Subject: RE: EAP-SRP and identity privacy

From: [email-masked]
Date: Wed, 20 Jun 2001 18:39:06 +0300

Hi James,

I just have time for one quick comment, I'll get back 
with more comments later.

> The authenticator *would* have to maintain state across calls in order
> to use the pseudonym; you must at least to keep track of that random
> salt.  Otherwise, you either always have the same pseudonym or you
> can't recognize the client by his pseudonym when he comes back.

If the authenticator generates the pseydonym by encrypting the string
random number || cleartext_identity with its private key for this purpose
(the same key for all users), then different pseudonyms will generated 
each time, except in the unlikely event that the random number generator 
gives the same random number. When the authenticator decrypts any pseudonym,
it recovers the string random number||cleartext_identity, and hence it 
is always able to recognize the client. So no need to keep state or even 
use the pseudonyms in order.

Regards,
Henry

---

From: James Carlson <[email-masked]>
Date: Wed, 20 Jun 2001 11:50:50 -0400 (EDT)

> with more comments later.

OK.

> use the pseudonyms in order.

Ah, I think I see what you're suggesting now.  So, you're proposing
two levels of encryption on the server side -- one with this private
key, then again with the ephemeral key "K".  The client decrypts with
"K" to reveal the encrypted identity, and uses that as its identity
in the next session.

That appears to fix an important problem.  It allows the protocol to
run without having to requery for identity -- the identity is always
in the pseudonym, and it's always valid.

The tradeoff would be that some form of reversible encryption is
required, and that makes it tougher (in that respect) to deploy.  Hmm.

-- 
James Carlson, Internet Engineering       <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677

---

From: James Carlson <[email-masked]>
Date: Wed, 20 Jun 2001 11:52:17 -0400 (EDT)

(Resend; last message omitted the mailing list cc.  Sigh ...)

OK.