Subject: [eap] EAP support in smartcard version 01

From: [email-masked] (Puthenkulam, Jose P)
Date: Tue, 11 Mar 2003 06:48:44 -0800

Hi Pascal,

I just happened to read your recent submittal. Your draft seems to define a
solution for putting EAP in the smart card. But I guess its not clear what
problem you are trying to solve? At least it was very difficult to
understand from the draft.

Somewhere in your Security Considerations section you mention
"The nature of the Internet network does no longer require getting physical
access to the smart card. Worms, Trojan horses or viruses can move to the
computing platforms and performs the jobs. It is important for a reference
implementation to provide the relevant level of protection for the new
applications but not to create other flaws."
   
If the smart card generates keys that can be picked up by viruses, what
protection did you achieve by terminating EAP in the smart card. If the
virus knows the keys for one session, what prevents it from knwoing the keys
from subsequent sessions.

best regards,
jose

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   Jose Puthenkulam
   Senior Software Engineer
   Emerging Platforms Lab
   Intel R & D
   Intel Corporation
   2111 NE 25th Avenue, JF2-58
   Hillsboro, OR 97124
   Tel: (503) 264 6121
   Fax: (503) 264 8154
   Email: [email-masked]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

> -----Original Message-----
> From: Pascal Urien [mailto:[email-masked]] 
> Sent: Saturday, March 01, 2003 2:31 PM
> To: [email-masked]
> Subject: [eap] EAP support in smartcard version 01
> 
> 
> 
> Hi Every body,
> 
>    New version of the internet draft
> 
>   draft-urien-EAP-smartcard-01.txt - EAP support in smartcard
> 
> has been dowloaded to the IETF web site.
> 
> I hope to meet you again during the next IETF meetinf in SF
> 
> Regards
> 
> Pascal Urien 
>