Subject: [eap] Status of the proposed EAP WG?

From: [email-masked] (Luca Salgarelli)
Date: 01 May 2002 17:05:58 -0400

Hello Bernard.

After the EAP BOF in Minneapolis not much has been said about what
happens next. 

Given that the results of the BOF were not that clear, at least to me,
in terms of what we agreed on for the charter, does anybody have any
news on what is going to happen next? Is there going to be an EAP BOF-2
in Yokohama?

Thanks
Luca

---

From: [email-masked] (Bernard Aboba)
Date: Thu, 2 May 2002 15:00:02 -0700 (PDT)

EAP BOF REPORT

The minutes of the EAP BOF at IETF 53 have been posted at:

http://www.drizzle.com/~aboba/EAP/eapbof.txt
http://www.drizzle.com/~aboba/EAP/presentations.zip

As noted in the BOF minutes, there was widespread agreement that an EAP WG
should be formed. Discussion relating to the strawman charter (see
below) occurred both during the EAP BOF, and to some extent, afterwards,
as individuals have posted their views on the charter to the ADs. We can
continue that discussion on this list, so as to get closer to agreement on
it.

PROGRESS REPORT ON RFC 2284bis and RFC 2869bis

The latest drafts are available here:

http://www.ietf.org/internet-drafts/draft-ietf-pppext-rfc2284bis-04.txt
http://www.ietf.org/internet-drafts/draft-aboba-radius-rfc2869bis-01.txt
http://www.ietf.org/internet-drafts/draft-aboba-pppext-key-problem-01.txt

Current issues with RFC 2284bis are tracked here:

http://www.drizzle.com/~aboba/EAP/eapissues.html

In terms of progress on RFC 2284bis and RFC 2869bis, we seem to be moving
along at a reasonable pace. As noted in the RFC 2284bis issues list, the
open issues include:

Issue #3 Pending    EAP needs a formal state machine
Issue #7 Pending    Ability to authenticate with multiple methods one
                    after another not specified
Issue #10 Pending   No support for acknowledged Success or Failure
Issue #13 Pending   Identifier usage not specified 
Issue #14 Pending   EAP transport behavior not specified 
Issue #18 Pending   Identifier behavior details 

The issue that needs the most work here is the EAP state machine, which
is to be submitted as an IETF Internet-Draft by Bryan Payne of University
of Maryland. 

Open issues with RFC 2869bis include:

Issue #15 Pending   NASREQ Key Distribution insecure
Issue #16 Pending   EAP corner conditions 
Issue #19 No Disc.  User-Name in EAP/RADIUS 
Issue #20 No Disc.  Reply-Message attribute in Access-Accept or
                    Access-Reject 

The biggest issue with RFC 2869bis revolves around key distribution and
the associated attributes and security model. Analysis is ongoing in this
area by Jesse Walker of Intel and Russ Housley of RSA. For details, see:

http://www.ietf.org/internet-drafts/draft-walker-aaa-key-distribution-00.txt

CHARTER UPDATE

The strawman EAP WG charter is enclosed below. This formed the basis for
the discussion at the IETF 53 EAP BOF. During the BOF and subsequent
discussion, the comments on the charter fell into several categories:

a. Strawman as "minimum set of work items".  During the EAP BOF and
subsequently, there wasn't much discussion about removing items from the
strawman charter. So we seem to have agreement that the strawman
represents a minimum set of work items that need to be completed. The
discussion therefore centers around what needs to be added. 

b. Venue. We had a number of comments relating to the RFC 2284bis (PPPEXT
WG) and RFC 2869bis (AAA WG) work items. Since these items are
already chartered within existing WGs, and seem to be moving forward, 
it was suggested that they be allowed to complete within the existing WGs,
rather than moving them to an EAP WG. This might also better allow the EAP
WG to take on additional work items beyond what is in the strawman
charter. On the other hand, there were also comments that the RFC 2284bis
effort might be integrated with other EAP Work if it were in an
EAP WG. 

c. Need for key management work. There seemed to be agreement that the
work on key management was particularly important, though the full extent
of the required work is not completely defined. 

d. Need for review of methods. Quite a few EAP methods were covered in the
BOF, and there seemed to be a high level of interest in review/discussion
of methods. In general, there seemed to be consensus around the
idea that the EAP WG would review methods in some form. However, the
relationship of method review to the charter is not as clear. For
example, should the EAP WG standardize methods? If so, what kinds of
methods, how many and for what purposes? A variety of opinions were
expressed on this subject; there was a suggestion that perhaps the usage
scenarios could be characterized, and methods could be standardized within
the categories. 

------------------------------------------------------------------------------
Strawman charter proposal 

EAP Working Group (EAP)

Chair(s):
   This space for rent

Area Director(s):
   Thomas Narten <[email-masked]>
   Erik Nordmark <[email-masked]>

Security Advisor:
   Bill Arbaugh <[email-masked]>

Mailing Lists:

General discussion: [email-masked]
To subscribe: send a message with "subscribe" in the subject to 
              [email-masked]
Archive: http://mail.frascone.com/pipermail/eap/

The EAP working group will restrict itself to the following short-term
work items in order to fully document and improve the interoperability of
the existing EAP protocol:

1.  IANA considerations. 
2.  Threat model and security considerations.
3.  EAP state machine.
4.  Clarification and documentation of EAP keying issues
5.  Documentation of interaction between EAP and other layers.   
6.  Resolution of interoperability issues. 
7.  Type space extension to support an expanded Type space.
8.  EAP applicability statement 
9.  Update of RADIUS/EAP section of RFC 2869

Goals and Milestones

Jun  02   IANA considerations draft to RFC Editor.
Jun  02   EAP type extension section for RFC 2284bis. 
Jun  02   EAP Security considerations section for RFC 2284bis.
Jun  02   EAP state machine section for RFC 2284bis.
Sep  02   RFC 2869bis published as Proposed Standard RFC.
Sep  02   RFC 2284bis published as Proposed Standard RFC.
Sep  02   EAP applicability statement published as Informational RFC.
Sep  02   EAP keying issues doc published as Informational RFC.