Subject: Re: [TLS] EAP-in-TLS and channel bindings

From: Yaron Sheffer <[email-masked]>
Date: Mon, 04 Apr 2011 18:15:32 +0300

Also, EAP as a generic infrastructure is making steady (albeit slow) 
progress with channel bindings and the NEA work. And it provides two 
recently published password-based protocols: 
https://tools.ietf.org/html/rfc6124 and http://tools.ietf.org/html/rfc5931.

Thanks,
	Yaron

>
> Message: 1
> Date: Mon, 4 Apr 2011 09:16:57 +0200
> From: Yoav Nir<[email-masked]>
> Subject: Re: [TLS] EAP-in-TLS and channel bindings
> To: "'Michael D'Errico'"<[email-masked]>
> Cc: "[email-masked]"<[email-masked]>, Simon Josefsson
> 	<[email-masked]>
> Message-ID:
> 	<[email-masked]>
> 	
> Content-Type: text/plain; charset="us-ascii"
>
> Sure, but those require the verifiers (salted hashes of the passwords) to be stored on the TLS server.
>
> I don't think there's a good way to get TLS-SRP to work with a backend AAA server.
>
> -----Original Message-----
> From: Michael D'Errico [mailto:[email-masked]]
> Sent: 04 April 2011 10:00
> To: Yoav Nir
> Cc: Nico Williams; Simon Josefsson; [email-masked]
> Subject: Re: [TLS] EAP-in-TLS and channel bindings
>
> Yoav Nir wrote:
>>
>> One of our design goals is to make password authentication part of the TLS handshake, just as certificate authentication is.
>
> Forgive me if this is another stupid question, but have you looked at the Secure Remote Password (SRP) cipher suites in RFC 5054?
>
> Mike
>
>
> ------------------------------