Subject: [eap] Issues and Questions draft-haverinen-pppext-eap-sim-05

From: [email-masked] (Garces, Rodrigo)
Date: Thu, 10 Oct 2002 11:23:07 -0700

Here are some issues and concerns with EAP-SIM

1) It seems to me that the number of messages could probably be reduce and still achieve the goal of providing SIM based authentication using EAP. At the same time EAP-SIM should not required any changes or minimum changes to the operators for it to be accepted as a standard. 

2) Why should there be any restrictions or additions to the pseudonym grammar beyond what is there today in 3GPP? 

3) Is there some protocol that depends upon the Authenticator knowing the pseudonym?

4) If the pseudonym is lost in the authentication server, the supplicant can be locked out of the network for ever as it does not have to respond to the identity request.  This sounds bad.

5) The maximum lengths of the fields in the 'message format' section is 1020  bytes, not 1024.

6) Is the concatenated "1" in front of the IMSI really useful?  Will it save any protocol bytes or messages?  
If not, let's drop it. I still do not see the usefulness of having the concatenated "1".

7) The EAP-SIM seems to imply that there is a need for owlan,org. Who will be running the .owlan.org service?

8) Why is the message subtype included in the MAC_SRES hash?  Does this provide any further security?

regards, 

Rodrigo Garces
Mobility Networks

---

From: [email-masked] (Joseph Salowey)
Date: Thu, 10 Oct 2002 11:44:31 -0700

At 11:23 AM 10/10/2002 -0700, Garces, Rodrigo wrote:

>1) It seems to me that the number of messages could probably be reduce and 
>still achieve the goal of providing SIM based authentication using EAP. At 
>the same time EAP-SIM should not required any changes or minimum changes 
>to the operators for it to be accepted as a standard.

What do you have in mind?

>2) Why should there be any restrictions or additions to the pseudonym 
>grammar beyond what is there today in 3GPP?

I don't think there are any restrictions on the Pseudonym grammar.  I don't 
think the 3GPP restrictions necessarily apply.

>3) Is there some protocol that depends upon the Authenticator knowing the 

How the authentication server manages the pseudonym is not defined in this 
document.  Is this what you mean?

>4) If the pseudonym is lost in the authentication server, the supplicant 
>can be locked out of the network for ever as it does not have to respond 
>to the identity request.  This sounds bad.

THis depends upon the implementation. It is possible for the implementation 
to allow manual intervention so the client knows they are sending their 
clear IMSI and can choose to accept that risk.  Other implementations on 
the client are possible.

>If not, let's drop it. I still do not see the usefulness of having the 

Good question.

>be running the .owlan.org service?

What do you mean by owlan.org service?

>provide any further security?

See changes in draft 6 which is now available

>regards,
>
>Rodrigo Garces
>Mobility Networks
>_______________________________________________
>eap mailing list
>[email-masked]
>http://mail.frascone.com/mailman/listinfo/eap