Subject: RE: [Emu] Crypto-binding in TTLS-v0

From: "[email-masked]" <[email-masked]>
Date: Thu, 16 Aug 2007 15:00:37 +0000 (UTC)

I with Alan on this.
I still haven't seen one yet either.

But I'd love to see a version of EAP-FAST that I _could_ work with.

Meaning; 
- it runs with something more accessible than the Cisco ACS server,
 preferably an open source or reference copy.  Maybe even an 
Windows/IAS plugin.

- there is a Windows EAPhost supplicant availible, preferably with 
interfaces for tunnelled methods and/or interfaces for the ID we wrote 
for SecurID PAC provisioning.
draft-cam-winget-eap-fast-potp-provisioning-00.txt
(hmm... time to renew that)

If you have any of this, let me know.

Dave Mitton,
RSA - Security Division of EMC.

----Original Message----
From: [email-masked]
Date: Aug 16, 2007 10:13 
To: "Alan DeKok"<[email-masked]>, "Nancy Winget (ncamwing)"
<[email-masked]>
Cc: "Ryan Hurst"<[email-masked]>, <[email-masked]>
Subj: RE: [Emu] Crypto-binding in TTLS-v0

Alan,
It is not unusual for developers to be unaware of the breath of the
EAP-FAST market adoption. It has been growing under the radar for a 
lot
of people since market research firms do not track market share of
different EAP methods.

Part of the misperception that EAP-FAST has no market presence has 
been
because no one has been drawing attention to the adoption success of
EAP-FAST. I am hoping to assemble some public data to shed a light on
the secret life of EAP-FAST.

Gene

------------------------------------------------------------------------
----
Eugene Chang (genchang)
WNBU, Technical Leader
Office:   603-559-2978
Mobile:  781-799-0233

-----Original Message-----
From: Alan DeKok [mailto:[email-masked]] 
Sent: Thursday, August 16, 2007 8:46 AM
To: Nancy Winget (ncamwing)
Cc: Ryan Hurst; [email-masked]
Subject: Re: [Emu] Crypto-binding in TTLS-v0

Nancy Winget (ncamwing) wrote:
> Thanks Alan, I am glad to see that the evaluation is continuing on 
the
> thread.....I think both TTLS and EAP-FAST are being widely deployed
and
> both merit consideration.

  I think EAP-FAST has been considered, and has little support.  I've
never seen an EAP-FAST deployment, and most people I talk to haven't
seen one, either.  Most people I talk to don't plan on supporting
EAP-FAST any time soon.

  Alan DeKok.

_______________________________________________
Emu mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/emu

_______________________________________________
Emu mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/emu

_______________________________________________
Emu mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/emu

---

From: "Gene Chang \(genchang\)" <[email-masked]>
Date: Thu, 16 Aug 2007 11:35:43 -0400

Dave,
There is an EAP-FAST implementation on FreeRADIUS from Jouni Malinan. I
don't know how much testing has already gone into the module.

I don't know of a client side implementation with APIs for you to
integrate the SecurID PAC provisioning.

Gene

 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Thursday, August 16, 2007 11:01 AM
To: [email-masked]
Subject: RE: [Emu] Crypto-binding in TTLS-v0

I with Alan on this.

Meaning; 

Dave Mitton,

----Original Message----
From: [email-masked]
Date: Aug 16, 2007 10:13 
To: "Alan DeKok"<[email-masked]>, "Nancy Winget (ncamwing)"
<[email-masked]>

Alan,

Gene

 

-----Original Message-----
From: Alan DeKok [mailto:[email-masked]] 
Sent: Thursday, August 16, 2007 8:46 AM
To: Nancy Winget (ncamwing)
Cc: Ryan Hurst; [email-masked]
Subject: Re: [Emu] Crypto-binding in TTLS-v0

the
and

  Alan DeKok.

---

From: Alan DeKok <[email-masked]>
Date: Thu, 16 Aug 2007 11:39:31 -0400

Gene Chang (genchang) wrote:
> There is an EAP-FAST implementation on FreeRADIUS from Jouni Malinan.

  If there was, I would have known about it.

  Jouni has added EAP-FAST to hostapd and to wpa_supplicant.  While
hostapd is a RADIUS server, it's pretty minimal.  i.e. not database
support, no policy language, etc.

  If there is an EAP-FAST patch for FreeRADIUS, I'd like to see it.

  Alan DeKok.

---

From: "Hao Zhou \(hzhou\)" <[email-masked]>
Date: Thu, 16 Aug 2007 18:26:15 -0400

There is an EAP-FAST module for EAPHost plug-in, which currently uses
three hard coded inner methods, EAP-GTC, EAP-MSCHAPv2 and EAP-TLS. But
it can be extended to work with EAPHost supplicant interface to load any
inner method registered with EAPHost. Will you have a POTP plug-in soon?
The problem is to find a server that supports provisioning with POTP. I
can work with you to make it happen.

> From: Gene Chang (genchang) 
> Sent: Thursday, August 16, 2007 11:36 AM
> To: [email-masked]; [email-masked]
> There is an EAP-FAST implementation on FreeRADIUS from Jouni 
> Malinan. I don't know how much testing has already gone into 
> the module.
> 
> I don't know of a client side implementation with APIs for 
> you to integrate the SecurID PAC provisioning.
> 
> Gene
> 
> - it runs with something more accessible than the Cisco ACS 
> server,  preferably an open source or reference copy.  Maybe 
> even an Windows/IAS plugin.
> 
> - there is a Windows EAPhost supplicant availible, preferably 
> with interfaces for tunnelled methods and/or interfaces for 
> the ID we wrote for SecurID PAC provisioning.
> It is not unusual for developers to be unaware of the breath 
> of the EAP-FAST market adoption. It has been growing under 
> the radar for a lot of people since market research firms do 
> not track market share of different EAP methods.
> 
> Part of the misperception that EAP-FAST has no market 
> presence has been because no one has been drawing attention 
> to the adoption success of EAP-FAST. I am hoping to assemble 
> some public data to shed a light on the secret life of EAP-FAST.
> 
> Gene
> 
>   I think EAP-FAST has been considered, and has little 
> support.  I've never seen an EAP-FAST deployment, and most 
> people I talk to haven't seen one, either.  Most people I 
> talk to don't plan on supporting EAP-FAST any time soon.
> 
>   Alan DeKok.
>

---

From: Jouni Malinen <[email-masked]>
Date: Thu, 16 Aug 2007 19:56:00 -0700

>   If there was, I would have known about it.

Yes, and I would assume I would also be aware of this should such a
thing have happened ;-).

> support, no policy language, etc.

I added EAP-FAST support to hostapd mainly to make it (much) easier for
me to test client side code in wpa_supplicant. Anyway, that means that
there is an open source implementation available for both the server and
peer side of EAP-FAST should someone be interested in testing them and
was just waiting for broader set of available implementations or access
to source code. I would obviously be interested in any feedback on the
implementations, too. I try to run as complete interop tests with other
implementations as feasible, but don't really have unlimited resources
for doing this, so any additional testing would be welcome.

Sure, hostapd as a RADIUS server is not meant for large and complex
deployments, but I think it works well as a testbed component for
testing various EAP methods, including EAP-FAST. In addition, based on
past history, it looks like I have quite open view in adding support for
new EAP methods regardless of their completeness, popularity, or even
suitability for anything ;-). I see this as one of the best ways to
evaluate protocol designs and specifications and more or less mandatory
part of standard development.

-- 
Jouni Malinen                                            PGP id EFC895FA