Subject: [eap] EAP and roaming

From: Julien Bournelle <[email-masked]>
Date: Fri, 13 May 2005 12:10:00 +0200

Hi all,

 In the roaming case, the EAP authenticator and EAP server do not belong
 to the same administrative entity. LEt's say that authenticator belong
 to company A and EAP server to company B.

 In draft-ietf-eap-keying-06.txt, it is assumed that the
 AAA-Key is provided in a AAA-Token. 

 From security requirements in p. 51:

 "TO ensure against compromise, the AAA-Token MUST be integrity
 protected, authenticated, replay protected and encrypted in transit,
 using well-established cryptographic algorithms"

 TO follow this requirement, it implies that the A's EAP authenticator
 has a direct SA with B's EAP server.

 So if the company B does not allow SA establishment between its EAP
 server with EAP authenticator from other company, EAP shouldn't be used.

 Am I missing something ?
 
-- 
julien.bournelle at int-evry.fr
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap