Subject: [eap] RFC 2284bis status

From: [email-masked] (Simon Josefsson)
Date: Sun, 07 Apr 2002 12:35:31 +0200

Bernard Aboba <[email-masked]> writes:

> http://www.drizzle.com/~aboba/EAP/draft-ietf-pppext-rfc2284bis-03.txt

Quoting new text in the security consideration, section 9.1:

,----
| However, where EAP is run over wireless media such as IEEE 802.11, or
| over IP, such as within protocols supporting PPP or Ethernet tunneling
| [RFC2661], this assumption is no longer valid and the vulnerability to
| attack is much greater.  As a result, when EAP is used with wireless
| media or over IP, the EAP conversation SHOULD be authenticated,
| integrity protected and encrypted, on a per-packet basis.  This can be
| accomplished using mechanisms such as ISAKMP [RFC2408], as is done in
| PIC [PIC], or using TLS [RFC2246].
`----

What are the implications of this?  Is this text suggesting that EAP
should not be used directly over WLAN without protection?  The EAP
Success and EAP Reject messages are not protected, even if the EAP
mechanism used supports per-packet auth/integrity/encryption.

Also, is it strictly necessary that the conversation is encrypted?  It
seems that an authentication protocol could do without encryption and
still be considered secure.

Thanks, Simon