Subject: Re: [eap] EAP pre-authentication, EAP re-authentication, etc.

From: "Bernard Aboba" <[email-masked]>
Date: Sun, 01 Oct 2006 15:07:17 -0700

>How about this?
>
>EAP  pre-authentication
>The utilization of EAP to pre-establish EAP keying material on an
>authenticator prior to arrival of the peer at the access network managed by
>that authenticator.

Looks good.

>Note that the EAP peer may not know whether previously established keying
>material is valid unless it has recently exchanged data with the 
>authenticator,
>protected by TSKs derived from that keying material.
>
>Hmmm.... This is tricky. In the absence of explicit authenticator
>identifiers, even if the host (peer) is using the same connection to the
>access network, it cannot know the same authenticator is used. Things like
>authenticator relocation can happen transparent to the peer.

Actually, I think all that matters is that the keying material is unexpired 
so that the new EAP authentication replaces the existing keying material.   
How about this?

EAP re-authentication
The completion of EAP authentication between a peer and an authenticator
with whom the EAP peer shares valid unexpired keying material.

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: "Alper Yegin" <[email-masked]>
Date: Mon, 2 Oct 2006 09:52:23 +0300

> with whom the EAP peer shares valid unexpired keying material.

Yes, this looks good taking into account "the authenticator."

How about "the authentication server?" Completing of a new EAP
authentication with the authentication server while the two are still
sharing an unexpired EMSK could also be considered "re-authentication". This
is not related to the authenticator at all (i.e., it may or may not be a
re-authentication with the authenticator).  

Are we only interested in re-authentication with respect to the
authenticators?

Alper

---

From: "Bernard Aboba" <[email-masked]>
Date: Mon, 02 Oct 2006 11:50:30 -0700

Yes, it should probably be:

EAP re-authentication
The completion of EAP authentication between a peer and a server
with whom the EAP peer shares valid unexpired keying material.

>From: "Alper Yegin" <[email-masked]>
>To: "'Bernard Aboba'" <[email-masked]>,<[email-masked]>
>Subject: RE: [eap] EAP pre-authentication, EAP re-authentication, etc.
>Date: Mon, 2 Oct 2006 09:52:23 +0300
>
>
> > EAP re-authentication