Subject: RE: [Emu] Issue: Definition of Session-Id, Peer-Id, Server-Id forEAP GPSK

From: "Joseph Salowey \(jsalowey\)" <[email-masked]>
Date: Wed, 22 Nov 2006 09:21:05 -0800

> -----Original Message-----
> From: Bernard Aboba [mailto:[email-masked]] 
> Sent: Wednesday, November 22, 2006 8:52 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [Emu] Issue: Definition of Session-Id, 
> Peer-Id,Server-Id forEAP GPSK
> 
> >Sounds reasonable, but I'm not entirely sure I'd call the ID_Server 
> >unauthenticated.  It's authenticated in GPSK-3 when the 
> server includes 
> >it in the key derivation to compute SK.  If the value was 
> changed by an 
> >attacker, the authentication would fail.
> 
> The client only confirms that the server has access to the 
> PSK, but it doesn't confirm the specific server identity.  
> This is different from TLS-based EAP methods where the client 
> can verify a certificate issued to a specific server.
> 
[Joe] Yes, by it's nature symmetric authentication is different than
asymmetric authentication, but that doesn't mean that an identity is not
authenticated in the symmetric case.  

> 
> 
> _______________________________________________
> Emu mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/emu
> 

_______________________________________________
Emu mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/emu