Subject: [eap] Proposed resolution of Issue 119: EAP inappropriate for peer-to-peer

From: [email-masked] (Bernard Aboba)
Date: Sat, 10 May 2003 21:11:32 -0700 (PDT)

The text of Issue 119 is available on the EAP Issues Web page:

http://www.drizzle.com/~aboba/EAP/eapissues.html

The proposed resolution is as follows:

In the EAP Keying Framework document, add the following requirements
to Section 4.1:

Liveness
Methods deriving keys SHOULD exchange random nonces, and
SHOULD protect the nonces from modification.

Man-in-the-middle and replay protection
Methods deriving keys SHOULD detect replay and man-in-the-middle
attacks in either direction.