Subject: [eap] Re: EAP multiplexing model

From: [email-masked] (Bernard Aboba)
Date: Wed, 25 Sep 2002 21:42:34 -0700 (PDT)

Jari wrote:

> We debated yesterday whether the NAK can come at any time.
> I have a related question: can Success can at any time? Say,
> at the time the peer still thinks method X is in progress,
> not yet finished? I am assuming Failure can come at
> any time.

I think the key to answering this question is understanding the
interplay between the EAP method and the mux.

I don't believe that Success can come at any time in a mutually
authenticating method. If a mutually authenticating method has been
negotiated (e.g. an EAP-Request with Type=X is answered by EAP-Response
with Type=X), and server authentication is not complete, then if the
peer receives a Success, it should be silently discarded. This is
accomplished by having the method indicate to the mux when authentication
is complete.

I also believe that there are methods for which there would not be a
reason to accept EAP Failure at any time. For example, a method
negotiates a key up front, then after that the method can require that all packets
(including a method-specific success/failure indication) be protected.
For such a method, the supplicant should silently discard cleartext EAP
Failure message received prior to receipt of a protected method-specific
failure indication.

So in addition to allowing a peer method to tell the mux "Authentication
complete" (implying that an EAP Success can be accepted if received by the
peer), I'd suggest that a peer method can indicate "Failure recognized"
(implying that an EAP Failure can be accepted if received by the peer).

I don't see an issue with the two sides getting out of sync as a result of
discarding inappropriate cleartext success/failure indications because
presumably protected indications need to take precedence and if those are
correctly sent then both sides will have the correct view of the result.