Subject: [eap] Re: Issue 121: Potential meaning of successful authentication

From: [email-masked] (Bernard Aboba)
Date: Fri, 9 May 2003 11:21:50 -0700 (PDT)

>Do you think the reasoning above would cover all cases,
>and is ok?

Yes, I think the reasoning covers all cases, and makes some sense. The
question is how to reflect this unambiguously in the language of the
draft.

Basically, you are saying that an EAP Failure is accepted unless the
method includes a protected result indication and that indication
contradicts the EAP Failure. So the Failure is accepted after one-way
authentication or even mutual authentication if no protected result
indication is provided by the method.

Success is only accepted in the case of a one-way authentication method,
or a mutual authentication method where the peer successfully
authenticates the authenticator. If a protected result indication is
provided, then the indication needs to indicate success in order for the
Success packet to be processed.

I'm not entirely clear on what would constitute a protected result
indication, though. In EAP TLS, since we have authorization error
messages, and a "Finished" message, is the absence of a TLS alert
considered a "protected result indication" in this context? I think that
this is the case since an alert could still be sent after the peer
successfully authenticates the authenticator, and if a "finished"
message is sent instead, that means everything is ok.