Subject: [eap] Proposed Resolution to issue 226: Comments on WLAN Requirements

From: Bernard Aboba <[email-masked]>
Date: Mon, 10 May 2004 20:24:19 -0700 (PDT)

The text of Issue 226 is enclosed below.  The proposed resolution is as
follows:

Change Section 1 to the following:

"1. Introduction

The Draft IEEE 802.11i MAC Security Enhancements Amendment [IEEE802.11i]
makes use of IEEE 802.1X [IEEE8021X-REV] which in turn relies on the
Extensible Authentication Protocol (EAP), defined in [RFC2284bis].

Deployments of IEEE 802.11 wireless LANs today are based on EAP, and use
several EAP methods, including EAP-TLS [RFC2716], EAP-TTLS [TTLS], PEAP
[PEAP] and EAP-SIM [SIM]. These methods support authentication
credentials that include digital certificates, user-names and passwords,
secure tokens, and SIM secrets.

This document defines requirements for EAP methods used in IEEE 802.11
wireless LAN deployments."

The draft could benefit by addition of a terminology section.

Add Section 1.2:

"1.2 Terminology

authenticator
The end of the link initiating EAP authentication. The
term Authenticator is used in [IEEE-802.1X], and
authenticator has the same meaning in this document.

peer
The end of the link that responds to the authenticator. In
[IEEE-802.1X], this end is known as the Supplicant.

Supplicant
The end of the link that responds to the authenticator in
[IEEE-802.1X].

backend authentication server
A backend authentication server is an entity that provides
an authentication service to an authenticator. When used,
this server typically executes EAP methods for the
authenticator. This terminology is also used in
[IEEE-802.1X].

EAP server
The entity that terminates the EAP authentication method
with the peer. In the case where no backend authentication
server is used, the EAP server is part of the
authenticator. In the case where the authenticator
operates in pass-through mode, the EAP server is located on
the backend authentication server.

Master Session Key (MSK)
Keying material that is derived between the EAP peer and
server and exported by the EAP method. The MSK is at least
64 octets in length. In existing implementations a AAA
server acting as an EAP server transports the MSK to the
authenticator.

Extended Master Session Key (EMSK)
Additional keying material derived between the EAP client
and server that is exported by the EAP method. The EMSK is
at least 64 octets in length. The EMSK is not shared with
the authenticator or any other third party. The EMSK is
reserved for future uses that are not defined yet."

4-Way Handshake
A pairwise Authentication and Key Management Protocol (AKMP)
defined in [IEEE802.11i], which confirms mutual possession
of a Pairwise Master Key by two parties and distributes a
Group Key."

-------------------------------------------------------------------------
Issue 226: Comments on WLAN requirementsSubmitter name: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: 2/25/2004
Reference:
Document: EAP-WLAN-00
Comment type: 'T'echnical
Priority: S
Section: 1, 1.2, 2.2, 3
Rationale/Explanation of issue:

I don't think there is enough overview material, describing the
IEEE 802.11i environment.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap