Subject: RE: [eap] Channel bindings

From: <[email-masked]>
Date: Wed, 12 May 2004 11:23:07 +0300

Hi,

As far as I know, there are not even any complete specifications
about channel bindings. For instance, PEAPv2 specifies a TLV for 
channel bindings but not its contents; draft-arkko-eap-service-
identity-auth-00 specifies contents but not e.g. TLV numbers for 
actual EAP methods (which require IANA assignments).

I think it would be a good idea to get some implementation
and operational experiences before promoting this to a "SHOULD".

Best regards,
Pasi

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]On Behalf Of
> ext Bernard Aboba
> Sent: Wednesday, May 12, 2004 7:31 AM
> To: [email-masked]
> Subject: [eap] Channel bindings
> 
> 
> A question has arisen in IEEE 802.11i as to whether Channel 
> Bindings (see Section 7.15 of RFC 3748) is to be promoted to 
> a SHOULD in draft-walker-ieee802-req-01.txt, as suggested in 
> Issue 227.  The current recommended resolution of Issue 227 is 
> to leave it as a MAY.
> 
> Section 7.15 of RFC 3748 states:
> 
>    Using such a protected exchange, it is possible to match 
>    the channel properties provided by the authenticator via 
>    out-of-band mechanisms against those exchanged within the EAP 
>    method.  Where discrepancies are found, these SHOULD be logged; 
>    additional actions MAY also be taken, such as denying access.
> 
> Some questions that have come up:
> 
> a. Are there deployed implementations of channel bindings?
> b. Why is more strict action not mandated?
> c. Are there known Access Point architectures that will break
>    Channel Bindings?  For example, are there APs that use
>    "MAC Address Translation" (MAT)?
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Jari Arkko <[email-masked]>
Date: Wed, 12 May 2004 17:34:03 +0300

I agree.

--Jari

---

From: "Joseph Salowey" <[email-masked]>
Date: Wed, 12 May 2004 08:08:19 -0700

I agree that "channel bindings" are currently underspecified.

[email-masked] wrote:
> Hi,
> 
> As far as I know, there are not even any complete
> specifications about channel bindings. For instance, PEAPv2 specifies
> a TLV for channel bindings but not its contents;
> draft-arkko-eap-service- identity-auth-00 specifies contents but not
> e.g. TLV numbers for actual EAP methods (which require IANA
> assignments). 
>