Subject: RE: [eap] EAP SIM and AKA identities.

From: <[email-masked]>
Date: Thu, 7 Apr 2005 12:03:02 +0300

Hello Suresh,
 
The term "identity" refers to an identity string that includes the realm
portion in environments where a realm is needed. "Username" refers to
the username portion of the identity. Explanations for the terms 
"permanent identity" and "permanent username" are included in the terms section
of the documents. 
 
The leading digit (0 or 1) of the permanent username would be useful as a hint only when processing 
an EAP-Response/Identity packet. The peer uses AT_IDENTITY only in response to an EAP-SIM or EAP-AKA
packet, so the EAP method has already been selected in this phase. Hence
the server does not need to use the leading digit of the username as an EAP method selection
hint anymore. Nevertheless, if the peer composes the permanent username from
the IMSI, as specified in the drafts, then the peer will still include the leading digit.
 
The format of AT_IDENTITY is specified in section 9.8 of EAP-SIM and section
9.5 of EAP-AKA. These sections say that the same identity format is used in the AT_IDENTITY
attribute and the EAP-Response/Identity packet, with the exception
that the peer MUST NOT decorate the identity it includes in AT_IDENTITY. The identity format is 
specified in section 4.2.1 of EAP-SIM and  4.1.1 of EAP-AKA.
 
The realm portion is not considered as decoration. In other words, If the identity includes a realm 
portion in the present enviroment, then the peer includes the realm also in the AT_IDENTITY attribute.
 
Best regards,
Henry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of ext Suresh
Sent: 06 April, 2005 10:13
To: [email-masked]
Subject: [eap] EAP SIM and AKA identities.

Hi
I have a small clarification in the identities and user names used in the EAP-SIM and AKA implementations.
When ever a client needs to send fill in the AT_IDENTITY attribute, it has to fill in the complete identity, and the identity may or may not have a realm portion.
The format of the permanent user name is 0|IMSI and 1|IMSI for the AKA and SIM respectively. 
It is also given that 

   The EAP server MAY use the leading "1" as a hint to try EAP-SIM as
   the first authentication method during method negotiation, rather
   than for example EAP/AKA.  The EAP-SIM server MAY propose EAP-SIM
   even if the leading character was not "1".

for EAP-AKA. 

I could not understand how user name is sent to the EAP-Server, in actual, complete identity is sent in the AT_IDENTITY attribute and not just the user name.

regards,
Suresh

---

From: Suresh <[email-masked]>
Date: Mon, 11 Apr 2005 11:31:34 +0530

Hell Henry,

Thanks for the mail. Just to consolidate my understanding, Identity 
exchanged in the EAP-Identity/Response, can be obfuscated, truncated, or 
decorated. This information can be used to select the method for 
authentication, and some routing information. So, if the Identity exchanged 
in the EAP-Identity/Response, has user name, which is prep ended with "0", 
then the authentication method to be selected can be AKA. If prep ended 
with "1", then the authentication method can be SIM. This is how, permanent 
user names if sent, the server has the clue to select the authentication 
methods.

Of course this has to be done, only during EAP-Identity/response phase, not 
during AT_IDENTITY, as in the latter case, method is already known.
Is my understanding correct?

regards
Suresh

>>When ever a client needs to send fill in the AT_IDENTITY attribute, it 
>>has to fill in the complete identity, and the identity may or may not 
>>have a realm portion.
>>I could not understand how user name is sent to the EAP-Server, in 
>>actual, complete identity is sent in the AT_IDENTITY attribute and not 
>>just the user name.
>>
>>regards,
>>Suresh
>> 
>>