Subject: I-D ACTION:draft-ietf-pppext-eap-srp-03.txt

From: [email-masked]
Date: Tue, 10 Jul 2001 10:27:14 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Point-to-Point Protocol Extensions Working Group of the IETF.

	Title		: PPP EAP SRP-SHA1 Authentication Protocol
	Author(s)	: J. Carlson, B. Aboba, H. Haverinen
	Filename	: draft-ietf-pppext-eap-srp-03.txt
	Pages		: 25
	Date		: 09-Jul-01
	
The Extensible Authentication Protocol (EAP) [RFC2284] describes a
framework that allows the use of multiple authentication mechanisms.
This document defines an authentication mechanism for EAP called
SRP-SHA1, based on the Secure Remote Password (SRP) [RFC2945]
protocol.
EAP can be used with the Point-to-Point Protocol (PPP) [RFC1661] for
link authentication.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-pppext-eap-srp-03.txt

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-pppext-eap-srp-03.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-pppext-eap-srp-03.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Jacques Caron <[email-masked]>
Date: Mon, 16 Jul 2001 15:33:39 +1000

Hi,

Just read the new version. Getting good!

A few comments, though:
1. It focuses a bit too much on PPP and its associated protocols (ECP). I 
guess other implementations (such as 802.1x) and associated protocols 
(WEP...) should be at least mentionned.

2. The new lightweight challange is nice, but I still have a problem with 
the link/EAP endpoint separation when using AAA. In the case of a remote 
AAA server, the reauth should probably be end-to-end (AAA server to EAP 
client), not on the local link (this enables a home server to ensure that 
the user is still connected and that the local NAS/AP is not trying to 
cheat and bill more usage time -- to the contrary of what is said in 
section 2.8, btw).
However, this requires that the key remain local (in the AAA server). But 
one wouldn't want to preclude the use of the key for encryption either 
(even though the NAS/AP operator can then decrypt the data, it's still 
better than clear data over the air in the case of 802.11 connections). I 
still think deriving two keys (by deriving a longer key and splitting it, 
for instance) would be the better solution.

3. The E bit is not protected. Not sure if that's actually an issue (my 
tortuous mind hasn't come up with a case yet), but maybe somebody else can 
find one ;->

4. I think a quick mention of the username hiding (pseudonym) feature in 
section 1 would be a good thing. Always better to describe what you're 
talking about before that stuff popping up in the description of the 
packets :-)

Thanks,

Jacques.

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com