Subject: [eap] Re: method identification

From: Bernard Aboba <[email-masked]>
Date: Wed, 25 Aug 2004 11:32:54 -0700 (PDT)

> I have the following two questions? Kindly clarify.
>
> Question 1
> This is regarding EAP behaving as a relay. RFC-3579 (RADIUS support for EAP)
> states, that NAS can send a RADIUS access request with EAP-Start attribute
> to the RADIUS server.

[BA] This is not the typical mode because it implies that the NAS will be
sending an Access-Request every time a user connects, even if they cannot
respond to an Identity Request.  So if there are hosts that don't support
EAP, this generates a high RADIUS server load.

> How does the NAS inform the RADIUS server, to frame a particular
> method specific start request for the above sent Access request? i.e. how
> does the NAS informs the RADIUS server that a particular method
> functionality is required?

In RADIUS/EAP, the NAS acts as a passthrough so it lets the RADIUS server
make that determination.

> What I understood from the RFC is that, RADIUS server may frame EAP-ID
> request and to that client responds. Based on the ID received, the RADIUS
> server identifies an EAP-Method i.e. ID very specific to the method. Is
> there any specific reason that, there is no attribute in the RADIUS Access
> Request to identify an EAP-method to be used by the RADIUS server, so that
> identity will be independant of method? Kindly clarify.

The EAP-Request/Identity is independent of the EAP method.  There is no
attribute to request an EAP method because the NAS acts as a passthrough
in RADIUS/EAP.

> Question 2
> How does the RADIUS server keeps track of each EAP authentication context?
> Is there any concept of re-authentication, in Client-NAS mutual
> authentication using EAP? i.e. Can RADIUS server identify a particular
> connection has already authenticated, and it is going for re-uthentication.

Typically the RADIUS server keeps track of the context via a State
attribute.  Reauthentication is supported via the Session-Timeout
attribute in RADIUS, as explained in RFC 3580.  Since a re-authentication
looks exactly like a regular authentication, there is typically no need
for the RADIUS to distinguish between them.

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "Suresh" <[email-masked]>
Date: Thu, 26 Aug 2004 12:40:58 +0530

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Bernard Aboba
Sent: Thursday, August 26, 2004 12:03 AM
To: [email-masked]
Subject: [eap] Re: method identification

I think, NAS and client will know what type of authetication method
that they want to go for. Without knowing what authentication to be
used, I am unable to visualize how NAS starts that
particular method negotiation. And for each user that connects to the
NAS, I think there is no need to send a RADIUS access request
with EAP-Start attribute. If the NAS and the client negotiates
to go for EAP, then only NAS sends a RADIUS access request with
EAP-Start attribute to the RADIUS server. This is what I have seen
in IKEv2 using EAP as mutual authentication. The initiator in IKEv2
desires to go for EAP authentication by sending third message
without AUTH payload. I think it is similar in case of PPP.
Is there any exception?

> functionality is required?

[BA]In RADIUS/EAP, the NAS acts as a passthrough so it lets the RADIUS
server
make that determination.

Does it means that there exists a policy in RADIUS which will specify
what method has to be selected for the particular ID received in
EAP-Response/Identity.

> identity will be independant of method? Kindly clarify.

[BA]The EAP-Request/Identity is independent of the EAP method.  There is no
attribute to request an EAP method because the NAS acts as a passthrough
in RADIUS/EAP.

Yes, it is true that EAP-Request/Identity is independant of EAP method.
Is the identity received in the EAP-Response/Identity is specific to a
method? Based on the identity received, does the RADIUS server identify
that a particular EAP method has to be used?

Thank you very much for the clarification.

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 26 Aug 2004 06:12:38 -0700 (PDT)

> I think, NAS and client will know what type of authentication method
> that they want to go for.

The NAS only acts as the EAP server if it implements one or more EAP
methods and is authenticating the user locally.  Otherwise, the AAA
server acts as the EAP server and the NAS is just a pass-through.
Here is what RFC 3748 says:

   Within or associated with each authenticator, it is not anticipated
   that a particular named peer will support a choice of methods.  This
   would make the peer vulnerable to attacks that negotiate the least
   secure method from among a set.  Instead, for each named peer, there
   SHOULD be an indication of exactly one method used to authenticate
   that peer name.  If a peer needs to make use of different
   authentication methods under different circumstances, then distinct
   identities SHOULD be employed, each of which identifies exactly one
   authentication method.

> Without knowing what authentication to be
> particular method negotiation.

Unless the NAS is acting as the EAP server, it doesn't start the method
negotiation -- the RADIUS server does.

> what method has to be selected for the particular ID received in

The RADIUS server needs to be able to select an EAP method for use with a
particular authentication.  It could require the User-Name in order to do
that, or it might have the same policy for all users within a particular
realm.

> that a particular EAP method has to be used?

The EAP-Response/Identity is not specific to a method, because when the
peer sends this packet it doesn't know what method will be requested yet.
The RADIUS server may select the identity based on some or all of the
contents of the EAP-Request/Identity, or it may use the same method for
all users.  This is purely an implementation issue.

---

From: "Suresh" <[email-masked]>
Date: Fri, 27 Aug 2004 13:12:11 +0530

[BA]server acts as the EAP server and the NAS is just a pass-through.
Here is what RFC 3748 says:

Kindly tell me if my understanding is correct.

NAS need not rather should not know what EAP method
is being used, but NAS will know if at all an EAP
negotiation has to be started. i.e. to send
EAP-Request/Identity. NAS can send RADIUS access
request with EAP-Start attribute to the RADIUS Server.
But this is not default, as there are cases where
clients may not have EAP support, and may
result in un-necessary traffic to AAA.

> particular method negotiation.

[BA]Unless the NAS is acting as the EAP server, it doesn't start the method
negotiation -- the RADIUS server does.

Sending EAP-Request/Identity doesn't mean a start of method negotiation.

> that a particular EAP method has to be used?

[BA]The EAP-Response/Identity is not specific to a method, because when the

Assume that my client support an EAP method M1. It has an EAP-Identity
I1.
case 1. My client software has upgraded from EAP method M1 to EAP method M2.
I1 is independant of EAP method, as the same I1 can be used for EAP method
M2.
case 2. My client software has upgraded to support both EAP methods M1 and
M2.
In which case you should require one more Identity I2. This is to negate
attacks which force client to get itself autheticated to simplest of the
EAP methods M1, M2. This is with reference to RFC 3748

   This would make the peer vulnerable to attacks that negotiate the least

case 3. My client software has upgraded to support both EAP methods M1 and
M2.
Assume that M2 is more stronger authentication method than M1. Can the
RADIUS
server force M2 to be used? It is because, the client can send I1 and not I2
in response to EAP-ID/Request.

My question:
1) Identity is independant of EAP method that is used, but client need to
have
different identities to uniquely identify a EAP method to be used, to negate
attacks
as mentioned above. So how the case 3 mentioned above generally handled.
Kindly clarify.

Thanks
Suresh