Subject: [eap] RE: passphrases in EAP

From: [email-masked] ([email-masked])
Date: Fri, 2 May 2003 23:48:08 +0300

Lauri Tarkkala wrote:

> Example:
>=20
> - I try to authenticate to some server, with my neat unicode
>   passphrase. The server, being EAP-bis compliant, sends me
>   an EAP-MD5 message with the "I support the hint-bit"-bit set.
>=20
> - My client, noticing this encodes my passphrase using UTF-8,
>   and uses this as input to the MD5 hash, and keeps the hint
>   bit set.
>=20
> - If the hint bit were not set. Then my implementation would
>   have to arbitrarily choose an encoding, and use this. I could
>   only hope that, this was the same encoding used by the server
>   side implementation.=20

Yes, but what encoding would the implementation choose in this=20
case (since it has to choose something)? If it would always=20
choose UTF-8 anyway, then we don't need the "hint bit".

Specifying a new method (with different type code) is easy in=20
theory (but getting it deployed certainly would not be :-). =20
The more difficult aspect is what to do with existing methods=20
(and implementations of them).

I guess the important question here is that do existing
implementations of MD5-Challenge and OTP (this problem=20
doesn't exist in MS-CHAPv2 or LEAP) support non-ASCII=20
passphrases "well enough" (with good interoperability),=20
with some other encoding than UTF-8, so that mandating=20
UTF-8 would seriously break things?

(Does someone have more information or actual=20
experiences about this?)

Best regards,
Pasi