Subject: [eap] Resolution of Issue 25: Accept

From: [email-masked] (Bernard Aboba)
Date: Wed, 27 Nov 2002 18:00:12 -0800 (PST)

Issue 25: Spoofing and duplicate detection
Submitter: Jesse Walker
Submitter email address: [email-masked]
Date first submitted: May 3, 2002
Reference:
Document: RFC2284bis-04
Comment type: T
Priority: S
Section: 2.2, 7.7

Proposed resolution:

Delete Section 7.7.

Add the following text to Section 2.2:

"The EAP layer provides sequencing and duplicate elimination
to EAP methods. During the period after an
EAP Peer receives an EAP-Request, but has not yet sent an
EAP-Response, the Peer EAP layer MUST silently
discard additional EAP packets upon reception, rather
than providing them to the EAP method. This occurs whether
the received packet is a duplicate (same Identifier) or
not (different Identifier).

This provides an opportunity for a denial of service attack:
an attacker can swamp a Peer with EAP Requests,
preventing valid EAP Requests from being processed.
Addressing this requires an EAP method to be able
to indicate to the EAP layer that it wants to handle
duplicate elimination and packet validation itself, which
is not supported."