Subject: [eap] Proposed Resolution to Issue 40: Accept

From: [email-masked] (Puthenkulam, Jose P)
Date: Wed, 27 Nov 2002 15:36:13 -0800

>> This attack may be mitigated by the following measures:
>> [a] Requiring mutual authentication within EAP tunneling mechanisms.
>> [b] Requiring cryptographic binding between EAP methods executed within a
>> sequence or between the EAP tunneling protocol and the tunneled EAP
>> methods.
>> [c] Limiting the EAP methods authorized for use without protection based
>> on peer and authenticator policy. "

>[d] Avoiding the use of sequences or tunnels when a single, strong
>method is available?

IMHO, I don't think [d] is appropriate. Because it implies that
man-in-the-attacks warrant the avoidance of tunnels
or sequences which sounds a bit drastic.

cheers,
jose

-----Original Message-----
From: Jari Arkko [mailto:[email-masked]] 
Sent: Wednesday, November 27, 2002 11:07 AM
To: Bernard Aboba
Cc: [email-masked]
Subject: Re: [eap] Proposed Resolution to Issue 40: Accept

Bernard Aboba wrote:

> This attack may be mitigated by the following measures:
> [a] Requiring mutual authentication within EAP tunneling mechanisms.
> [b] Requiring cryptographic binding between EAP methods executed within a
> sequence or between the EAP tunneling protocol and the tunneled EAP
> methods.
> [c] Limiting the EAP methods authorized for use without protection based
> on peer and authenticator policy. "

[d] Avoiding the use of sequences or tunnels when a single, strong
method is available?

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap