Subject: [HOKEY] How does overloading EAP Req&Resp/Id and Success work in these cases?

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 12 Apr 2007 02:01:11 -0700

Consider the following cases:

In Case 1, EAP Success may be lost in transmission, but EAP works.  The 
Peer would have computed the MSK as part of the EAP Method and the 
Authenticator would have received the MSK.  The Success message will 
make it that far: AAA will make sure of that (e.g., RADIUS message pairing).

How would Type-based re-authentication approaches work in such cases in 
1 RT (or 1.5 RT, counting the EAP Req/Id?)?  More specifically what 
happens when the EAP Success (let's say modified and carrying additional 
data) message gets lost between the Peer and the Authenticator?

************* Case 1 ***************************

Peer                Authenticator                   AS

  <----EAP Req/Id--------

  -----EAP Resp/Id------>   -----AAA(EAP Resp/Id)---->

  <====EAP Method=======>   <====AAA(EAP Method)=====>

               X<--------   <--AAA(EAP Success,MSK)--
               EAP Success

*******************************************************

On Case 2, I am not sure how 3748-compliant it is, but I have had people 
argue with me that it is in fact compliant and I can see how it might 
be.  The NAI might be available through the lower layer and the 
Authenticator, in the interest of saving over the link (over the air 
really, and that too over licensed spectrum, since that's where there is 
a motivation to reduce link usage) bandwidth, sends the AAA message 
containing EAP Response/Identity.

In such cases, the problem is two-fold.  In addition to the Success 
being lost, there may be no provision to even send additional data as 
part of the EAP Response/Identity.  How would Type-based 
re-authentication approaches work in such cases?

************ Case 2 ***************************

Peer                Authenticator                   AS

  <===LowerLayerXchg(NAI)===>

                            -----AAA(EAP Resp/Id)---->

  <====EAP Method=======>   <====AAA(EAP Method)=====>

               X<--------   <--AAA(EAP Success,MSK)---
               EAP Success

****************************************************

There is simply no way to ensure "no changes to authenticator" in 
supporting efficient reauthentication.

thanks,
Lakshminath

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey