Subject: [eap] Re: Channel binding consensus call

From: Bernard Aboba <[email-masked]>
Date: Thu, 25 Aug 2005 09:17:56 -0700 (PDT)

So here are the questions:

>1. Should we take on a WG work item, a specification
>   of a solution/protocol that provides channel bindings?

Although interest in Channel Bindings has been increasingly recently,
I don't think that we are at the point where we can choose a single 
solution/protocol. 

>2. Is this solution something that should go to
>    keying framework, as "the" mechanism to be
>    used by everyone, or is it an independent
>    extension? Result from Paris, at least as far
>    as Yoshi's scheme goes, was "independent
>    extension".

I think that the keying framework does need to talk about how Channel 
Bindings fit within the architecture, but I don't think it needs to 
recommend a particular solution.  In my view, Yoshi's scheme does not 
represent an extension to the EAP Key Management Framework, since it is 
compatible with the existing document and mainly requires documentation of 
the lower layer and AAA behavior, not changes to EAP method behavior, or 
new modes of EAP key management. 

>3. Should the solution be unified in some sense
>    across different types of EAP usage or should
>    we pursue multiple approaches? An example
>    of multiple approaches would be leaving it
>    to individual method writes without coordination,
>    different mechanisms for different link layers,
>    or developing both method and aaa-key based
>    mechanisms.

I don't think it is required that all EAP methods handle Channel Bindings 
the exact same way, although some general architecture principles probably 
need to be established.  

One of the major architectural principles at stake here is whether AAA 
servers implementing EAP will remain media independent going forward. 
Today we do have media independence in AAA, so that implementations of 
RFC 3579/4072 can be used with PPP, 802.11,  IKEv2, etc. Having AAA 
servers compute different roots of the key hierarchy depending on the 
media is a fairly major change, so we need to think the implications 
through.  

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Jari Arkko <[email-masked]>
Date: Fri, 26 Aug 2005 10:46:12 +0300

>I don't think that we are at the point where we can choose a single 
(Clarification: the question I intended to ask was not
about whether we can choose the solution now, but
rather if the group wants a solution. If the answer
is yes, we'll need more work to study the various
approaches, then later we can actually pick an
approach that we develop to an RFC. Questions 2
and 3 are about what the role of such RFC would
have in relation to other possible solutions that
might be developed later or elsewhere.

And if the answer is no, we can tell the methods writers
and others that EAP will not be delivering a solution
to them.)

>media is a fairly major change, so we need to think the implications 
Yes. Similarly for the treatment of media-dependent
cb information at AAA, even if it wouldn't impact the actual
key.

--Jari