Subject: [eap] Question on EAP SM

From: Bernard Aboba <[email-masked]>
Date: Wed, 19 Nov 2003 11:24:47 -0800 (PST)

In IEEE 802.1XD7.1, page 49 in the Authenticator PAE state machine,
the transition from AUTHENTICATING state appears to be controlled in part
by the value of the authSuccess and authFail variables.  However, these
variables do not appear to be set in the corresponding EAP authenticator
state machines, either in Figure 4, 5 or 6.

Note that Figure 5 does set the aaaEapFail and aaaEapSuccess variables.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Nick Petroni <[email-masked]>
Date: Wed, 19 Nov 2003 14:24:57 -0500 (EST)

I could be wrong, but my understanding is that authSuccess and authFail
are set in the Backend authenticator 1x state machine (p. 59) after
eapSuccess or eapFail are set. These ARE set in the Authenticator state
machine as I read it.

Is this wrong?

nick

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 19 Nov 2003 12:54:26 -0800 (PST)

Yes, they are set in Figure 8-15 in the Backend Authenticator SM.
However, these are set based on the eapFail and eapSuccess variables.

Is that right?  This seems to imply that it is EAP that determines the
success or failure of the Authenticator SM, when in fact is the decision
communicated by the AAA protocol (Accept/Reject).

For example, in the EAP Authenticator SM (Figure 5), the variables
aaaEapFail and aaaEapSuccess are set.  Shouldn't these variables cause the
transition from RESPONSE state to SUCCESS or FAILURE state in Figure 8-15
in 802.1X, instead of eapFail and eapSuccess?

---

From: Jim Burns <[email-masked]>
Date: Wed, 19 Nov 2003 16:02:30 -0500

Nick,
   Actually, Bernard's statement has reminded that in fact I should have 
said:
       eapSuccess and eapFail are the variables between 1X and *Higher 
Layer* (which according to 2284bis this will be AAA, not EAP).
       authSuccess and authFail are variables between the 802.1X front 
end and 802.1X back end authenticator state machines.
   A subtle but very important distinction.
Jim B.

Jim Burns wrote:

> Nick,
>    Correct.
>    eapSuccess and eapFail are the variables between the 1X and EAP 
> machine.
>    authSuccess and authFail are variables between the 802.1X front end 
> and 802.1X back end authenticator state machines.
> Sincerely,
> Jim B.
>
> Nick Petroni wrote:
>

---

From: Jim Burns <[email-masked]>
Date: Wed, 19 Nov 2003 15:38:25 -0500

Nick,
    Correct.
    eapSuccess and eapFail are the variables between the 1X and EAP machine.
    authSuccess and authFail are variables between the 802.1X front end 
and 802.1X back end authenticator state machines.
Sincerely,
Jim B.

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 19 Nov 2003 13:32:52 -0800 (PST)

I'm not sure how this works because eapSuccess and eapFail are not set in
the EAP SM as a result of AAA activity.   So this isn't quite right, I
think.

---

From: Nick Petroni <[email-masked]>
Date: Wed, 19 Nov 2003 16:13:58 -0500 (EST)

Bernard,
Maybe this is a subtle, but important point but I think you need to
convince me of it. I am not completely understanding the objection. Your
initial comment was that authSuccess and authFail are not set in the EAP
state machine, but now you are asking why the EAP state machine leads
directly to them being set? I think I am misunderstanding.

As for AAA making the decision, eapFail/eapSucess get set based on the
response aaaFail or aaaSuccess in figure 7. Figures 4 and 6 are the case
where AAA is not used.

can you clarify?

thanks,
nick

Nick L. Petroni, Jr.
Graduate Student, Computer Science
Maryland Information Systems Security Lab
University of Maryland
http://www.cs.umd.edu/~npetroni

---

From: Nick Petroni <[email-masked]>
Date: Wed, 19 Nov 2003 16:15:28 -0500 (EST)

why are they not? the only authenticator code that interracts with AAA is
figure 7 and that clearly shows eapFail/eapSucces being driven from
aaaFail/aaaSuccess, no?

Nick L. Petroni, Jr.

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 19 Nov 2003 13:40:39 -0800 (PST)

Yes, I understand figure 7 and this seems to make sense.  But Figure 5 is
for the Backend Authenticator state machine and Section 6 mentions AAA,
yet the eapFail/eapSuccess variables aren't driven in the same way.  I'm
not sure why this is the case.