Subject: [eap] Proposed resolution to Issue 92

From: [email-masked] (Bernard Aboba)
Date: Thu, 6 Mar 2003 10:28:47 -0800 (PST)

I would propose that this change be accepted with modifications, as noted
by Henrik and others, below. Comments?

-------------------------------------------------------------------------
Issue 92: Integrity Protection
Submitter name: John Vollbrecht
Submitter email address: [email-masked]
Date first submitted: March 3, 2003
Document: EAP-01
Comment type: Technical
Priority: 2
Section: 1.2
change:

"Integrity protection
This refers to per-packet authentication and integrity
protection of EAP packets, including EAP Requests and
Responses, and method-specific success and failure
indications.
When making this claim, a method specification
MUST describe the fields within the EAP packet that are
protected."

to:
"Integrity protection
This refers to per-packet authentication of all EAP packets,
including EAP Requests and Responses. When making this claim,
a method specification MUST describe the fields within the EAP
packet that are authenticated."

[Based on comments from Henrik, and others]:

Revise to:
"Integrity protection
This refers to per-packet authentication and integrity
protection of EAP packets, including EAP Requests and
Responses. When making this claim, a method specification
MUST describe the EAP packets and fields within the EAP packet
that are protected."

---

From: [email-masked] (John Vollbrecht)
Date: Thu, 06 Mar 2003 21:19:56 -0500

Just to have one more round on this one - I prefer to not include integrity 
protection in the definition of integrity protection.  I believe, perhaps 
incorrectly, that message authentication is the means of providing message 
integrity.  Is there a different term that we could use instead of message 
integrity so we don't have a circular definition?

-- John

--On Thursday, March 6, 2003 10:28 AM -0800 Bernard Aboba 
<[email-masked]> wrote:

> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap

---

From: [email-masked] (Nick Petroni)
Date: Fri, 7 Mar 2003 03:18:44 -0500 (EST)

> integrity so we don't have a circular definition?
I agree with John, the circular nature of this definition is an issue.
Typically in security, integrity is one of the three primary services and
includes both authentication and unauthorized modification. Practically
speaking, when talking about message integrity, message authentication is
roughly equated to "insuring" or "verifying" the integrity of messages.
Since source authentication is closely related to message modification, I
think it's sufficient to simply use "per-packet authentication" and remove
"integrity protection" from the definition. However, if people would like
to separate the concepts of source identification and message modification
we could replace "integrity protection" with "protection against
unauthorized modification or destruction of information" in the
definition.

These and other definitions can be found in the INFOSEC glossary at
http://www.nstissc.gov/Assets/pdf/4009.pdf

nick

---

From: [email-masked] (Bernard Aboba)
Date: Fri, 7 Mar 2003 04:19:35 -0800 (PST)

OK. How about this?

Integrity protection
This refers to providing data origin authentication and protection
against unauthorized modification of information for EAP packets
(including EAP Requests and Responses). When making this claim,
a method specification MUST describe the EAP packets and fields
within the EAP packet that are protected.

---

From: [email-masked] (Nick Petroni)
Date: Fri, 7 Mar 2003 09:15:13 -0500 (EST)

This looks good to me.

nick

---

From: [email-masked] (Henrik Levkowetz)
Date: Fri, 7 Mar 2003 16:24:52 +0100

I agree.
	Henrik

On Fri, 7 Mar 2003 09:15:13 -0500 (EST)

---

From: [email-masked] (John Vollbrecht)
Date: Fri, 07 Mar 2003 11:08:13 -0500

good for me