Subject: [eap] PEAP question

From: [email-masked] (Dan Harkins)
Date: Wed, 18 Dec 2002 12:51:03 -0800

Hello!

  draft-josefsson-pppext-eap-tls-eap-02.html says that PEAP phase 2
is done "within the TLS session" established in PEAP phase 1.
What exactly does that mean?

  The examples from appendix A show phase 2 packets like this:

                       <- EAP-Request/
                        Identity
EAP-Response/
Identity (MyID) ->
                       <- EAP-Request/
                        EAP-Type=X
EAP-Response/
EAP-Type=X or NAK ->

                       <- EAP-Request/
                        EAP-Type=X

  So what does the packet look like on the wire? The ID request the 
authenticator sends "within the TLS channel" cannot be an encrypted
ID request because layer transporting EAP will not be able to
decode it as an EAP packet. There's no EAP data to "protect" so it 
could be a raw ID request but then the supplicant state machine will
transition back into ACQUIRED when it receives it. 

  It must be a PEAP packet (length included) with the PEAP data
being an encrypted EAP packet with the type=1. Correct? If so then 
the requests and responses are not EAP-Type=X, they're EAP-Type=PEAP
and the PEAP data is an EAP packet with EAP-Type=X:

	  <- EAP-Request/EAP-Type=PEAP/EAP-Request/EAP-Type=X

  So the phase 2 ID request from the authenticator looks like this
on the wire:

   0                   1                   2                   3
   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |      1        |   Identifier  |  len(PEAP hdr+encryped idreq) |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |     PEAP      |1 0 0 0 0 0 0 1|       length of encrypted...
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |     ... EAP ID request        | 
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                following is protected by TLS cipher suite

                                  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                  |       1       | Identifier+1? |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |       Length of id request    |      1=ID     |   cruft...
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |      from TLS....
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

What then does one do about the identifiers in this packet? The one
in the encrypted EAP header is one more than the one in the PEAP
header? Are they the same? Is this even the correct format?

  Or have I completely missed something and the packets on the
wire really have EAP-Type=X? If so then how do you encode the phase
2 id request? 

  Dan.