Subject: [Nea] Pros and cons of EAP for L2 PT

From: brford <[email-masked]>
Date: Thu, 09 Jun 2011 16:33:07 -0400

In
> PT-EAP: Posture Transport (PT) Protocol For EAP Tunnel Methods
>> draft-hanna-nea-pt-eap-00.txt
>>                 

It says...
> EAP-TNC is designed to operate as an inner EAP [10] method over an
>    EAP tunnel method that meets the Requirements for a Tunnel Based EAP
>    Method [17]. PT-EAP therefore can operate over a number of existing
>    access protocols that support EAP for authentication. Some examples
>    of such access protocols include 802.1X [7] for wired and wireless
>    networks and IKEv2 [15] for establishing VPNs over IP networks.

Does that mean that the data gathered at an endpoint via some NEA client
would be available to party that controls the 802.1x or IKEv2 exchange?

Would that data only be available after a successful 802.1x auth or tunnel
negotiation?

On 6/9/11 3:00 PM, "[email-masked]" <[email-masked]> wrote:

> Message: 1
> Date: Thu, 9 Jun 2011 13:03:52 -0400
> From: Stephen Hanna <[email-masked]>
> To: "[email-masked]" <[email-masked]>
> Subject: [Nea] Pros and cons of EAP and TLVs for L2 PT
> Message-ID:
> <[email-masked]>
> Content-Type: text/plain; charset="us-ascii"
> 
> As I mentioned in my recent email to the NEA list, the
> PT draft editors have been working (as requested at the
> last NEA WG meeting) on a list of pros and cons for
> different approaches to the L2 PT protocol. This group
> has now agreed on a set of pros and cons:
> 
> EAP for PT
> Pro: Can export keys (but no clear value at this time)
> Pro: Multiple Interoperable Independent Implementations
> Con: More likely to accidentally be used outside EAP tunnel
> 
> TLVs for PT
> Pro: Can run in parallel with authentication
> 
> Of course, these are just bullet points. They're quite
> short and don't capture all the nuances of the issues.
> Let's start up an email discussion on the NEA list where
> we can elaborate on these points and discuss them. In the
> end, I hope that we can reach rough consensus on what is
> the best approach.
> 
> So let the discussion begin!
> 
> Thanks,
> 
> Steve
>

---

From: Stephen Hanna <[email-masked]>
Date: Thu, 9 Jun 2011 17:21:35 -0400

Good question. With both L2 PT proposals that we have
received, data gathered at the endpoint is available
in unprotected form to the EAP server that terminates
the tunnel method. The EAP peer must authenticate the
EAP server and determine that it is trusted to receive
data about the endpoint's posture. However, this is
not an unusual requirement. When using a tunnel method,
EAP peers are generally expected to authenticate the
EAP server and decide whether it's trustworthy before
any data is sent over the tunnel method.

You asked about whether "the party that controls the
802.1x or IKEv2 exchange" would have access to data
on endpoint posture. That depends on the deployment
environment and what you meant by those words. In an
802.1X environment, the authenticator (e.g. a wireless
access point) generally would NOT have access to data
on endpoint posture. That data would be conveyed in
the encrypted, authenticated EAP tunnel method to
the EAP server.

None of this is different whether you use TLVs or
an EAP method to carry the NEA exchange.

Thanks,

Steve

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> brford
> Sent: Thursday, June 09, 2011 4:33 PM
> To: NEA
> Subject: [Nea] Pros and cons of EAP for L2 PT
> 
> 
> In
> _______________________________________________
> Nea mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nea

---

From: Andreas Steffen <[email-masked]>
Date: Fri, 10 Jun 2011 08:02:09 +0200

> the encrypted, authenticated EAP tunnel method to
The same holds with IKEv2. If a tunneled EAP method
(e.g. EAP-TTLS or EAP-FAST) is used to encapsulate
the PT protocol then the IKEv2 Policy Enforcement Point
(i.e. the VPN gateway) does not have any access to the
data).

> an EAP method to carry the NEA exchange.
Best regards

Andreas

>>> So let the discussion begin!

======================================================================
Andreas Steffen                         [email-masked]
strongSwan - the Linux VPN Solution!                www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==