Subject: Re: EAP method discussion at EAP BOF

From: David Jablon <[email-masked]>
Date: Mon, 04 Mar 2002 19:29:54 -0500

A recent Internet-Draft that is relevant to this EAP BOF discussion is:
http://search.ietf.org/internet-drafts/draft-jablon-speke-00.txt

        Title           : The SPEKE Password-Based Key Agreement Methods
        Author(s)       : D. Jablon
        Filename        : draft-jablon-speke-00.txt
        Pages           : 25
        Date            : 13-Feb-02
        
This document describes SPEKE, B-SPEKE, and SRP-4, three methods for
password-based key agreement and authentication. In the same class of
techniques as SRP-3 [RFC 2945], these methods provide a zero-knowledge
proof of a password and authenticate session keys over an unprotected
channel, with minimal dependency on infrastructure and proper user
behavior. These methods are compatible with IEEE 1363 and ANSI X9
standards, and are closely aligned with RFC 2945 from an application
perspective. They are also based on different fundamental techniques than
earlier patented alternatives, providing an expanded set of choices for
convenient and secure personal authentication over the Internet. 

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-jablon-speke-00.txt

At 10:39 AM 2/23/02 -0800, Bernard Aboba wrote:
>An EAP BoF session has been scheduled at IETF 53. As part of this session,
>some time has been set aside for discussion of proposed EAP
>methods. We hereby solicit EAP method authors who wish to make a 
>short (1 slide) presentation on their proposed EAP method. In the
>presentation, it can be assumed that BoF participants have read the
>draft.
>
>The slide should cover the following:
>
>a. Name of the method 
>b. Justification (why is it unique) 
>c. Usage scenario (kinds of devices, media, etc.) 
>d. EAP Type # assigned
>e. Authentication (mutual/one-way) 
>f. Support for "fast reconnect" (yes/no)
>g. Dictionary attack vulnerability (yes/no) 
>h. Key derivation? (yes/no, kinds of keys derived)
>i. Algorithms (e.g. does it use existing standard
>   algorithms or does it create new ones)
>j. Standards group dependencies (3GPP, IEEE 802.11i, etc.)

Yes, brevity is desirable.  But cramming all of the above into a single slide
may create an unnecessary burden for both presenter and audience.
A few simpler slides should be an acceptable alternate format.

>EAP BOF description:
>
>http://www.ietf.org/ietf/02mar/eap.txt