Subject: [eap] EAP SIM and AKA identities.

From: Suresh <[email-masked]>
Date: Wed, 06 Apr 2005 12:43:06 +0530

>
>Hi
>I have a small clarification in the identities and user names used in the 
>EAP-SIM and AKA implementations.
>When ever a client needs to send fill in the AT_IDENTITY attribute, it has 
>to fill in the complete identity, and the identity may or may not have a 
>realm portion.
>The format of the permanent user name is 0|IMSI and 1|IMSI for the AKA and 
>SIM respectively.
>It is also given that
>
>    The EAP server MAY use the leading "1" as a hint to try EAP-SIM as
>    the first authentication method during method negotiation, rather
>    than for example EAP/AKA.  The EAP-SIM server MAY propose EAP-SIM
>    even if the leading character was not "1".
>
>for EAP-AKA.
>
>I could not understand how user name is sent to the EAP-Server, in actual, 
>complete identity is sent in the AT_IDENTITY attribute and not just the 
>user name.
>
>regards,
>Suresh
> 
>

---

From: <[email-masked]>
Date: Mon, 11 Apr 2005 12:19:35 +0300

Hi Suresh,
 
Please see inline.
 
 -----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of ext Suresh

Hell Henry,

Thanks for the mail. Just to consolidate my understanding, Identity exchanged in the EAP-Identity/Response, can be obfuscated, truncated, or decorated. This information can be used to select the method for authentication, and some routing information. So, if the Identity exchanged in the EAP-Identity/Response, has user name, which is prep ended with "0", then the authentication method to be selected can be AKA. If prep ended with "1", then the authentication method can be SIM. This is how, permanent user names if sent, the server has the clue to select the authentication methods. 

Right. The drafts recommend the server not to rely on the identity string sent in EAP-Identity/Response.
The leading digit may be used as an EAP method seletion hint during method negotiation, but there may 
be other ways to select the EAP method, too. 

Of course this has to be done, only during EAP-Identity/response phase, not during AT_IDENTITY, as in the latter case, method is already known.
Is my understanding correct?

Yes, you are right that the contents of the identity in AT_IDENTITY must not be used as any kind of
hint to select  the EAP method anymore. But if you compose the permanent user name from the IMSI 
as specified in the drafts, then you must prepend the leading digit in all cases, even for AT_IDENTITY.
For simplicity, the drafts only specify one format for the permanent identity, and that format
is used always.
 
Best regards,
Henry