Subject: [Reap] Review of EAP-NOOB

From: Zhen Cao <[email-masked]>
Date: Wed, 11 Oct 2017 14:38:48 +0800

Hi Mohit&Tuomas,

Thank for the EAP-noob work, which is quite interesting.
I read your draft again, however the OOB step still confuses me.

In Section 3.2.2,

   Depending on the direction
   negotiated, the peer or the server outputs the OOB message containing
   the PeerId, the secret nonce Noob, and the cryptographic fingerprint
   Hoob, as defined in Section 3.3.  This message is then delivered to
   the other party via a user-assisted OOB channel.  The details of the
                                 ~~~~~~~~~~~~~~~~~~~~~
   OOB channel are defined by the application.

In the text above, the OOB message will be delivered to the other
party via the *user-assisted* OOB channel.

However, Figure.3 depicts the OOB between the peer and Server, which I
believe is between User & Server.  And this is not necessarily be over
EAP.

 EAP Peer (Should be User?) EAP Server
             |                                            |
             |=======OOB=========>|
             |      (PeerId,Noob,Hoob)      |
             |                                            |

My understanding is, the device displays the OOB message on its user
interface, and the user will read this message and relays to the
Server out of band.  Because the server and the user has a
pre-authenticated relationship, the server can regard the device as
authenticated.  The authentication delegation chain is: server trusts
the user, and user has granted access to the IoT device, so the server
will trust the IoT device (which has set a conversation with the
Initial Exchange).   This is essentially how you can bootstrapping the
authentication between two parties without any preconfigured
credentials.

Correct me if I did not get it right.

Many thanks,
Zhen