Subject: [eap] Issue 22: Issues with mandatory to implement method

From: [email-masked] (Bernard Aboba)
Date: Tue, 7 May 2002 17:49:27 -0700 (PDT)

Issue 22: Issues with mandatory to implement method
Submitter: Jesse Walker
Submitter email address: [email-masked]
Date first submitted: May 3, 2002
Reference: 
Document: RFC2869bis-04
Comment type: T
Priority: S
Section: 5.4
Rationale/Explanation of issue:

Here is an example where we should note that using EAP unchanged
can be a more of a danger than a help in some new environments. Section
5.4 says of MD5-Challenge on page 16:

All EAP implementations MUST support the MD5-Challenge mechanism.

While this might make sense for legacy dial-in environments (does it
really? how many times have you seen someone cable their PC modem to their
cell-phone in an airport?), it does not for wireless LANs in particular,
where MD5-Challenge is simply a credentials publication mechanism when a
password is used, and always subject to man-in-the-middle attacks, even if
a key rather than a password is somehow used. These problems should be
explicitly noted, and we need to develop wide understanding of the
problem.