomplish its purpose. For example, if the
method offers mutual authentication, then the server should authenticate
itself to the Peer before starting a new method. So it seems to me that
the Peer can't leave the state machine of the EAP Type until its policy
with respect to that Type is satisfied. Otherwise, it would always be
possible to abort a Type simply by sending a packet for yet another EAP
Type. 

My take is that if the policy is not satisfied, that the packet for the
new Type is silently discarded. This would prevent an attacker from
spoofing a packet for a new Type in the middle of a conversation and
moving the Peer out of the state machine for the previous Type.

---

From: [email-masked] (Bryan D. Payne)
Date: Fri, 5 Apr 2002 07:52:26 -0500 (EST)

I agree, and this is how it is represented in the currently proposed state
machine.

-bryan

On Thu, 4 Apr 2002, Bernard Aboba wrote:

> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>