Subject: RE: [eap] Proposed Resolution to Issue 189: Handling of the Identity Response

From: <[email-masked]>
Date: Fri, 21 Nov 2003 14:47:03 +0200

Bernard Aboba wrote:
> 
> The text of Issue 189 is enclosed below.  The proposed fix is 
> as follows:
>
<snip>
> 
> To the following:
> 
> "It is RECOMMENDED that the Identity Response be used primarily
> for routing purposes and that EAP Methods SHOULD include an
> method-specific mechanism for obtaining the identity, so that
> they do not have to rely on the Identity Response. Identity
> Requests and Responses are not protected, so from a privacy
> perspective it is preferable for an EAP method to include its
> own protected identity exchange. The Identity Response may
> not be the appropriate identity for the method; it may have
> been truncated or obfuscated so as to provide privacy; or it
> may have been decorated for routing purposes. Where the peer
> is configured to only accept authentication methods
> supporting protected identity exchanges, the peer MAY
> provide an abbreviated Identity Response (such as omitting
> the peer-name portion of the NAI [RFC2486]). For further
> discussion of identity protection, see Section 7.3.

This omits the point that Identity Response is also used to
select which method to use. I suggest we rephrase the beginning
something like this:

  "It is RECOMMENDED that the Identity Response be used primarily 
  for routing purposes and selecting which EAP Method to use.  
  EAP Methods SHOULD include an method-specific..."

Best regards,
Pasi
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 21 Nov 2003 08:27:10 -0800 (PST)

>   EAP Methods SHOULD include an method-specific..."

I've changed the proposed text to reflect this.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "Joseph Salowey" <[email-masked]>
Date: Fri, 21 Nov 2003 08:33:49 -0800

Thanks Bernard, this looks good.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Bernard Aboba
> Sent: Friday, November 21, 2003 8:27 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: RE: [eap] Proposed Resolution to Issue 189: Handling 
> of the Identity Response
> 
> 
> > This omits the point that Identity Response is also used to select 
> > which method to use. I suggest we rephrase the beginning something 
> > like this:
> >

---

From: John Vollbrecht <[email-masked]>
Date: Fri, 21 Nov 2003 14:37:27 -0500

I like this -- John

---

From: Nick Petroni <[email-masked]>
Date: Fri, 21 Nov 2003 14:43:24 -0500 (EST)

agreed.

Nick L. Petroni, Jr.
Graduate Student, Computer Science
Maryland Information Systems Security Lab
University of Maryland
http://www.cs.umd.edu/~npetroni