« back to all changes in this revision
Viewing changes to doc/rfc/rfc3748.txt
- browse files at revision 28
- compare with another revision
- download diff
- download tarball
- view history from revision 28
- Committer: Bazaar Package Importer
- Author(s): Chuck Short
- Date: 2010-01-04 21:40:02 UTC
- mfrom: (1.1.14 upstream) (4.1.5 sid)
- Revision ID: james.westby@ubuntu.com-20100104214002-41gcmr2dd7sebn58
Tags: 2.1.8+dfsg-1ubuntu1
Resynchronize with Debian.
- files added:
- .gitignore
- files removed:
- debian/TODO
- doc/rfc
- files modified:
- Make.inc.in
added
removed
doc/rfc/rfc3748.txt
1
2
3
4
5
6
7
Network Working Group B. Aboba
8
Request for Comments: 3748 Microsoft
9
Obsoletes: 2284 L. Blunk
10
Category: Standards Track Merit Network, Inc
11
J. Vollbrecht
12
Vollbrecht Consulting LLC
13
J. Carlson
14
Sun
15
H. Levkowetz, Ed.
16
ipUnplugged
17
June 2004
18
19
20
Extensible Authentication Protocol (EAP)
21
22
Status of this Memo
23
24
This document specifies an Internet standards track protocol for the
25
Internet community, and requests discussion and suggestions for
26
improvements. Please refer to the current edition of the "Internet
27
Official Protocol Standards" (STD 1) for the standardization state
28
and status of this protocol. Distribution of this memo is unlimited.
29
30
Copyright Notice
31
32
Copyright (C) The Internet Society (2004).
33
34
Abstract
35
36
This document defines the Extensible Authentication Protocol (EAP),
37
an authentication framework which supports multiple authentication
38
methods. EAP typically runs directly over data link layers such as
39
Point-to-Point Protocol (PPP) or IEEE 802, without requiring IP. EAP
40
provides its own support for duplicate elimination and
41
retransmission, but is reliant on lower layer ordering guarantees.
42
Fragmentation is not supported within EAP itself; however, individual
43
EAP methods may support this.
44
45
This document obsoletes RFC 2284. A summary of the changes between
46
this document and RFC 2284 is available in Appendix A.
47
48
49
50
51
52
53
54
55
56
57
58
Aboba, et al. Standards Track [Page 1]
59
60
RFC 3748 EAP June 2004
61
62
63
Table of Contents
64
65
1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . 3
66
1.1. Specification of Requirements . . . . . . . . . . . . . 4
67
1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . 4
68
1.3. Applicability . . . . . . . . . . . . . . . . . . . . . 6
69
2. Extensible Authentication Protocol (EAP). . . . . . . . . . . 7
70
2.1. Support for Sequences . . . . . . . . . . . . . . . . . 9
71
2.2. EAP Multiplexing Model. . . . . . . . . . . . . . . . . 10
72
2.3. Pass-Through Behavior . . . . . . . . . . . . . . . . . 12
73
2.4. Peer-to-Peer Operation. . . . . . . . . . . . . . . . . 14
74
3. Lower Layer Behavior. . . . . . . . . . . . . . . . . . . . . 15
75
3.1. Lower Layer Requirements. . . . . . . . . . . . . . . . 15
76
3.2. EAP Usage Within PPP. . . . . . . . . . . . . . . . . . 18
77
3.2.1. PPP Configuration Option Format. . . . . . . . . 18
78
3.3. EAP Usage Within IEEE 802 . . . . . . . . . . . . . . . 19
79
3.4. Lower Layer Indications . . . . . . . . . . . . . . . . 19
80
4. EAP Packet Format . . . . . . . . . . . . . . . . . . . . . . 20
81
4.1. Request and Response. . . . . . . . . . . . . . . . . . 21
82
4.2. Success and Failure . . . . . . . . . . . . . . . . . . 23
83
4.3. Retransmission Behavior . . . . . . . . . . . . . . . . 26
84
5. Initial EAP Request/Response Types. . . . . . . . . . . . . . 27
85
5.1. Identity. . . . . . . . . . . . . . . . . . . . . . . . 28
86
5.2. Notification. . . . . . . . . . . . . . . . . . . . . . 29
87
5.3. Nak . . . . . . . . . . . . . . . . . . . . . . . . . . 31
88
5.3.1. Legacy Nak . . . . . . . . . . . . . . . . . . . 31
89
5.3.2. Expanded Nak . . . . . . . . . . . . . . . . . . 32
90
5.4. MD5-Challenge . . . . . . . . . . . . . . . . . . . . . 35
91
5.5. One-Time Password (OTP) . . . . . . . . . . . . . . . . 36
92
5.6. Generic Token Card (GTC). . . . . . . . . . . . . . . . 37
93
5.7. Expanded Types. . . . . . . . . . . . . . . . . . . . . 38
94
5.8. Experimental. . . . . . . . . . . . . . . . . . . . . . 40
95
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 40
96
6.1. Packet Codes. . . . . . . . . . . . . . . . . . . . . . 41
97
6.2. Method Types. . . . . . . . . . . . . . . . . . . . . . 41
98
7. Security Considerations . . . . . . . . . . . . . . . . . . . 42
99
7.1. Threat Model. . . . . . . . . . . . . . . . . . . . . . 42
100
7.2. Security Claims . . . . . . . . . . . . . . . . . . . . 43
101
7.2.1. Security Claims Terminology for EAP Methods. . . 44
102
7.3. Identity Protection . . . . . . . . . . . . . . . . . . 46
103
7.4. Man-in-the-Middle Attacks . . . . . . . . . . . . . . . 47
104
7.5. Packet Modification Attacks . . . . . . . . . . . . . . 48
105
7.6. Dictionary Attacks. . . . . . . . . . . . . . . . . . . 49
106
7.7. Connection to an Untrusted Network. . . . . . . . . . . 49
107
7.8. Negotiation Attacks . . . . . . . . . . . . . . . . . . 50
108
7.9. Implementation Idiosyncrasies . . . . . . . . . . . . . 50
109
7.10. Key Derivation. . . . . . . . . . . . . . . . . . . . . 51
110
7.11. Weak Ciphersuites . . . . . . . . . . . . . . . . . . . 53
111
112
113
114
Aboba, et al. Standards Track [Page 2]
115
116
RFC 3748 EAP June 2004
117
118
119
7.12. Link Layer. . . . . . . . . . . . . . . . . . . . . . . 53
120
7.13. Separation of Authenticator and Backend Authentication
121
Server. . . . . . . . . . . . . . . . . . . . . . . . . 54
122
7.14. Cleartext Passwords . . . . . . . . . . . . . . . . . . 55
123
7.15. Channel Binding . . . . . . . . . . . . . . . . . . . . 55
124
7.16. Protected Result Indications. . . . . . . . . . . . . . 56
125
8. Acknowledgements. . . . . . . . . . . . . . . . . . . . . . . 58
126
9. References. . . . . . . . . . . . . . . . . . . . . . . . . . 59
127
9.1. Normative References. . . . . . . . . . . . . . . . . . 59
128
9.2. Informative References. . . . . . . . . . . . . . . . . 60
129
Appendix A. Changes from RFC 2284. . . . . . . . . . . . . . . . . 64
130
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 66
131
Full Copyright Statement . . . . . . . . . . . . . . . . . . . . . 67
132
133
1. Introduction
134
135
This document defines the Extensible Authentication Protocol (EAP),
136
an authentication framework which supports multiple authentication
137
methods. EAP typically runs directly over data link layers such as
138
Point-to-Point Protocol (PPP) or IEEE 802, without requiring IP. EAP
139
provides its own support for duplicate elimination and
140
retransmission, but is reliant on lower layer ordering guarantees.
141
Fragmentation is not supported within EAP itself; however, individual
142
EAP methods may support this.
143
144
EAP may be used on dedicated links, as well as switched circuits, and
145
wired as well as wireless links. To date, EAP has been implemented
146
with hosts and routers that connect via switched circuits or dial-up
147
lines using PPP [RFC1661]. It has also been implemented with
148
switches and access points using IEEE 802 [IEEE-802]. EAP
149
encapsulation on IEEE 802 wired media is described in [IEEE-802.1X],
150
and encapsulation on IEEE wireless LANs in [IEEE-802.11i].
151
152
One of the advantages of the EAP architecture is its flexibility.
153
EAP is used to select a specific authentication mechanism, typically
154
after the authenticator requests more information in order to
155
determine the specific authentication method to be used. Rather than
156
requiring the authenticator to be updated to support each new
157
authentication method, EAP permits the use of a backend
158
authentication server, which may implement some or all authentication
159
methods, with the authenticator acting as a pass-through for some or
160
all methods and peers.
161
162
Within this document, authenticator requirements apply regardless of
163
whether the authenticator is operating as a pass-through or not.
164
Where the requirement is meant to apply to either the authenticator
165
or backend authentication server, depending on where the EAP
166
authentication is terminated, the term "EAP server" will be used.
167
168
169
170
Aboba, et al. Standards Track [Page 3]
171
172
RFC 3748 EAP June 2004
173
174
175
1.1. Specification of Requirements
176
177
In this document, several words are used to signify the requirements
178
of the specification. The key words "MUST", "MUST NOT", "REQUIRED",
179
"SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY",
180
and "OPTIONAL" in this document are to be interpreted as described in
181
[RFC2119].
182
183
1.2. Terminology
184
185
This document frequently uses the following terms:
186
187
authenticator
188
The end of the link initiating EAP authentication. The term
189
authenticator is used in [IEEE-802.1X], and has the same meaning
190
in this document.
191
192
peer
193
The end of the link that responds to the authenticator. In
194
[IEEE-802.1X], this end is known as the Supplicant.
195
196
Supplicant
197
The end of the link that responds to the authenticator in [IEEE-
198
802.1X]. In this document, this end of the link is called the
199
peer.
200
201
backend authentication server
202
A backend authentication server is an entity that provides an
203
authentication service to an authenticator. When used, this
204
server typically executes EAP methods for the authenticator. This
205
terminology is also used in [IEEE-802.1X].
206
207
AAA
208
Authentication, Authorization, and Accounting. AAA protocols with
209
EAP support include RADIUS [RFC3579] and Diameter [DIAM-EAP]. In
210
this document, the terms "AAA server" and "backend authentication
211
server" are used interchangeably.
212
213
Displayable Message
214
This is interpreted to be a human readable string of characters.
215
The message encoding MUST follow the UTF-8 transformation format
216
[RFC2279].
217
218
219
220
221
222
223
224
225
226
Aboba, et al. Standards Track [Page 4]
227
228
RFC 3748 EAP June 2004
229
230
231
EAP server
232
The entity that terminates the EAP authentication method with the
233
peer. In the case where no backend authentication server is used,
234
the EAP server is part of the authenticator. In the case where
235
the authenticator operates in pass-through mode, the EAP server is
236
located on the backend authentication server.
237
238
Silently Discard
239
This means the implementation discards the packet without further
240
processing. The implementation SHOULD provide the capability of
241
logging the event, including the contents of the silently
242
discarded packet, and SHOULD record the event in a statistics
243
counter.
244
245
Successful Authentication
246
In the context of this document, "successful authentication" is an
247
exchange of EAP messages, as a result of which the authenticator
248
decides to allow access by the peer, and the peer decides to use
249
this access. The authenticator's decision typically involves both
250
authentication and authorization aspects; the peer may
251
successfully authenticate to the authenticator, but access may be
252
denied by the authenticator due to policy reasons.
253
254
Message Integrity Check (MIC)
255
A keyed hash function used for authentication and integrity
256
protection of data. This is usually called a Message
257
Authentication Code (MAC), but IEEE 802 specifications (and this
258
document) use the acronym MIC to avoid confusion with Medium
259
Access Control.
260
261
Cryptographic Separation
262
Two keys (x and y) are "cryptographically separate" if an
263
adversary that knows all messages exchanged in the protocol cannot
264
compute x from y or y from x without "breaking" some cryptographic
265
assumption. In particular, this definition allows that the
266
adversary has the knowledge of all nonces sent in cleartext, as
267
well as all predictable counter values used in the protocol.
268
Breaking a cryptographic assumption would typically require
269
inverting a one-way function or predicting the outcome of a
270
cryptographic pseudo-random number generator without knowledge of
271
the secret state. In other words, if the keys are
272
cryptographically separate, there is no shortcut to compute x from
273
y or y from x, but the work an adversary must do to perform this
274
computation is equivalent to performing an exhaustive search for
275
the secret state value.
276
277
278
279
280
281
282
Aboba, et al. Standards Track [Page 5]
283
284
RFC 3748 EAP June 2004
285
286
287
Master Session Key (MSK)
288
Keying material that is derived between the EAP peer and server
289
and exported by the EAP method. The MSK is at least 64 octets in
290
length. In existing implementations, a AAA server acting as an
291
EAP server transports the MSK to the authenticator.
292
293
Extended Master Session Key (EMSK)
294
Additional keying material derived between the EAP client and
295
server that is exported by the EAP method. The EMSK is at least
296
64 octets in length. The EMSK is not shared with the
297
authenticator or any other third party. The EMSK is reserved for
298
future uses that are not defined yet.
299
300
Result indications
301
A method provides result indications if after the method's last
302
message is sent and received:
303
304
1) The peer is aware of whether it has authenticated the server,
305
as well as whether the server has authenticated it.
306
307
2) The server is aware of whether it has authenticated the peer,
308
as well as whether the peer has authenticated it.
309
310
In the case where successful authentication is sufficient to
311
authorize access, then the peer and authenticator will also know if
312
the other party is willing to provide or accept access. This may not
313
always be the case. An authenticated peer may be denied access due
314
to lack of authorization (e.g., session limit) or other reasons.
315
Since the EAP exchange is run between the peer and the server, other
316
nodes (such as AAA proxies) may also affect the authorization
317
decision. This is discussed in more detail in Section 7.16.
318
319
1.3. Applicability
320
321
EAP was designed for use in network access authentication, where IP
322
layer connectivity may not be available. Use of EAP for other
323
purposes, such as bulk data transport, is NOT RECOMMENDED.
324
325
Since EAP does not require IP connectivity, it provides just enough
326
support for the reliable transport of authentication protocols, and
327
no more.
328
329
EAP is a lock-step protocol which only supports a single packet in
330
flight. As a result, EAP cannot efficiently transport bulk data,
331
unlike transport protocols such as TCP [RFC793] or SCTP [RFC2960].
332
333
334
335
336
337
338
Aboba, et al. Standards Track [Page 6]
339
340
RFC 3748 EAP June 2004
341
342
343
While EAP provides support for retransmission, it assumes ordering
344
guarantees provided by the lower layer, so out of order reception is
345
not supported.
346
347
Since EAP does not support fragmentation and reassembly, EAP
348
authentication methods generating payloads larger than the minimum
349
EAP MTU need to provide fragmentation support.
350
351
While authentication methods such as EAP-TLS [RFC2716] provide
352
support for fragmentation and reassembly, the EAP methods defined in
353
this document do not. As a result, if the EAP packet size exceeds
354
the EAP MTU of the link, these methods will encounter difficulties.
355
356
EAP authentication is initiated by the server (authenticator),
357
whereas many authentication protocols are initiated by the client
358
(peer). As a result, it may be necessary for an authentication
359
algorithm to add one or two additional messages (at most one
360
roundtrip) in order to run over EAP.
361
362
Where certificate-based authentication is supported, the number of
363
additional roundtrips may be much larger due to fragmentation of
364
certificate chains. In general, a fragmented EAP packet will require
365
as many round-trips to send as there are fragments. For example, a
366
certificate chain 14960 octets in size would require ten round-trips
367
to send with a 1496 octet EAP MTU.
368
369
Where EAP runs over a lower layer in which significant packet loss is
370
experienced, or where the connection between the authenticator and
371
authentication server experiences significant packet loss, EAP
372
methods requiring many round-trips can experience difficulties. In
373
these situations, use of EAP methods with fewer roundtrips is
374
advisable.
375
376
2. Extensible Authentication Protocol (EAP)
377
378
The EAP authentication exchange proceeds as follows:
379
380
[1] The authenticator sends a Request to authenticate the peer. The
381
Request has a Type field to indicate what is being requested.
382
Examples of Request Types include Identity, MD5-challenge, etc.
383
The MD5-challenge Type corresponds closely to the CHAP
384
authentication protocol [RFC1994]. Typically, the authenticator
385
will send an initial Identity Request; however, an initial
386
Identity Request is not required, and MAY be bypassed. For
387
example, the identity may not be required where it is determined
388
by the port to which the peer has connected (leased lines,
389
390
391
392
393
394
Aboba, et al. Standards Track [Page 7]
395
396
RFC 3748 EAP June 2004
397
398
399
dedicated switch or dial-up ports), or where the identity is
400
obtained in another fashion (via calling station identity or MAC
401
address, in the Name field of the MD5-Challenge Response, etc.).
402
403
[2] The peer sends a Response packet in reply to a valid Request. As
404
with the Request packet, the Response packet contains a Type
405
field, which corresponds to the Type field of the Request.
406
407
[3] The authenticator sends an additional Request packet, and the
408
peer replies with a Response. The sequence of Requests and
409
Responses continues as long as needed. EAP is a 'lock step'
410
protocol, so that other than the initial Request, a new Request
411
cannot be sent prior to receiving a valid Response. The
412
authenticator is responsible for retransmitting requests as
413
described in Section 4.1. After a suitable number of
414
retransmissions, the authenticator SHOULD end the EAP
415
conversation. The authenticator MUST NOT send a Success or
416
Failure packet when retransmitting or when it fails to get a
417
response from the peer.
418
419
[4] The conversation continues until the authenticator cannot
420
authenticate the peer (unacceptable Responses to one or more
421
Requests), in which case the authenticator implementation MUST
422
transmit an EAP Failure (Code 4). Alternatively, the
423
authentication conversation can continue until the authenticator
424
determines that successful authentication has occurred, in which
425
case the authenticator MUST transmit an EAP Success (Code 3).
426
427
Advantages:
428
429
o The EAP protocol can support multiple authentication mechanisms
430
without having to pre-negotiate a particular one.
431
432
o Network Access Server (NAS) devices (e.g., a switch or access
433
point) do not have to understand each authentication method and
434
MAY act as a pass-through agent for a backend authentication
435
server. Support for pass-through is optional. An authenticator
436
MAY authenticate local peers, while at the same time acting as a
437
pass-through for non-local peers and authentication methods it
438
does not implement locally.
439
440
o Separation of the authenticator from the backend authentication
441
server simplifies credentials management and policy decision
442
making.
443
444
445
446
447
448
449
450
Aboba, et al. Standards Track [Page 8]
451
452
RFC 3748 EAP June 2004
453
454
455
Disadvantages:
456
457
o For use in PPP, EAP requires the addition of a new authentication
458
Type to PPP LCP and thus PPP implementations will need to be
459
modified to use it. It also strays from the previous PPP
460
authentication model of negotiating a specific authentication
461
mechanism during LCP. Similarly, switch or access point
462
implementations need to support [IEEE-802.1X] in order to use EAP.
463
464
o Where the authenticator is separate from the backend
465
authentication server, this complicates the security analysis and,
466
if needed, key distribution.
467
468
2.1. Support for Sequences
469
470
An EAP conversation MAY utilize a sequence of methods. A common
471
example of this is an Identity request followed by a single EAP
472
authentication method such as an MD5-Challenge. However, the peer
473
and authenticator MUST utilize only one authentication method (Type 4
474
or greater) within an EAP conversation, after which the authenticator
475
MUST send a Success or Failure packet.
476
477
Once a peer has sent a Response of the same Type as the initial
478
Request, an authenticator MUST NOT send a Request of a different Type
479
prior to completion of the final round of a given method (with the
480
exception of a Notification-Request) and MUST NOT send a Request for
481
an additional method of any Type after completion of the initial
482
authentication method; a peer receiving such Requests MUST treat them
483
as invalid, and silently discard them. As a result, Identity Requery
484
is not supported.
485
486
A peer MUST NOT send a Nak (legacy or expanded) in reply to a Request
487
after an initial non-Nak Response has been sent. Since spoofed EAP
488
Request packets may be sent by an attacker, an authenticator
489
receiving an unexpected Nak SHOULD discard it and log the event.
490
491
Multiple authentication methods within an EAP conversation are not
492
supported due to their vulnerability to man-in-the-middle attacks
493
(see Section 7.4) and incompatibility with existing implementations.
494
495
Where a single EAP authentication method is utilized, but other
496
methods are run within it (a "tunneled" method), the prohibition
497
against multiple authentication methods does not apply. Such
498
"tunneled" methods appear as a single authentication method to EAP.
499
Backward compatibility can be provided, since a peer not supporting a
500
"tunneled" method can reply to the initial EAP-Request with a Nak
501
502
503
504
505
506
Aboba, et al. Standards Track [Page 9]
507
508
RFC 3748 EAP June 2004
509
510
511
(legacy or expanded). To address security vulnerabilities,
512
"tunneled" methods MUST support protection against man-in-the-middle
513
attacks.
514
515
2.2. EAP Multiplexing Model
516
517
Conceptually, EAP implementations consist of the following
518
components:
519
520
[a] Lower layer. The lower layer is responsible for transmitting and
521
receiving EAP frames between the peer and authenticator. EAP has
522
been run over a variety of lower layers including PPP, wired IEEE
523
802 LANs [IEEE-802.1X], IEEE 802.11 wireless LANs [IEEE-802.11],
524
UDP (L2TP [RFC2661] and IKEv2 [IKEv2]), and TCP [PIC]. Lower
525
layer behavior is discussed in Section 3.
526
527
[b] EAP layer. The EAP layer receives and transmits EAP packets via
528
the lower layer, implements duplicate detection and
529
retransmission, and delivers and receives EAP messages to and
530
from the EAP peer and authenticator layers.
531
532
[c] EAP peer and authenticator layers. Based on the Code field, the
533
EAP layer demultiplexes incoming EAP packets to the EAP peer and
534
authenticator layers. Typically, an EAP implementation on a
535
given host will support either peer or authenticator
536
functionality, but it is possible for a host to act as both an
537
EAP peer and authenticator. In such an implementation both EAP
538
peer and authenticator layers will be present.
539
540
[d] EAP method layers. EAP methods implement the authentication
541
algorithms and receive and transmit EAP messages via the EAP peer
542
and authenticator layers. Since fragmentation support is not
543
provided by EAP itself, this is the responsibility of EAP
544
methods, which are discussed in Section 5.
545
546
The EAP multiplexing model is illustrated in Figure 1 below. Note
547
that there is no requirement that an implementation conform to this
548
model, as long as the on-the-wire behavior is consistent with it.
549
550
551
552
553
554
555
556
557
558
559
560
561
562
Aboba, et al. Standards Track [Page 10]
563
564
RFC 3748 EAP June 2004
565
566
567
+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+
568
| | | | | |
569
| EAP method| EAP method| | EAP method| EAP method|
570
| Type = X | Type = Y | | Type = X | Type = Y |
571
| V | | | ^ | |
572
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
573
| ! | | ! |
574
| EAP ! Peer layer | | EAP ! Auth. layer |
575
| ! | | ! |
576
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
577
| ! | | ! |
578
| EAP ! layer | | EAP ! layer |
579
| ! | | ! |
580
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
581
| ! | | ! |
582
| Lower ! layer | | Lower ! layer |
583
| ! | | ! |
584
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
585
! !
586
! Peer ! Authenticator
587
+------------>-------------+
588
589
Figure 1: EAP Multiplexing Model
590
591
Within EAP, the Code field functions much like a protocol number in
592
IP. It is assumed that the EAP layer demultiplexes incoming EAP
593
packets according to the Code field. Received EAP packets with
594
Code=1 (Request), 3 (Success), and 4 (Failure) are delivered by the
595
EAP layer to the EAP peer layer, if implemented. EAP packets with
596
Code=2 (Response) are delivered to the EAP authenticator layer, if
597
implemented.
598
599
Within EAP, the Type field functions much like a port number in UDP
600
or TCP. It is assumed that the EAP peer and authenticator layers
601
demultiplex incoming EAP packets according to their Type, and deliver
602
them only to the EAP method corresponding to that Type. An EAP
603
method implementation on a host may register to receive packets from
604
the peer or authenticator layers, or both, depending on which role(s)
605
it supports.
606
607
Since EAP authentication methods may wish to access the Identity,
608
implementations SHOULD make the Identity Request and Response
609
accessible to authentication methods (Types 4 or greater), in
610
addition to the Identity method. The Identity Type is discussed in
611
Section 5.1.
612
613
614
615
616
617
618
Aboba, et al. Standards Track [Page 11]
619
620
RFC 3748 EAP June 2004
621
622
623
A Notification Response is only used as confirmation that the peer
624
received the Notification Request, not that it has processed it, or
625
displayed the message to the user. It cannot be assumed that the
626
contents of the Notification Request or Response are available to
627
another method. The Notification Type is discussed in Section 5.2.
628
629
Nak (Type 3) or Expanded Nak (Type 254) are utilized for the purposes
630
of method negotiation. Peers respond to an initial EAP Request for
631
an unacceptable Type with a Nak Response (Type 3) or Expanded Nak
632
Response (Type 254). It cannot be assumed that the contents of the
633
Nak Response(s) are available to another method. The Nak Type(s) are
634
discussed in Section 5.3.
635
636
EAP packets with Codes of Success or Failure do not include a Type
637
field, and are not delivered to an EAP method. Success and Failure
638
are discussed in Section 4.2.
639
640
Given these considerations, the Success, Failure, Nak Response(s),
641
and Notification Request/Response messages MUST NOT be used to carry
642
data destined for delivery to other EAP methods.
643
644
2.3. Pass-Through Behavior
645
646
When operating as a "pass-through authenticator", an authenticator
647
performs checks on the Code, Identifier, and Length fields as
648
described in Section 4.1. It forwards EAP packets received from the
649
peer and destined to its authenticator layer to the backend
650
authentication server; packets received from the backend
651
authentication server destined to the peer are forwarded to it.
652
653
A host receiving an EAP packet may only do one of three things with
654
it: act on it, drop it, or forward it. The forwarding decision is
655
typically based only on examination of the Code, Identifier, and
656
Length fields. A pass-through authenticator implementation MUST be
657
capable of forwarding EAP packets received from the peer with Code=2
658
(Response) to the backend authentication server. It also MUST be
659
capable of receiving EAP packets from the backend authentication
660
server and forwarding EAP packets of Code=1 (Request), Code=3
661
(Success), and Code=4 (Failure) to the peer.
662
663
Unless the authenticator implements one or more authentication
664
methods locally which support the authenticator role, the EAP method
665
layer header fields (Type, Type-Data) are not examined as part of the
666
forwarding decision. Where the authenticator supports local
667
authentication methods, it MAY examine the Type field to determine
668
whether to act on the packet itself or forward it. Compliant pass-
669
through authenticator implementations MUST by default forward EAP
670
packets of any Type.
671
672
673
674
Aboba, et al. Standards Track [Page 12]
675
676
RFC 3748 EAP June 2004
677
678
679
EAP packets received with Code=1 (Request), Code=3 (Success), and
680
Code=4 (Failure) are demultiplexed by the EAP layer and delivered to
681
the peer layer. Therefore, unless a host implements an EAP peer
682
layer, these packets will be silently discarded. Similarly, EAP
683
packets received with Code=2 (Response) are demultiplexed by the EAP
684
layer and delivered to the authenticator layer. Therefore, unless a
685
host implements an EAP authenticator layer, these packets will be
686
silently discarded. The behavior of a "pass-through peer" is
687
undefined within this specification, and is unsupported by AAA
688
protocols such as RADIUS [RFC3579] and Diameter [DIAM-EAP].
689
690
The forwarding model is illustrated in Figure 2.
691
692
Peer Pass-through Authenticator Authentication
693
Server
694
695
+-+-+-+-+-+-+ +-+-+-+-+-+-+
696
| | | |
697
|EAP method | |EAP method |
698
| V | | ^ |
699
+-+-+-!-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-!-+-+-+
700
| ! | |EAP | EAP | | | ! |
701
| ! | |Peer | Auth.| EAP Auth. | | ! |
702
|EAP ! peer| | | +-----------+ | |EAP !Auth.|
703
| ! | | | ! | ! | | ! |
704
+-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
705
| ! | | ! | ! | | ! |
706
|EAP !layer| | EAP !layer| EAP !layer | |EAP !layer|
707
| ! | | ! | ! | | ! |
708
+-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
709
| ! | | ! | ! | | ! |
710
|Lower!layer| | Lower!layer| AAA ! /IP | | AAA ! /IP |
711
| ! | | ! | ! | | ! |
712
+-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
713
! ! ! !
714
! ! ! !
715
+-------->--------+ +--------->-------+
716
717
718
Figure 2: Pass-through Authenticator
719
720
For sessions in which the authenticator acts as a pass-through, it
721
MUST determine the outcome of the authentication solely based on the
722
Accept/Reject indication sent by the backend authentication server;
723
the outcome MUST NOT be determined by the contents of an EAP packet
724
sent along with the Accept/Reject indication, or the absence of such
725
an encapsulated EAP packet.
726
727
728
729
730
Aboba, et al. Standards Track [Page 13]
731
732
RFC 3748 EAP June 2004
733
734
735
2.4. Peer-to-Peer Operation
736
737
Since EAP is a peer-to-peer protocol, an independent and simultaneous
738
authentication may take place in the reverse direction (depending on
739
the capabilities of the lower layer). Both ends of the link may act
740
as authenticators and peers at the same time. In this case, it is
741
necessary for both ends to implement EAP authenticator and peer
742
layers. In addition, the EAP method implementations on both peers
743
must support both authenticator and peer functionality.
744
745
Although EAP supports peer-to-peer operation, some EAP
746
implementations, methods, AAA protocols, and link layers may not
747
support this. Some EAP methods may support asymmetric
748
authentication, with one type of credential being required for the
749
peer and another type for the authenticator. Hosts supporting peer-
750
to-peer operation with such a method would need to be provisioned
751
with both types of credentials.
752
753
For example, EAP-TLS [RFC2716] is a client-server protocol in which
754
distinct certificate profiles are typically utilized for the client
755
and server. This implies that a host supporting peer-to-peer
756
authentication with EAP-TLS would need to implement both the EAP peer
757
and authenticator layers, support both peer and authenticator roles
758
in the EAP-TLS implementation, and provision certificates appropriate
759
for each role.
760
761
AAA protocols such as RADIUS/EAP [RFC3579] and Diameter EAP [DIAM-
762
EAP] only support "pass-through authenticator" operation. As noted
763
in [RFC3579] Section 2.6.2, a RADIUS server responds to an Access-
764
Request encapsulating an EAP-Request, Success, or Failure packet with
765
an Access-Reject. There is therefore no support for "pass-through
766
peer" operation.
767
768
Even where a method is used which supports mutual authentication and
769
result indications, several considerations may dictate that two EAP
770
authentications (one in each direction) are required. These include:
771
772
[1] Support for bi-directional session key derivation in the lower
773
layer. Lower layers such as IEEE 802.11 may only support uni-
774
directional derivation and transport of transient session keys.
775
For example, the group-key handshake defined in [IEEE-802.11i] is
776
uni-directional, since in IEEE 802.11 infrastructure mode, only
777
the Access Point (AP) sends multicast/broadcast traffic. In IEEE
778
802.11 ad hoc mode, where either peer may send
779
multicast/broadcast traffic, two uni-directional group-key
780
781
782
783
784
785
786
Aboba, et al. Standards Track [Page 14]
787
788
RFC 3748 EAP June 2004
789
790
791
exchanges are required. Due to limitations of the design, this
792
also implies the need for unicast key derivations and EAP method
793
exchanges to occur in each direction.
794
795
[2] Support for tie-breaking in the lower layer. Lower layers such
796
as IEEE 802.11 ad hoc do not support "tie breaking" wherein two
797
hosts initiating authentication with each other will only go
798
forward with a single authentication. This implies that even if
799
802.11 were to support a bi-directional group-key handshake, then
800
two authentications, one in each direction, might still occur.
801
802
[3] Peer policy satisfaction. EAP methods may support result
803
indications, enabling the peer to indicate to the EAP server
804
within the method that it successfully authenticated the EAP
805
server, as well as for the server to indicate that it has
806
authenticated the peer. However, a pass-through authenticator
807
will not be aware that the peer has accepted the credentials
808
offered by the EAP server, unless this information is provided to
809
the authenticator via the AAA protocol. The authenticator SHOULD
810
interpret the receipt of a key attribute within an Accept packet
811
as an indication that the peer has successfully authenticated the
812
server.
813
814
However, it is possible that the EAP peer's access policy was not
815
satisfied during the initial EAP exchange, even though mutual
816
authentication occurred. For example, the EAP authenticator may not
817
have demonstrated authorization to act in both peer and authenticator
818
roles. As a result, the peer may require an additional
819
authentication in the reverse direction, even if the peer provided an
820
indication that the EAP server had successfully authenticated to it.
821
822
3. Lower Layer Behavior
823
824
3.1. Lower Layer Requirements
825
826
EAP makes the following assumptions about lower layers:
827
828
[1] Unreliable transport. In EAP, the authenticator retransmits
829
Requests that have not yet received Responses so that EAP does
830
not assume that lower layers are reliable. Since EAP defines its
831
own retransmission behavior, it is possible (though undesirable)
832
for retransmission to occur both in the lower layer and the EAP
833
layer when EAP is run over a reliable lower layer.
834
835
836
837
838
839
840
841
842
Aboba, et al. Standards Track [Page 15]
843
844
RFC 3748 EAP June 2004
845
846
847
Note that EAP Success and Failure packets are not retransmitted.
848
Without a reliable lower layer, and with a non-negligible error rate,
849
these packets can be lost, resulting in timeouts. It is therefore
850
desirable for implementations to improve their resilience to loss of
851
EAP Success or Failure packets, as described in Section 4.2.
852
853
[2] Lower layer error detection. While EAP does not assume that the
854
lower layer is reliable, it does rely on lower layer error
855
detection (e.g., CRC, Checksum, MIC, etc.). EAP methods may not
856
include a MIC, or if they do, it may not be computed over all the
857
fields in the EAP packet, such as the Code, Identifier, Length,
858
or Type fields. As a result, without lower layer error
859
detection, undetected errors could creep into the EAP layer or
860
EAP method layer header fields, resulting in authentication
861
failures.
862
863
For example, EAP TLS [RFC2716], which computes its MIC over the
864
Type-Data field only, regards MIC validation failures as a fatal
865
error. Without lower layer error detection, this method, and
866
others like it, will not perform reliably.
867
868
[3] Lower layer security. EAP does not require lower layers to
869
provide security services such as per-packet confidentiality,
870
authentication, integrity, and replay protection. However, where
871
these security services are available, EAP methods supporting Key
872
Derivation (see Section 7.2.1) can be used to provide dynamic
873
keying material. This makes it possible to bind the EAP
874
authentication to subsequent data and protect against data
875
modification, spoofing, or replay. See Section 7.1 for details.
876
877
[4] Minimum MTU. EAP is capable of functioning on lower layers that
878
provide an EAP MTU size of 1020 octets or greater.
879
880
EAP does not support path MTU discovery, and fragmentation and
881
reassembly is not supported by EAP, nor by the methods defined in
882
this specification: Identity (1), Notification (2), Nak Response
883
(3), MD5-Challenge (4), One Time Password (5), Generic Token Card
884
(6), and expanded Nak Response (254) Types.
885
886
Typically, the EAP peer obtains information on the EAP MTU from
887
the lower layers and sets the EAP frame size to an appropriate
888
value. Where the authenticator operates in pass-through mode,
889
the authentication server does not have a direct way of
890
determining the EAP MTU, and therefore relies on the
891
authenticator to provide it with this information, such as via
892
the Framed-MTU attribute, as described in [RFC3579], Section 2.4.
893
894
895
896
897
898
Aboba, et al. Standards Track [Page 16]
899
900
RFC 3748 EAP June 2004
901
902
903
While methods such as EAP-TLS [RFC2716] support fragmentation and
904
reassembly, EAP methods originally designed for use within PPP
905
where a 1500 octet MTU is guaranteed for control frames (see
906
[RFC1661], Section 6.1) may lack fragmentation and reassembly
907
features.
908
909
EAP methods can assume a minimum EAP MTU of 1020 octets in the
910
absence of other information. EAP methods SHOULD include support
911
for fragmentation and reassembly if their payloads can be larger
912
than this minimum EAP MTU.
913
914
EAP is a lock-step protocol, which implies a certain inefficiency
915
when handling fragmentation and reassembly. Therefore, if the
916
lower layer supports fragmentation and reassembly (such as where
917
EAP is transported over IP), it may be preferable for
918
fragmentation and reassembly to occur in the lower layer rather
919
than in EAP. This can be accomplished by providing an
920
artificially large EAP MTU to EAP, causing fragmentation and
921
reassembly to be handled within the lower layer.
922
923
[5] Possible duplication. Where the lower layer is reliable, it will
924
provide the EAP layer with a non-duplicated stream of packets.
925
However, while it is desirable that lower layers provide for
926
non-duplication, this is not a requirement. The Identifier field
927
provides both the peer and authenticator with the ability to
928
detect duplicates.
929
930
[6] Ordering guarantees. EAP does not require the Identifier to be
931
monotonically increasing, and so is reliant on lower layer
932
ordering guarantees for correct operation. EAP was originally
933
defined to run on PPP, and [RFC1661] Section 1 has an ordering
934
requirement:
935
936
"The Point-to-Point Protocol is designed for simple links
937
which transport packets between two peers. These links
938
provide full-duplex simultaneous bi-directional operation,
939
and are assumed to deliver packets in order."
940
941
Lower layer transports for EAP MUST preserve ordering between a
942
source and destination at a given priority level (the ordering
943
guarantee provided by [IEEE-802]).
944
945
Reordering, if it occurs, will typically result in an EAP
946
authentication failure, causing EAP authentication to be re-run.
947
In an environment in which reordering is likely, it is therefore
948
expected that EAP authentication failures will be common. It is
949
RECOMMENDED that EAP only be run over lower layers that provide
950
ordering guarantees; running EAP over raw IP or UDP transport is
951
952
953
954
Aboba, et al. Standards Track [Page 17]
955
956
RFC 3748 EAP June 2004
957
958
959
NOT RECOMMENDED. Encapsulation of EAP within RADIUS [RFC3579]
960
satisfies ordering requirements, since RADIUS is a "lockstep"
961
protocol that delivers packets in order.
962
963
3.2. EAP Usage Within PPP
964
965
In order to establish communications over a point-to-point link, each
966
end of the PPP link first sends LCP packets to configure the data
967
link during the Link Establishment phase. After the link has been
968
established, PPP provides for an optional Authentication phase before
969
proceeding to the Network-Layer Protocol phase.
970
971
By default, authentication is not mandatory. If authentication of
972
the link is desired, an implementation MUST specify the
973
Authentication Protocol Configuration Option during the Link
974
Establishment phase.
975
976
If the identity of the peer has been established in the
977
Authentication phase, the server can use that identity in the
978
selection of options for the following network layer negotiations.
979
980
When implemented within PPP, EAP does not select a specific
981
authentication mechanism at the PPP Link Control Phase, but rather
982
postpones this until the Authentication Phase. This allows the
983
authenticator to request more information before determining the
984
specific authentication mechanism. This also permits the use of a
985
"backend" server which actually implements the various mechanisms
986
while the PPP authenticator merely passes through the authentication
987
exchange. The PPP Link Establishment and Authentication phases, and
988
the Authentication Protocol Configuration Option, are defined in The
989
Point-to-Point Protocol (PPP) [RFC1661].
990
991
3.2.1. PPP Configuration Option Format
992
993
A summary of the PPP Authentication Protocol Configuration Option
994
format to negotiate EAP follows. The fields are transmitted from
995
left to right.
996
997
Exactly one EAP packet is encapsulated in the Information field of a
998
PPP Data Link Layer frame where the protocol field indicates type hex
999
C227 (PPP EAP).
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
Aboba, et al. Standards Track [Page 18]
1011
1012
RFC 3748 EAP June 2004
1013
1014
1015
0 1 2 3
1016
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1017
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1018
| Type | Length | Authentication Protocol |
1019
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1020
1021
Type
1022
1023
3
1024
1025
Length
1026
1027
4
1028
1029
Authentication Protocol
1030
1031
C227 (Hex) for Extensible Authentication Protocol (EAP)
1032
1033
3.3. EAP Usage Within IEEE 802
1034
1035
The encapsulation of EAP over IEEE 802 is defined in [IEEE-802.1X].
1036
The IEEE 802 encapsulation of EAP does not involve PPP, and IEEE
1037
802.1X does not include support for link or network layer
1038
negotiations. As a result, within IEEE 802.1X, it is not possible to
1039
negotiate non-EAP authentication mechanisms, such as PAP or CHAP
1040
[RFC1994].
1041
1042
3.4. Lower Layer Indications
1043
1044
The reliability and security of lower layer indications is dependent
1045
on the lower layer. Since EAP is media independent, the presence or
1046
absence of lower layer security is not taken into account in the
1047
processing of EAP messages.
1048
1049
To improve reliability, if a peer receives a lower layer success
1050
indication as defined in Section 7.2, it MAY conclude that a Success
1051
packet has been lost, and behave as if it had actually received a
1052
Success packet. This includes choosing to ignore the Success in some
1053
circumstances as described in Section 4.2.
1054
1055
A discussion of some reliability and security issues with lower layer
1056
indications in PPP, IEEE 802 wired networks, and IEEE 802.11 wireless
1057
LANs can be found in the Security Considerations, Section 7.12.
1058
1059
After EAP authentication is complete, the peer will typically
1060
transmit and receive data via the authenticator. It is desirable to
1061
provide assurance that the entities transmitting data are the same
1062
ones that successfully completed EAP authentication. To accomplish
1063
1064
1065
1066
Aboba, et al. Standards Track [Page 19]
1067
1068
RFC 3748 EAP June 2004
1069
1070
1071
this, it is necessary for the lower layer to provide per-packet
1072
integrity, authentication and replay protection, and to bind these
1073
per-packet services to the keys derived during EAP authentication.
1074
Otherwise, it is possible for subsequent data traffic to be modified,
1075
spoofed, or replayed.
1076
1077
Where keying material for the lower layer ciphersuite is itself
1078
provided by EAP, ciphersuite negotiation and key activation are
1079
controlled by the lower layer. In PPP, ciphersuites are negotiated
1080
within ECP so that it is not possible to use keys derived from EAP
1081
authentication until the completion of ECP. Therefore, an initial
1082
EAP exchange cannot be protected by a PPP ciphersuite, although EAP
1083
re-authentication can be protected.
1084
1085
In IEEE 802 media, initial key activation also typically occurs after
1086
completion of EAP authentication. Therefore an initial EAP exchange
1087
typically cannot be protected by the lower layer ciphersuite,
1088
although an EAP re-authentication or pre-authentication exchange can
1089
be protected.
1090
1091
4. EAP Packet Format
1092
1093
A summary of the EAP packet format is shown below. The fields are
1094
transmitted from left to right.
1095
1096
0 1 2 3
1097
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1098
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1099
| Code | Identifier | Length |
1100
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1101
| Data ...
1102
+-+-+-+-+
1103
1104
Code
1105
1106
The Code field is one octet and identifies the Type of EAP packet.
1107
EAP Codes are assigned as follows:
1108
1109
1 Request
1110
2 Response
1111
3 Success
1112
4 Failure
1113
1114
Since EAP only defines Codes 1-4, EAP packets with other codes
1115
MUST be silently discarded by both authenticators and peers.
1116
1117
1118
1119
1120
1121
1122
Aboba, et al. Standards Track [Page 20]
1123
1124
RFC 3748 EAP June 2004
1125
1126
1127
Identifier
1128
1129
The Identifier field is one octet and aids in matching Responses
1130
with Requests.
1131
1132
Length
1133
1134
The Length field is two octets and indicates the length, in
1135
octets, of the EAP packet including the Code, Identifier, Length,
1136
and Data fields. Octets outside the range of the Length field
1137
should be treated as Data Link Layer padding and MUST be ignored
1138
upon reception. A message with the Length field set to a value
1139
larger than the number of received octets MUST be silently
1140
discarded.
1141
1142
Data
1143
1144
The Data field is zero or more octets. The format of the Data
1145
field is determined by the Code field.
1146
1147
4.1. Request and Response
1148
1149
Description
1150
1151
The Request packet (Code field set to 1) is sent by the
1152
authenticator to the peer. Each Request has a Type field which
1153
serves to indicate what is being requested. Additional Request
1154
packets MUST be sent until a valid Response packet is received, an
1155
optional retry counter expires, or a lower layer failure
1156
indication is received.
1157
1158
Retransmitted Requests MUST be sent with the same Identifier value
1159
in order to distinguish them from new Requests. The content of
1160
the data field is dependent on the Request Type. The peer MUST
1161
send a Response packet in reply to a valid Request packet.
1162
Responses MUST only be sent in reply to a valid Request and never
1163
be retransmitted on a timer.
1164
1165
If a peer receives a valid duplicate Request for which it has
1166
already sent a Response, it MUST resend its original Response
1167
without reprocessing the Request. Requests MUST be processed in
1168
the order that they are received, and MUST be processed to their
1169
completion before inspecting the next Request.
1170
1171
A summary of the Request and Response packet format follows. The
1172
fields are transmitted from left to right.
1173
1174
1175
1176
1177
1178
Aboba, et al. Standards Track [Page 21]
1179
1180
RFC 3748 EAP June 2004
1181
1182
1183
0 1 2 3
1184
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1185
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1186
| Code | Identifier | Length |
1187
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1188
| Type | Type-Data ...
1189
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
1190
1191
Code
1192
1193
1 for Request
1194
2 for Response
1195
1196
Identifier
1197
1198
The Identifier field is one octet. The Identifier field MUST be
1199
the same if a Request packet is retransmitted due to a timeout
1200
while waiting for a Response. Any new (non-retransmission)
1201
Requests MUST modify the Identifier field.
1202
1203
The Identifier field of the Response MUST match that of the
1204
currently outstanding Request. An authenticator receiving a
1205
Response whose Identifier value does not match that of the
1206
currently outstanding Request MUST silently discard the Response.
1207
1208
In order to avoid confusion between new Requests and
1209
retransmissions, the Identifier value chosen for each new Request
1210
need only be different from the previous Request, but need not be
1211
unique within the conversation. One way to achieve this is to
1212
start the Identifier at an initial value and increment it for each
1213
new Request. Initializing the first Identifier with a random
1214
number rather than starting from zero is recommended, since it
1215
makes sequence attacks somewhat more difficult.
1216
1217
Since the Identifier space is unique to each session,
1218
authenticators are not restricted to only 256 simultaneous
1219
authentication conversations. Similarly, with re-authentication,
1220
an EAP conversation might continue over a long period of time, and
1221
is not limited to only 256 roundtrips.
1222
1223
Implementation Note: The authenticator is responsible for
1224
retransmitting Request messages. If the Request message is obtained
1225
from elsewhere (such as from a backend authentication server), then
1226
the authenticator will need to save a copy of the Request in order to
1227
accomplish this. The peer is responsible for detecting and handling
1228
duplicate Request messages before processing them in any way,
1229
including passing them on to an outside party. The authenticator is
1230
also responsible for discarding Response messages with a non-matching
1231
1232
1233
1234
Aboba, et al. Standards Track [Page 22]
1235
1236
RFC 3748 EAP June 2004
1237
1238
1239
Identifier value before acting on them in any way, including passing
1240
them on to the backend authentication server for verification. Since
1241
the authenticator can retransmit before receiving a Response from the
1242
peer, the authenticator can receive multiple Responses, each with a
1243
matching Identifier. Until a new Request is received by the
1244
authenticator, the Identifier value is not updated, so that the
1245
authenticator forwards Responses to the backend authentication
1246
server, one at a time.
1247
1248
Length
1249
1250
The Length field is two octets and indicates the length of the EAP
1251
packet including the Code, Identifier, Length, Type, and Type-Data
1252
fields. Octets outside the range of the Length field should be
1253
treated as Data Link Layer padding and MUST be ignored upon
1254
reception. A message with the Length field set to a value larger
1255
than the number of received octets MUST be silently discarded.
1256
1257
Type
1258
1259
The Type field is one octet. This field indicates the Type of
1260
Request or Response. A single Type MUST be specified for each EAP
1261
Request or Response. An initial specification of Types follows in
1262
Section 5 of this document.
1263
1264
The Type field of a Response MUST either match that of the
1265
Request, or correspond to a legacy or Expanded Nak (see Section
1266
5.3) indicating that a Request Type is unacceptable to the peer.
1267
A peer MUST NOT send a Nak (legacy or expanded) in response to a
1268
Request, after an initial non-Nak Response has been sent. An EAP
1269
server receiving a Response not meeting these requirements MUST
1270
silently discard it.
1271
1272
Type-Data
1273
1274
The Type-Data field varies with the Type of Request and the
1275
associated Response.
1276
1277
4.2. Success and Failure
1278
1279
The Success packet is sent by the authenticator to the peer after
1280
completion of an EAP authentication method (Type 4 or greater) to
1281
indicate that the peer has authenticated successfully to the
1282
authenticator. The authenticator MUST transmit an EAP packet with
1283
the Code field set to 3 (Success). If the authenticator cannot
1284
authenticate the peer (unacceptable Responses to one or more
1285
Requests), then after unsuccessful completion of the EAP method in
1286
progress, the implementation MUST transmit an EAP packet with the
1287
1288
1289
1290
Aboba, et al. Standards Track [Page 23]
1291
1292
RFC 3748 EAP June 2004
1293
1294
1295
Code field set to 4 (Failure). An authenticator MAY wish to issue
1296
multiple Requests before sending a Failure response in order to allow
1297
for human typing mistakes. Success and Failure packets MUST NOT
1298
contain additional data.
1299
1300
Success and Failure packets MUST NOT be sent by an EAP authenticator
1301
if the specification of the given method does not explicitly permit
1302
the method to finish at that point. A peer EAP implementation
1303
receiving a Success or Failure packet where sending one is not
1304
explicitly permitted MUST silently discard it. By default, an EAP
1305
peer MUST silently discard a "canned" Success packet (a Success
1306
packet sent immediately upon connection). This ensures that a rogue
1307
authenticator will not be able to bypass mutual authentication by
1308
sending a Success packet prior to conclusion of the EAP method
1309
conversation.
1310
1311
Implementation Note: Because the Success and Failure packets are not
1312
acknowledged, they are not retransmitted by the authenticator, and
1313
may be potentially lost. A peer MUST allow for this circumstance as
1314
described in this note. See also Section 3.4 for guidance on the
1315
processing of lower layer success and failure indications.
1316
1317
As described in Section 2.1, only a single EAP authentication method
1318
is allowed within an EAP conversation. EAP methods may implement
1319
result indications. After the authenticator sends a failure result
1320
indication to the peer, regardless of the response from the peer, it
1321
MUST subsequently send a Failure packet. After the authenticator
1322
sends a success result indication to the peer and receives a success
1323
result indication from the peer, it MUST subsequently send a Success
1324
packet.
1325
1326
On the peer, once the method completes unsuccessfully (that is,
1327
either the authenticator sends a failure result indication, or the
1328
peer decides that it does not want to continue the conversation,
1329
possibly after sending a failure result indication), the peer MUST
1330
terminate the conversation and indicate failure to the lower layer.
1331
The peer MUST silently discard Success packets and MAY silently
1332
discard Failure packets. As a result, loss of a Failure packet need
1333
not result in a timeout.
1334
1335
On the peer, after success result indications have been exchanged by
1336
both sides, a Failure packet MUST be silently discarded. The peer
1337
MAY, in the event that an EAP Success is not received, conclude that
1338
the EAP Success packet was lost and that authentication concluded
1339
successfully.
1340
1341
1342
1343
1344
1345
1346
Aboba, et al. Standards Track [Page 24]
1347
1348
RFC 3748 EAP June 2004
1349
1350
1351
If the authenticator has not sent a result indication, and the peer
1352
is willing to continue the conversation, the peer waits for a Success
1353
or Failure packet once the method completes, and MUST NOT silently
1354
discard either of them. In the event that neither a Success nor
1355
Failure packet is received, the peer SHOULD terminate the
1356
conversation to avoid lengthy timeouts in case the lost packet was an
1357
EAP Failure.
1358
1359
If the peer attempts to authenticate to the authenticator and fails
1360
to do so, the authenticator MUST send a Failure packet and MUST NOT
1361
grant access by sending a Success packet. However, an authenticator
1362
MAY omit having the peer authenticate to it in situations where
1363
limited access is offered (e.g., guest access). In this case, the
1364
authenticator MUST send a Success packet.
1365
1366
Where the peer authenticates successfully to the authenticator, but
1367
the authenticator does not send a result indication, the
1368
authenticator MAY deny access by sending a Failure packet where the
1369
peer is not currently authorized for network access.
1370
1371
A summary of the Success and Failure packet format is shown below.
1372
The fields are transmitted from left to right.
1373
1374
0 1 2 3
1375
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1376
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1377
| Code | Identifier | Length |
1378
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1379
1380
Code
1381
1382
3 for Success
1383
4 for Failure
1384
1385
Identifier
1386
1387
The Identifier field is one octet and aids in matching replies to
1388
Responses. The Identifier field MUST match the Identifier field
1389
of the Response packet that it is sent in response to.
1390
1391
Length
1392
1393
4
1394
1395
1396
1397
1398
1399
1400
1401
1402
Aboba, et al. Standards Track [Page 25]
1403
1404
RFC 3748 EAP June 2004
1405
1406
1407
4.3. Retransmission Behavior
1408
1409
Because the authentication process will often involve user input,
1410
some care must be taken when deciding upon retransmission strategies
1411
and authentication timeouts. By default, where EAP is run over an
1412
unreliable lower layer, the EAP retransmission timer SHOULD be
1413
dynamically estimated. A maximum of 3-5 retransmissions is
1414
suggested.
1415
1416
When run over a reliable lower layer (e.g., EAP over ISAKMP/TCP, as
1417
within [PIC]), the authenticator retransmission timer SHOULD be set
1418
to an infinite value, so that retransmissions do not occur at the EAP
1419
layer. The peer may still maintain a timeout value so as to avoid
1420
waiting indefinitely for a Request.
1421
1422
Where the authentication process requires user input, the measured
1423
round trip times may be determined by user responsiveness rather than
1424
network characteristics, so that dynamic RTO estimation may not be
1425
helpful. Instead, the retransmission timer SHOULD be set so as to
1426
provide sufficient time for the user to respond, with longer timeouts
1427
required in certain cases, such as where Token Cards (see Section
1428
5.6) are involved.
1429
1430
In order to provide the EAP authenticator with guidance as to the
1431
appropriate timeout value, a hint can be communicated to the
1432
authenticator by the backend authentication server (such as via the
1433
RADIUS Session-Timeout attribute).
1434
1435
In order to dynamically estimate the EAP retransmission timer, the
1436
algorithms for the estimation of SRTT, RTTVAR, and RTO described in
1437
[RFC2988] are RECOMMENDED, including use of Karn's algorithm, with
1438
the following potential modifications:
1439
1440
[a] In order to avoid synchronization behaviors that can occur with
1441
fixed timers among distributed systems, the retransmission timer
1442
is calculated with a jitter by using the RTO value and randomly
1443
adding a value drawn between -RTOmin/2 and RTOmin/2. Alternative
1444
calculations to create jitter MAY be used. These MUST be
1445
pseudo-random. For a discussion of pseudo-random number
1446
generation, see [RFC1750].
1447
1448
[b] When EAP is transported over a single link (as opposed to over
1449
the Internet), smaller values of RTOinitial, RTOmin, and RTOmax
1450
MAY be used. Recommended values are RTOinitial=1 second,
1451
RTOmin=200ms, and RTOmax=20 seconds.
1452
1453
1454
1455
1456
1457
1458
Aboba, et al. Standards Track [Page 26]
1459
1460
RFC 3748 EAP June 2004
1461
1462
1463
[c] When EAP is transported over a single link (as opposed to over
1464
the Internet), estimates MAY be done on a per-authenticator
1465
basis, rather than a per-session basis. This enables the
1466
retransmission estimate to make the most use of information on
1467
link-layer behavior.
1468
1469
[d] An EAP implementation MAY clear SRTT and RTTVAR after backing off
1470
the timer multiple times, as it is likely that the current SRTT
1471
and RTTVAR are bogus in this situation. Once SRTT and RTTVAR are
1472
cleared, they should be initialized with the next RTT sample
1473
taken as described in [RFC2988] equation 2.2.
1474
1475
5. Initial EAP Request/Response Types
1476
1477
This section defines the initial set of EAP Types used in Request/
1478
Response exchanges. More Types may be defined in future documents.
1479
The Type field is one octet and identifies the structure of an EAP
1480
Request or Response packet. The first 3 Types are considered special
1481
case Types.
1482
1483
The remaining Types define authentication exchanges. Nak (Type 3) or
1484
Expanded Nak (Type 254) are valid only for Response packets, they
1485
MUST NOT be sent in a Request.
1486
1487
All EAP implementations MUST support Types 1-4, which are defined in
1488
this document, and SHOULD support Type 254. Implementations MAY
1489
support other Types defined here or in future RFCs.
1490
1491
1 Identity
1492
2 Notification
1493
3 Nak (Response only)
1494
4 MD5-Challenge
1495
5 One Time Password (OTP)
1496
6 Generic Token Card (GTC)
1497
254 Expanded Types
1498
255 Experimental use
1499
1500
EAP methods MAY support authentication based on shared secrets. If
1501
the shared secret is a passphrase entered by the user,
1502
implementations MAY support entering passphrases with non-ASCII
1503
characters. In this case, the input should be processed using an
1504
appropriate stringprep [RFC3454] profile, and encoded in octets using
1505
UTF-8 encoding [RFC2279]. A preliminary version of a possible
1506
stringprep profile is described in [SASLPREP].
1507
1508
1509
1510
1511
1512
1513
1514
Aboba, et al. Standards Track [Page 27]
1515
1516
RFC 3748 EAP June 2004
1517
1518
1519
5.1. Identity
1520
1521
Description
1522
1523
The Identity Type is used to query the identity of the peer.
1524
Generally, the authenticator will issue this as the initial
1525
Request. An optional displayable message MAY be included to
1526
prompt the peer in the case where there is an expectation of
1527
interaction with a user. A Response of Type 1 (Identity) SHOULD
1528
be sent in Response to a Request with a Type of 1 (Identity).
1529
1530
Some EAP implementations piggy-back various options into the
1531
Identity Request after a NUL-character. By default, an EAP
1532
implementation SHOULD NOT assume that an Identity Request or
1533
Response can be larger than 1020 octets.
1534
1535
It is RECOMMENDED that the Identity Response be used primarily for
1536
routing purposes and selecting which EAP method to use. EAP
1537
Methods SHOULD include a method-specific mechanism for obtaining
1538
the identity, so that they do not have to rely on the Identity
1539
Response. Identity Requests and Responses are sent in cleartext,
1540
so an attacker may snoop on the identity, or even modify or spoof
1541
identity exchanges. To address these threats, it is preferable
1542
for an EAP method to include an identity exchange that supports
1543
per-packet authentication, integrity and replay protection, and
1544
confidentiality. The Identity Response may not be the appropriate
1545
identity for the method; it may have been truncated or obfuscated
1546
so as to provide privacy, or it may have been decorated for
1547
routing purposes. Where the peer is configured to only accept
1548
authentication methods supporting protected identity exchanges,
1549
the peer MAY provide an abbreviated Identity Response (such as
1550
omitting the peer-name portion of the NAI [RFC2486]). For further
1551
discussion of identity protection, see Section 7.3.
1552
1553
Implementation Note: The peer MAY obtain the Identity via user input.
1554
It is suggested that the authenticator retry the Identity Request in
1555
the case of an invalid Identity or authentication failure to allow
1556
for potential typos on the part of the user. It is suggested that
1557
the Identity Request be retried a minimum of 3 times before
1558
terminating the authentication. The Notification Request MAY be used
1559
to indicate an invalid authentication attempt prior to transmitting a
1560
new Identity Request (optionally, the failure MAY be indicated within
1561
the message of the new Identity Request itself).
1562
1563
1564
1565
1566
1567
1568
1569
1570
Aboba, et al. Standards Track [Page 28]
1571
1572
RFC 3748 EAP June 2004
1573
1574
1575
Type
1576
1577
1
1578
1579
Type-Data
1580
1581
This field MAY contain a displayable message in the Request,
1582
containing UTF-8 encoded ISO 10646 characters [RFC2279]. Where
1583
the Request contains a null, only the portion of the field prior
1584
to the null is displayed. If the Identity is unknown, the
1585
Identity Response field should be zero bytes in length. The
1586
Identity Response field MUST NOT be null terminated. In all
1587
cases, the length of the Type-Data field is derived from the
1588
Length field of the Request/Response packet.
1589
1590
Security Claims (see Section 7.2):
1591
1592
Auth. mechanism: None
1593
Ciphersuite negotiation: No
1594
Mutual authentication: No
1595
Integrity protection: No
1596
Replay protection: No
1597
Confidentiality: No
1598
Key derivation: No
1599
Key strength: N/A
1600
Dictionary attack prot.: N/A
1601
Fast reconnect: No
1602
Crypt. binding: N/A
1603
Session independence: N/A
1604
Fragmentation: No
1605
Channel binding: No
1606
1607
5.2. Notification
1608
1609
Description
1610
1611
The Notification Type is optionally used to convey a displayable
1612
message from the authenticator to the peer. An authenticator MAY
1613
send a Notification Request to the peer at any time when there is
1614
no outstanding Request, prior to completion of an EAP
1615
authentication method. The peer MUST respond to a Notification
1616
Request with a Notification Response unless the EAP authentication
1617
method specification prohibits the use of Notification messages.
1618
In any case, a Nak Response MUST NOT be sent in response to a
1619
Notification Request. Note that the default maximum length of a
1620
Notification Request is 1020 octets. By default, this leaves at
1621
most 1015 octets for the human readable message.
1622
1623
1624
1625
1626
Aboba, et al. Standards Track [Page 29]
1627
1628
RFC 3748 EAP June 2004
1629
1630
1631
An EAP method MAY indicate within its specification that
1632
Notification messages must not be sent during that method. In
1633
this case, the peer MUST silently discard Notification Requests
1634
from the point where an initial Request for that Type is answered
1635
with a Response of the same Type.
1636
1637
The peer SHOULD display this message to the user or log it if it
1638
cannot be displayed. The Notification Type is intended to provide
1639
an acknowledged notification of some imperative nature, but it is
1640
not an error indication, and therefore does not change the state
1641
of the peer. Examples include a password with an expiration time
1642
that is about to expire, an OTP sequence integer which is nearing
1643
0, an authentication failure warning, etc. In most circumstances,
1644
Notification should not be required.
1645
1646
Type
1647
1648
2
1649
1650
Type-Data
1651
1652
The Type-Data field in the Request contains a displayable message
1653
greater than zero octets in length, containing UTF-8 encoded ISO
1654
10646 characters [RFC2279]. The length of the message is
1655
determined by the Length field of the Request packet. The message
1656
MUST NOT be null terminated. A Response MUST be sent in reply to
1657
the Request with a Type field of 2 (Notification). The Type-Data
1658
field of the Response is zero octets in length. The Response
1659
should be sent immediately (independent of how the message is
1660
displayed or logged).
1661
1662
Security Claims (see Section 7.2):
1663
1664
Auth. mechanism: None
1665
Ciphersuite negotiation: No
1666
Mutual authentication: No
1667
Integrity protection: No
1668
Replay protection: No
1669
Confidentiality: No
1670
Key derivation: No
1671
Key strength: N/A
1672
Dictionary attack prot.: N/A
1673
Fast reconnect: No
1674
Crypt. binding: N/A
1675
Session independence: N/A
1676
Fragmentation: No
1677
Channel binding: No
1678
1679
1680
1681
1682
Aboba, et al. Standards Track [Page 30]
1683
1684
RFC 3748 EAP June 2004
1685
1686
1687
5.3. Nak
1688
1689
5.3.1. Legacy Nak
1690
1691
Description
1692
1693
The legacy Nak Type is valid only in Response messages. It is
1694
sent in reply to a Request where the desired authentication Type
1695
is unacceptable. Authentication Types are numbered 4 and above.
1696
The Response contains one or more authentication Types desired by
1697
the Peer. Type zero (0) is used to indicate that the sender has
1698
no viable alternatives, and therefore the authenticator SHOULD NOT
1699
send another Request after receiving a Nak Response containing a
1700
zero value.
1701
1702
Since the legacy Nak Type is valid only in Responses and has very
1703
limited functionality, it MUST NOT be used as a general purpose
1704
error indication, such as for communication of error messages, or
1705
negotiation of parameters specific to a particular EAP method.
1706
1707
Code
1708
1709
2 for Response.
1710
1711
Identifier
1712
1713
The Identifier field is one octet and aids in matching Responses
1714
with Requests. The Identifier field of a legacy Nak Response MUST
1715
match the Identifier field of the Request packet that it is sent
1716
in response to.
1717
1718
Length
1719
1720
>=6
1721
1722
Type
1723
1724
3
1725
1726
Type-Data
1727
1728
Where a peer receives a Request for an unacceptable authentication
1729
Type (4-253,255), or a peer lacking support for Expanded Types
1730
receives a Request for Type 254, a Nak Response (Type 3) MUST be
1731
sent. The Type-Data field of the Nak Response (Type 3) MUST
1732
contain one or more octets indicating the desired authentication
1733
Type(s), one octet per Type, or the value zero (0) to indicate no
1734
proposed alternative. A peer supporting Expanded Types that
1735
1736
1737
1738
Aboba, et al. Standards Track [Page 31]
1739
1740
RFC 3748 EAP June 2004
1741
1742
1743
receives a Request for an unacceptable authentication Type (4-253,
1744
255) MAY include the value 254 in the Nak Response (Type 3) to
1745
indicate the desire for an Expanded authentication Type. If the
1746
authenticator can accommodate this preference, it will respond
1747
with an Expanded Type Request (Type 254).
1748
1749
Security Claims (see Section 7.2):
1750
1751
Auth. mechanism: None
1752
Ciphersuite negotiation: No
1753
Mutual authentication: No
1754
Integrity protection: No
1755
Replay protection: No
1756
Confidentiality: No
1757
Key derivation: No
1758
Key strength: N/A
1759
Dictionary attack prot.: N/A
1760
Fast reconnect: No
1761
Crypt. binding: N/A
1762
Session independence: N/A
1763
Fragmentation: No
1764
Channel binding: No
1765
1766
1767
5.3.2. Expanded Nak
1768
1769
Description
1770
1771
The Expanded Nak Type is valid only in Response messages. It MUST
1772
be sent only in reply to a Request of Type 254 (Expanded Type)
1773
where the authentication Type is unacceptable. The Expanded Nak
1774
Type uses the Expanded Type format itself, and the Response
1775
contains one or more authentication Types desired by the peer, all
1776
in Expanded Type format. Type zero (0) is used to indicate that
1777
the sender has no viable alternatives. The general format of the
1778
Expanded Type is described in Section 5.7.
1779
1780
Since the Expanded Nak Type is valid only in Responses and has
1781
very limited functionality, it MUST NOT be used as a general
1782
purpose error indication, such as for communication of error
1783
messages, or negotiation of parameters specific to a particular
1784
EAP method.
1785
1786
Code
1787
1788
2 for Response.
1789
1790
1791
1792
1793
1794
Aboba, et al. Standards Track [Page 32]
1795
1796
RFC 3748 EAP June 2004
1797
1798
1799
Identifier
1800
1801
The Identifier field is one octet and aids in matching Responses
1802
with Requests. The Identifier field of an Expanded Nak Response
1803
MUST match the Identifier field of the Request packet that it is
1804
sent in response to.
1805
1806
Length
1807
1808
>=20
1809
1810
Type
1811
1812
254
1813
1814
Vendor-Id
1815
1816
0 (IETF)
1817
1818
Vendor-Type
1819
1820
3 (Nak)
1821
1822
Vendor-Data
1823
1824
The Expanded Nak Type is only sent when the Request contains an
1825
Expanded Type (254) as defined in Section 5.7. The Vendor-Data
1826
field of the Nak Response MUST contain one or more authentication
1827
Types (4 or greater), all in expanded format, 8 octets per Type,
1828
or the value zero (0), also in Expanded Type format, to indicate
1829
no proposed alternative. The desired authentication Types may
1830
include a mixture of Vendor-Specific and IETF Types. For example,
1831
an Expanded Nak Response indicating a preference for OTP (Type 5),
1832
and an MIT (Vendor-Id=20) Expanded Type of 6 would appear as
1833
follows:
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
Aboba, et al. Standards Track [Page 33]
1851
1852
RFC 3748 EAP June 2004
1853
1854
1855
0 1 2 3
1856
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1857
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1858
| 2 | Identifier | Length=28 |
1859
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1860
| Type=254 | 0 (IETF) |
1861
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1862
| 3 (Nak) |
1863
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1864
| Type=254 | 0 (IETF) |
1865
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1866
| 5 (OTP) |
1867
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1868
| Type=254 | 20 (MIT) |
1869
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1870
| 6 |
1871
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1872
1873
An Expanded Nak Response indicating a no desired alternative would
1874
appear as follows:
1875
1876
0 1 2 3
1877
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1878
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1879
| 2 | Identifier | Length=20 |
1880
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1881
| Type=254 | 0 (IETF) |
1882
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1883
| 3 (Nak) |
1884
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1885
| Type=254 | 0 (IETF) |
1886
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1887
| 0 (No alternative) |
1888
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1889
1890
Security Claims (see Section 7.2):
1891
1892
Auth. mechanism: None
1893
Ciphersuite negotiation: No
1894
Mutual authentication: No
1895
Integrity protection: No
1896
Replay protection: No
1897
Confidentiality: No
1898
Key derivation: No
1899
Key strength: N/A
1900
Dictionary attack prot.: N/A
1901
Fast reconnect: No
1902
Crypt. binding: N/A
1903
1904
1905
1906
Aboba, et al. Standards Track [Page 34]
1907
1908
RFC 3748 EAP June 2004
1909
1910
1911
Session independence: N/A
1912
Fragmentation: No
1913
Channel binding: No
1914
1915
1916
5.4. MD5-Challenge
1917
1918
Description
1919
1920
The MD5-Challenge Type is analogous to the PPP CHAP protocol
1921
[RFC1994] (with MD5 as the specified algorithm). The Request
1922
contains a "challenge" message to the peer. A Response MUST be
1923
sent in reply to the Request. The Response MAY be either of Type
1924
4 (MD5-Challenge), Nak (Type 3), or Expanded Nak (Type 254). The
1925
Nak reply indicates the peer's desired authentication Type(s).
1926
EAP peer and EAP server implementations MUST support the MD5-
1927
Challenge mechanism. An authenticator that supports only pass-
1928
through MUST allow communication with a backend authentication
1929
server that is capable of supporting MD5-Challenge, although the
1930
EAP authenticator implementation need not support MD5-Challenge
1931
itself. However, if the EAP authenticator can be configured to
1932
authenticate peers locally (e.g., not operate in pass-through),
1933
then the requirement for support of the MD5-Challenge mechanism
1934
applies.
1935
1936
Note that the use of the Identifier field in the MD5-Challenge
1937
Type is different from that described in [RFC1994]. EAP allows
1938
for retransmission of MD5-Challenge Request packets, while
1939
[RFC1994] states that both the Identifier and Challenge fields
1940
MUST change each time a Challenge (the CHAP equivalent of the
1941
MD5-Challenge Request packet) is sent.
1942
1943
Note: [RFC1994] treats the shared secret as an octet string, and
1944
does not specify how it is entered into the system (or if it is
1945
handled by the user at all). EAP MD5-Challenge implementations
1946
MAY support entering passphrases with non-ASCII characters. See
1947
Section 5 for instructions how the input should be processed and
1948
encoded into octets.
1949
1950
Type
1951
1952
4
1953
1954
Type-Data
1955
1956
The contents of the Type-Data field is summarized below. For
1957
reference on the use of these fields, see the PPP Challenge
1958
Handshake Authentication Protocol [RFC1994].
1959
1960
1961
1962
Aboba, et al. Standards Track [Page 35]
1963
1964
RFC 3748 EAP June 2004
1965
1966
1967
0 1 2 3
1968
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1969
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1970
| Value-Size | Value ...
1971
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1972
| Name ...
1973
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1974
1975
Security Claims (see Section 7.2):
1976
1977
Auth. mechanism: Password or pre-shared key.
1978
Ciphersuite negotiation: No
1979
Mutual authentication: No
1980
Integrity protection: No
1981
Replay protection: No
1982
Confidentiality: No
1983
Key derivation: No
1984
Key strength: N/A
1985
Dictionary attack prot.: No
1986
Fast reconnect: No
1987
Crypt. binding: N/A
1988
Session independence: N/A
1989
Fragmentation: No
1990
Channel binding: No
1991
1992
5.5. One-Time Password (OTP)
1993
1994
Description
1995
1996
The One-Time Password system is defined in "A One-Time Password
1997
System" [RFC2289] and "OTP Extended Responses" [RFC2243]. The
1998
Request contains an OTP challenge in the format described in
1999
[RFC2289]. A Response MUST be sent in reply to the Request. The
2000
Response MUST be of Type 5 (OTP), Nak (Type 3), or Expanded Nak
2001
(Type 254). The Nak Response indicates the peer's desired
2002
authentication Type(s). The EAP OTP method is intended for use
2003
with the One-Time Password system only, and MUST NOT be used to
2004
provide support for cleartext passwords.
2005
2006
Type
2007
2008
5
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
Aboba, et al. Standards Track [Page 36]
2019
2020
RFC 3748 EAP June 2004
2021
2022
2023
Type-Data
2024
2025
The Type-Data field contains the OTP "challenge" as a displayable
2026
message in the Request. In the Response, this field is used for
2027
the 6 words from the OTP dictionary [RFC2289]. The messages MUST
2028
NOT be null terminated. The length of the field is derived from
2029
the Length field of the Request/Reply packet.
2030
2031
Note: [RFC2289] does not specify how the secret pass-phrase is
2032
entered by the user, or how the pass-phrase is converted into
2033
octets. EAP OTP implementations MAY support entering passphrases
2034
with non-ASCII characters. See Section 5 for instructions on how
2035
the input should be processed and encoded into octets.
2036
2037
Security Claims (see Section 7.2):
2038
2039
Auth. mechanism: One-Time Password
2040
Ciphersuite negotiation: No
2041
Mutual authentication: No
2042
Integrity protection: No
2043
Replay protection: Yes
2044
Confidentiality: No
2045
Key derivation: No
2046
Key strength: N/A
2047
Dictionary attack prot.: No
2048
Fast reconnect: No
2049
Crypt. binding: N/A
2050
Session independence: N/A
2051
Fragmentation: No
2052
Channel binding: No
2053
2054
2055
5.6. Generic Token Card (GTC)
2056
2057
Description
2058
2059
The Generic Token Card Type is defined for use with various Token
2060
Card implementations which require user input. The Request
2061
contains a displayable message and the Response contains the Token
2062
Card information necessary for authentication. Typically, this
2063
would be information read by a user from the Token card device and
2064
entered as ASCII text. A Response MUST be sent in reply to the
2065
Request. The Response MUST be of Type 6 (GTC), Nak (Type 3), or
2066
Expanded Nak (Type 254). The Nak Response indicates the peer's
2067
desired authentication Type(s). The EAP GTC method is intended
2068
for use with the Token Cards supporting challenge/response
2069
2070
2071
2072
2073
2074
Aboba, et al. Standards Track [Page 37]
2075
2076
RFC 3748 EAP June 2004
2077
2078
2079
authentication and MUST NOT be used to provide support for
2080
cleartext passwords in the absence of a protected tunnel with
2081
server authentication.
2082
2083
Type
2084
2085
6
2086
2087
Type-Data
2088
2089
The Type-Data field in the Request contains a displayable message
2090
greater than zero octets in length. The length of the message is
2091
determined by the Length field of the Request packet. The message
2092
MUST NOT be null terminated. A Response MUST be sent in reply to
2093
the Request with a Type field of 6 (Generic Token Card). The
2094
Response contains data from the Token Card required for
2095
authentication. The length of the data is determined by the
2096
Length field of the Response packet.
2097
2098
EAP GTC implementations MAY support entering a response with non-
2099
ASCII characters. See Section 5 for instructions how the input
2100
should be processed and encoded into octets.
2101
2102
Security Claims (see Section 7.2):
2103
2104
Auth. mechanism: Hardware token.
2105
Ciphersuite negotiation: No
2106
Mutual authentication: No
2107
Integrity protection: No
2108
Replay protection: No
2109
Confidentiality: No
2110
Key derivation: No
2111
Key strength: N/A
2112
Dictionary attack prot.: No
2113
Fast reconnect: No
2114
Crypt. binding: N/A
2115
Session independence: N/A
2116
Fragmentation: No
2117
Channel binding: No
2118
2119
2120
5.7. Expanded Types
2121
2122
Description
2123
2124
Since many of the existing uses of EAP are vendor-specific, the
2125
Expanded method Type is available to allow vendors to support
2126
their own Expanded Types not suitable for general usage.
2127
2128
2129
2130
Aboba, et al. Standards Track [Page 38]
2131
2132
RFC 3748 EAP June 2004
2133
2134
2135
The Expanded Type is also used to expand the global Method Type
2136
space beyond the original 255 values. A Vendor-Id of 0 maps the
2137
original 255 possible Types onto a space of 2^32-1 possible Types.
2138
(Type 0 is only used in a Nak Response to indicate no acceptable
2139
alternative).
2140
2141
An implementation that supports the Expanded attribute MUST treat
2142
EAP Types that are less than 256 equivalently, whether they appear
2143
as a single octet or as the 32-bit Vendor-Type within an Expanded
2144
Type where Vendor-Id is 0. Peers not equipped to interpret the
2145
Expanded Type MUST send a Nak as described in Section 5.3.1, and
2146
negotiate a more suitable authentication method.
2147
2148
A summary of the Expanded Type format is shown below. The fields
2149
are transmitted from left to right.
2150
2151
0 1 2 3
2152
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
2153
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2154
| Type | Vendor-Id |
2155
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2156
| Vendor-Type |
2157
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2158
| Vendor data...
2159
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2160
2161
Type
2162
2163
254 for Expanded Type
2164
2165
Vendor-Id
2166
2167
The Vendor-Id is 3 octets and represents the SMI Network
2168
Management Private Enterprise Code of the Vendor in network byte
2169
order, as allocated by IANA. A Vendor-Id of zero is reserved for
2170
use by the IETF in providing an expanded global EAP Type space.
2171
2172
Vendor-Type
2173
2174
The Vendor-Type field is four octets and represents the vendor-
2175
specific method Type.
2176
2177
If the Vendor-Id is zero, the Vendor-Type field is an extension
2178
and superset of the existing namespace for EAP Types. The first
2179
256 Types are reserved for compatibility with single-octet EAP
2180
Types that have already been assigned or may be assigned in the
2181
future. Thus, EAP Types from 0 through 255 are semantically
2182
identical, whether they appear as single octet EAP Types or as
2183
2184
2185
2186
Aboba, et al. Standards Track [Page 39]
2187
2188
RFC 3748 EAP June 2004
2189
2190
2191
Vendor-Types when Vendor-Id is zero. There is one exception to
2192
this rule: Expanded Nak and Legacy Nak packets share the same
2193
Type, but must be treated differently because they have a
2194
different format.
2195
2196
Vendor-Data
2197
2198
The Vendor-Data field is defined by the vendor. Where a Vendor-Id
2199
of zero is present, the Vendor-Data field will be used for
2200
transporting the contents of EAP methods of Types defined by the
2201
IETF.
2202
2203
5.8. Experimental
2204
2205
Description
2206
2207
The Experimental Type has no fixed format or content. It is
2208
intended for use when experimenting with new EAP Types. This Type
2209
is intended for experimental and testing purposes. No guarantee
2210
is made for interoperability between peers using this Type, as
2211
outlined in [RFC3692].
2212
2213
Type
2214
2215
255
2216
2217
Type-Data
2218
2219
Undefined
2220
2221
6. IANA Considerations
2222
2223
This section provides guidance to the Internet Assigned Numbers
2224
Authority (IANA) regarding registration of values related to the EAP
2225
protocol, in accordance with BCP 26, [RFC2434].
2226
2227
There are two name spaces in EAP that require registration: Packet
2228
Codes and method Types.
2229
2230
EAP is not intended as a general-purpose protocol, and allocations
2231
SHOULD NOT be made for purposes unrelated to authentication.
2232
2233
The following terms are used here with the meanings defined in BCP
2234
26: "name space", "assigned value", "registration".
2235
2236
The following policies are used here with the meanings defined in BCP
2237
26: "Private Use", "First Come First Served", "Expert Review",
2238
"Specification Required", "IETF Consensus", "Standards Action".
2239
2240
2241
2242
Aboba, et al. Standards Track [Page 40]
2243
2244
RFC 3748 EAP June 2004
2245
2246
2247
For registration requests where a Designated Expert should be
2248
consulted, the responsible IESG area director should appoint the
2249
Designated Expert. The intention is that any allocation will be
2250
accompanied by a published RFC. But in order to allow for the
2251
allocation of values prior to the RFC being approved for publication,
2252
the Designated Expert can approve allocations once it seems clear
2253
that an RFC will be published. The Designated expert will post a
2254
request to the EAP WG mailing list (or a successor designated by the
2255
Area Director) for comment and review, including an Internet-Draft.
2256
Before a period of 30 days has passed, the Designated Expert will
2257
either approve or deny the registration request and publish a notice
2258
of the decision to the EAP WG mailing list or its successor, as well
2259
as informing IANA. A denial notice must be justified by an
2260
explanation, and in the cases where it is possible, concrete
2261
suggestions on how the request can be modified so as to become
2262
acceptable should be provided.
2263
2264
6.1. Packet Codes
2265
2266
Packet Codes have a range from 1 to 255, of which 1-4 have been
2267
allocated. Because a new Packet Code has considerable impact on
2268
interoperability, a new Packet Code requires Standards Action, and
2269
should be allocated starting at 5.
2270
2271
6.2. Method Types
2272
2273
The original EAP method Type space has a range from 1 to 255, and is
2274
the scarcest resource in EAP, and thus must be allocated with care.
2275
Method Types 1-45 have been allocated, with 20 available for re-use.
2276
Method Types 20 and 46-191 may be allocated on the advice of a
2277
Designated Expert, with Specification Required.
2278
2279
Allocation of blocks of method Types (more than one for a given
2280
purpose) should require IETF Consensus. EAP Type Values 192-253 are
2281
reserved and allocation requires Standards Action.
2282
2283
Method Type 254 is allocated for the Expanded Type. Where the
2284
Vendor-Id field is non-zero, the Expanded Type is used for functions
2285
specific only to one vendor's implementation of EAP, where no
2286
interoperability is deemed useful. When used with a Vendor-Id of
2287
zero, method Type 254 can also be used to provide for an expanded
2288
IETF method Type space. Method Type values 256-4294967295 may be
2289
allocated after Type values 1-191 have been allocated, on the advice
2290
of a Designated Expert, with Specification Required.
2291
2292
Method Type 255 is allocated for Experimental use, such as testing of
2293
new EAP methods before a permanent Type is allocated.
2294
2295
2296
2297
2298
Aboba, et al. Standards Track [Page 41]
2299
2300
RFC 3748 EAP June 2004
2301
2302
2303
7. Security Considerations
2304
2305
This section defines a generic threat model as well as the EAP method
2306
security claims mitigating those threats.
2307
2308
It is expected that the generic threat model and corresponding
2309
security claims will used to define EAP method requirements for use
2310
in specific environments. An example of such a requirements analysis
2311
is provided in [IEEE-802.11i-req]. A security claims section is
2312
required in EAP method specifications, so that EAP methods can be
2313
evaluated against the requirements.
2314
2315
7.1. Threat Model
2316
2317
EAP was developed for use with PPP [RFC1661] and was later adapted
2318
for use in wired IEEE 802 networks [IEEE-802] in [IEEE-802.1X].
2319
Subsequently, EAP has been proposed for use on wireless LAN networks
2320
and over the Internet. In all these situations, it is possible for
2321
an attacker to gain access to links over which EAP packets are
2322
transmitted. For example, attacks on telephone infrastructure are
2323
documented in [DECEPTION].
2324
2325
An attacker with access to the link may carry out a number of
2326
attacks, including:
2327
2328
[1] An attacker may try to discover user identities by snooping
2329
authentication traffic.
2330
2331
[2] An attacker may try to modify or spoof EAP packets.
2332
2333
[3] An attacker may launch denial of service attacks by spoofing
2334
lower layer indications or Success/Failure packets, by replaying
2335
EAP packets, or by generating packets with overlapping
2336
Identifiers.
2337
2338
[4] An attacker may attempt to recover the pass-phrase by mounting
2339
an offline dictionary attack.
2340
2341
[5] An attacker may attempt to convince the peer to connect to an
2342
untrusted network by mounting a man-in-the-middle attack.
2343
2344
[6] An attacker may attempt to disrupt the EAP negotiation in order
2345
cause a weak authentication method to be selected.
2346
2347
[7] An attacker may attempt to recover keys by taking advantage of
2348
weak key derivation techniques used within EAP methods.
2349
2350
2351
2352
2353
2354
Aboba, et al. Standards Track [Page 42]
2355
2356
RFC 3748 EAP June 2004
2357
2358
2359
[8] An attacker may attempt to take advantage of weak ciphersuites
2360
subsequently used after the EAP conversation is complete.
2361
2362
[9] An attacker may attempt to perform downgrading attacks on lower
2363
layer ciphersuite negotiation in order to ensure that a weaker
2364
ciphersuite is used subsequently to EAP authentication.
2365
2366
[10] An attacker acting as an authenticator may provide incorrect
2367
information to the EAP peer and/or server via out-of-band
2368
mechanisms (such as via a AAA or lower layer protocol). This
2369
includes impersonating another authenticator, or providing
2370
inconsistent information to the peer and EAP server.
2371
2372
Depending on the lower layer, these attacks may be carried out
2373
without requiring physical proximity. Where EAP is used over
2374
wireless networks, EAP packets may be forwarded by authenticators
2375
(e.g., pre-authentication) so that the attacker need not be within
2376
the coverage area of an authenticator in order to carry out an attack
2377
on it or its peers. Where EAP is used over the Internet, attacks may
2378
be carried out at an even greater distance.
2379
2380
7.2. Security Claims
2381
2382
In order to clearly articulate the security provided by an EAP
2383
method, EAP method specifications MUST include a Security Claims
2384
section, including the following declarations:
2385
2386
[a] Mechanism. This is a statement of the authentication technology:
2387
certificates, pre-shared keys, passwords, token cards, etc.
2388
2389
[b] Security claims. This is a statement of the claimed security
2390
properties of the method, using terms defined in Section 7.2.1:
2391
mutual authentication, integrity protection, replay protection,
2392
confidentiality, key derivation, dictionary attack resistance,
2393
fast reconnect, cryptographic binding. The Security Claims
2394
section of an EAP method specification SHOULD provide
2395
justification for the claims that are made. This can be
2396
accomplished by including a proof in an Appendix, or including a
2397
reference to a proof.
2398
2399
[c] Key strength. If the method derives keys, then the effective key
2400
strength MUST be estimated. This estimate is meant for potential
2401
users of the method to determine if the keys produced are strong
2402
enough for the intended application.
2403
2404
2405
2406
2407
2408
2409
2410
Aboba, et al. Standards Track [Page 43]
2411
2412
RFC 3748 EAP June 2004
2413
2414
2415
The effective key strength SHOULD be stated as a number of bits,
2416
defined as follows: If the effective key strength is N bits, the
2417
best currently known methods to recover the key (with non-
2418
negligible probability) require, on average, an effort comparable
2419
to 2^(N-1) operations of a typical block cipher. The statement
2420
SHOULD be accompanied by a short rationale, explaining how this
2421
number was derived. This explanation SHOULD include the
2422
parameters required to achieve the stated key strength based on
2423
current knowledge of the algorithms.
2424
2425
(Note: Although it is difficult to define what "comparable
2426
effort" and "typical block cipher" exactly mean, reasonable
2427
approximations are sufficient here. Refer to e.g. [SILVERMAN]
2428
for more discussion.)
2429
2430
The key strength depends on the methods used to derive the keys.
2431
For instance, if keys are derived from a shared secret (such as a
2432
password or a long-term secret), and possibly some public
2433
information such as nonces, the effective key strength is limited
2434
by the strength of the long-term secret (assuming that the
2435
derivation procedure is computationally simple). To take another
2436
example, when using public key algorithms, the strength of the
2437
symmetric key depends on the strength of the public keys used.
2438
2439
[d] Description of key hierarchy. EAP methods deriving keys MUST
2440
either provide a reference to a key hierarchy specification, or
2441
describe how Master Session Keys (MSKs) and Extended Master
2442
Session Keys (EMSKs) are to be derived.
2443
2444
[e] Indication of vulnerabilities. In addition to the security
2445
claims that are made, the specification MUST indicate which of
2446
the security claims detailed in Section 7.2.1 are NOT being made.
2447
2448
7.2.1. Security Claims Terminology for EAP Methods
2449
2450
These terms are used to describe the security properties of EAP
2451
methods:
2452
2453
Protected ciphersuite negotiation
2454
This refers to the ability of an EAP method to negotiate the
2455
ciphersuite used to protect the EAP conversation, as well as to
2456
integrity protect the negotiation. It does not refer to the
2457
ability to negotiate the ciphersuite used to protect data.
2458
2459
2460
2461
2462
2463
2464
2465
2466
Aboba, et al. Standards Track [Page 44]
2467
2468
RFC 3748 EAP June 2004
2469
2470
2471
Mutual authentication
2472
This refers to an EAP method in which, within an interlocked
2473
exchange, the authenticator authenticates the peer and the peer
2474
authenticates the authenticator. Two independent one-way methods,
2475
running in opposite directions do not provide mutual
2476
authentication as defined here.
2477
2478
Integrity protection
2479
This refers to providing data origin authentication and protection
2480
against unauthorized modification of information for EAP packets
2481
(including EAP Requests and Responses). When making this claim, a
2482
method specification MUST describe the EAP packets and fields
2483
within the EAP packet that are protected.
2484
2485
Replay protection
2486
This refers to protection against replay of an EAP method or its
2487
messages, including success and failure result indications.
2488
2489
Confidentiality
2490
This refers to encryption of EAP messages, including EAP Requests
2491
and Responses, and success and failure result indications. A
2492
method making this claim MUST support identity protection (see
2493
Section 7.3).
2494
2495
Key derivation
2496
This refers to the ability of the EAP method to derive exportable
2497
keying material, such as the Master Session Key (MSK), and
2498
Extended Master Session Key (EMSK). The MSK is used only for
2499
further key derivation, not directly for protection of the EAP
2500
conversation or subsequent data. Use of the EMSK is reserved.
2501
2502
Key strength
2503
If the effective key strength is N bits, the best currently known
2504
methods to recover the key (with non-negligible probability)
2505
require, on average, an effort comparable to 2^(N-1) operations of
2506
a typical block cipher.
2507
2508
Dictionary attack resistance
2509
Where password authentication is used, passwords are commonly
2510
selected from a small set (as compared to a set of N-bit keys),
2511
which raises a concern about dictionary attacks. A method may be
2512
said to provide protection against dictionary attacks if, when it
2513
uses a password as a secret, the method does not allow an offline
2514
attack that has a work factor based on the number of passwords in
2515
an attacker's dictionary.
2516
2517
2518
2519
2520
2521
2522
Aboba, et al. Standards Track [Page 45]
2523
2524
RFC 3748 EAP June 2004
2525
2526
2527
Fast reconnect
2528
The ability, in the case where a security association has been
2529
previously established, to create a new or refreshed security
2530
association more efficiently or in a smaller number of round-
2531
trips.
2532
2533
Cryptographic binding
2534
The demonstration of the EAP peer to the EAP server that a single
2535
entity has acted as the EAP peer for all methods executed within a
2536
tunnel method. Binding MAY also imply that the EAP server
2537
demonstrates to the peer that a single entity has acted as the EAP
2538
server for all methods executed within a tunnel method. If
2539
executed correctly, binding serves to mitigate man-in-the-middle
2540
vulnerabilities.
2541
2542
Session independence
2543
The demonstration that passive attacks (such as capture of the EAP
2544
conversation) or active attacks (including compromise of the MSK
2545
or EMSK) does not enable compromise of subsequent or prior MSKs or
2546
EMSKs.
2547
2548
Fragmentation
2549
This refers to whether an EAP method supports fragmentation and
2550
reassembly. As noted in Section 3.1, EAP methods should support
2551
fragmentation and reassembly if EAP packets can exceed the minimum
2552
MTU of 1020 octets.
2553
2554
Channel binding
2555
The communication within an EAP method of integrity-protected
2556
channel properties such as endpoint identifiers which can be
2557
compared to values communicated via out of band mechanisms (such
2558
as via a AAA or lower layer protocol).
2559
2560
Note: This list of security claims is not exhaustive. Additional
2561
properties, such as additional denial-of-service protection, may be
2562
relevant as well.
2563
2564
7.3. Identity Protection
2565
2566
An Identity exchange is optional within the EAP conversation.
2567
Therefore, it is possible to omit the Identity exchange entirely, or
2568
to use a method-specific identity exchange once a protected channel
2569
has been established.
2570
2571
However, where roaming is supported as described in [RFC2607], it may
2572
be necessary to locate the appropriate backend authentication server
2573
before the authentication conversation can proceed. The realm
2574
portion of the Network Access Identifier (NAI) [RFC2486] is typically
2575
2576
2577
2578
Aboba, et al. Standards Track [Page 46]
2579
2580
RFC 3748 EAP June 2004
2581
2582
2583
included within the EAP-Response/Identity in order to enable the
2584
authentication exchange to be routed to the appropriate backend
2585
authentication server. Therefore, while the peer-name portion of the
2586
NAI may be omitted in the EAP-Response/Identity where proxies or
2587
relays are present, the realm portion may be required.
2588
2589
It is possible for the identity in the identity response to be
2590
different from the identity authenticated by the EAP method. This
2591
may be intentional in the case of identity privacy. An EAP method
2592
SHOULD use the authenticated identity when making access control
2593
decisions.
2594
2595
7.4. Man-in-the-Middle Attacks
2596
2597
Where EAP is tunneled within another protocol that omits peer
2598
authentication, there exists a potential vulnerability to a man-in-
2599
the-middle attack. For details, see [BINDING] and [MITM].
2600
2601
As noted in Section 2.1, EAP does not permit untunneled sequences of
2602
authentication methods. Were a sequence of EAP authentication
2603
methods to be permitted, the peer might not have proof that a single
2604
entity has acted as the authenticator for all EAP methods within the
2605
sequence. For example, an authenticator might terminate one EAP
2606
method, then forward the next method in the sequence to another party
2607
without the peer's knowledge or consent. Similarly, the
2608
authenticator might not have proof that a single entity has acted as
2609
the peer for all EAP methods within the sequence.
2610
2611
Tunneling EAP within another protocol enables an attack by a rogue
2612
EAP authenticator tunneling EAP to a legitimate server. Where the
2613
tunneling protocol is used for key establishment but does not require
2614
peer authentication, an attacker convincing a legitimate peer to
2615
connect to it will be able to tunnel EAP packets to a legitimate
2616
server, successfully authenticating and obtaining the key. This
2617
allows the attacker to successfully establish itself as a man-in-
2618
the-middle, gaining access to the network, as well as the ability to
2619
decrypt data traffic between the legitimate peer and server.
2620
2621
This attack may be mitigated by the following measures:
2622
2623
[a] Requiring mutual authentication within EAP tunneling mechanisms.
2624
2625
[b] Requiring cryptographic binding between the EAP tunneling
2626
protocol and the tunneled EAP methods. Where cryptographic
2627
binding is supported, a mechanism is also needed to protect
2628
against downgrade attacks that would bypass it. For further
2629
details on cryptographic binding, see [BINDING].
2630
2631
2632
2633
2634
Aboba, et al. Standards Track [Page 47]
2635
2636
RFC 3748 EAP June 2004
2637
2638
2639
[c] Limiting the EAP methods authorized for use without protection,
2640
based on peer and authenticator policy.
2641
2642
[d] Avoiding the use of tunnels when a single, strong method is
2643
available.
2644
2645
7.5. Packet Modification Attacks
2646
2647
While EAP methods may support per-packet data origin authentication,
2648
integrity, and replay protection, support is not provided within the
2649
EAP layer.
2650
2651
Since the Identifier is only a single octet, it is easy to guess,
2652
allowing an attacker to successfully inject or replay EAP packets.
2653
An attacker may also modify EAP headers (Code, Identifier, Length,
2654
Type) within EAP packets where the header is unprotected. This could
2655
cause packets to be inappropriately discarded or misinterpreted.
2656
2657
To protect EAP packets against modification, spoofing, or replay,
2658
methods supporting protected ciphersuite negotiation, mutual
2659
authentication, and key derivation, as well as integrity and replay
2660
protection, are recommended. See Section 7.2.1 for definitions of
2661
these security claims.
2662
2663
Method-specific MICs may be used to provide protection. If a per-
2664
packet MIC is employed within an EAP method, then peers,
2665
authentication servers, and authenticators not operating in pass-
2666
through mode MUST validate the MIC. MIC validation failures SHOULD
2667
be logged. Whether a MIC validation failure is considered a fatal
2668
error or not is determined by the EAP method specification.
2669
2670
It is RECOMMENDED that methods providing integrity protection of EAP
2671
packets include coverage of all the EAP header fields, including the
2672
Code, Identifier, Length, Type, and Type-Data fields.
2673
2674
Since EAP messages of Types Identity, Notification, and Nak do not
2675
include their own MIC, it may be desirable for the EAP method MIC to
2676
cover information contained within these messages, as well as the
2677
header of each EAP message.
2678
2679
To provide protection, EAP also may be encapsulated within a
2680
protected channel created by protocols such as ISAKMP [RFC2408], as
2681
is done in [IKEv2] or within TLS [RFC2246]. However, as noted in
2682
Section 7.4, EAP tunneling may result in a man-in-the-middle
2683
vulnerability.
2684
2685
2686
2687
2688
2689
2690
Aboba, et al. Standards Track [Page 48]
2691
2692
RFC 3748 EAP June 2004
2693
2694
2695
Existing EAP methods define message integrity checks (MICs) that
2696
cover more than one EAP packet. For example, EAP-TLS [RFC2716]
2697
defines a MIC over a TLS record that could be split into multiple
2698
fragments; within the FINISHED message, the MIC is computed over
2699
previous messages. Where the MIC covers more than one EAP packet, a
2700
MIC validation failure is typically considered a fatal error.
2701
2702
Within EAP-TLS [RFC2716], a MIC validation failure is treated as a
2703
fatal error, since that is what is specified in TLS [RFC2246].
2704
However, it is also possible to develop EAP methods that support
2705
per-packet MICs, and respond to verification failures by silently
2706
discarding the offending packet.
2707
2708
In this document, descriptions of EAP message handling assume that
2709
per-packet MIC validation, where it occurs, is effectively performed
2710
as though it occurs before sending any responses or changing the
2711
state of the host which received the packet.
2712
2713
7.6. Dictionary Attacks
2714
2715
Password authentication algorithms such as EAP-MD5, MS-CHAPv1
2716
[RFC2433], and Kerberos V [RFC1510] are known to be vulnerable to
2717
dictionary attacks. MS-CHAPv1 vulnerabilities are documented in
2718
[PPTPv1]; MS-CHAPv2 vulnerabilities are documented in [PPTPv2];
2719
Kerberos vulnerabilities are described in [KRBATTACK], [KRBLIM], and
2720
[KERB4WEAK].
2721
2722
In order to protect against dictionary attacks, authentication
2723
methods resistant to dictionary attacks (as defined in Section 7.2.1)
2724
are recommended.
2725
2726
If an authentication algorithm is used that is known to be vulnerable
2727
to dictionary attacks, then the conversation may be tunneled within a
2728
protected channel in order to provide additional protection.
2729
However, as noted in Section 7.4, EAP tunneling may result in a man-
2730
in-the-middle vulnerability, and therefore dictionary attack
2731
resistant methods are preferred.
2732
2733
7.7. Connection to an Untrusted Network
2734
2735
With EAP methods supporting one-way authentication, such as EAP-MD5,
2736
the peer does not authenticate the authenticator, making the peer
2737
vulnerable to attack by a rogue authenticator. Methods supporting
2738
mutual authentication (as defined in Section 7.2.1) address this
2739
vulnerability.
2740
2741
In EAP there is no requirement that authentication be full duplex or
2742
that the same protocol be used in both directions. It is perfectly
2743
2744
2745
2746
Aboba, et al. Standards Track [Page 49]
2747
2748
RFC 3748 EAP June 2004
2749
2750
2751
acceptable for different protocols to be used in each direction.
2752
This will, of course, depend on the specific protocols negotiated.
2753
However, in general, completing a single unitary mutual
2754
authentication is preferable to two one-way authentications, one in
2755
each direction. This is because separate authentications that are
2756
not bound cryptographically so as to demonstrate they are part of the
2757
same session are subject to man-in-the-middle attacks, as discussed
2758
in Section 7.4.
2759
2760
7.8. Negotiation Attacks
2761
2762
In a negotiation attack, the attacker attempts to convince the peer
2763
and authenticator to negotiate a less secure EAP method. EAP does
2764
not provide protection for Nak Response packets, although it is
2765
possible for a method to include coverage of Nak Responses within a
2766
method-specific MIC.
2767
2768
Within or associated with each authenticator, it is not anticipated
2769
that a particular named peer will support a choice of methods. This
2770
would make the peer vulnerable to attacks that negotiate the least
2771
secure method from among a set. Instead, for each named peer, there
2772
SHOULD be an indication of exactly one method used to authenticate
2773
that peer name. If a peer needs to make use of different
2774
authentication methods under different circumstances, then distinct
2775
identities SHOULD be employed, each of which identifies exactly one
2776
authentication method.
2777
2778
7.9. Implementation Idiosyncrasies
2779
2780
The interaction of EAP with lower layers such as PPP and IEEE 802 are
2781
highly implementation dependent.
2782
2783
For example, upon failure of authentication, some PPP implementations
2784
do not terminate the link, instead limiting traffic in Network-Layer
2785
Protocols to a filtered subset, which in turn allows the peer the
2786
opportunity to update secrets or send mail to the network
2787
administrator indicating a problem. Similarly, while an
2788
authentication failure will result in denied access to the controlled
2789
port in [IEEE-802.1X], limited traffic may be permitted on the
2790
uncontrolled port.
2791
2792
In EAP there is no provision for retries of failed authentication.
2793
However, in PPP the LCP state machine can renegotiate the
2794
authentication protocol at any time, thus allowing a new attempt.
2795
Similarly, in IEEE 802.1X the Supplicant or Authenticator can re-
2796
authenticate at any time. It is recommended that any counters used
2797
for authentication failure not be reset until after successful
2798
authentication, or subsequent termination of the failed link.
2799
2800
2801
2802
Aboba, et al. Standards Track [Page 50]
2803
2804
RFC 3748 EAP June 2004
2805
2806
2807
7.10. Key Derivation
2808
2809
It is possible for the peer and EAP server to mutually authenticate
2810
and derive keys. In order to provide keying material for use in a
2811
subsequently negotiated ciphersuite, an EAP method supporting key
2812
derivation MUST export a Master Session Key (MSK) of at least 64
2813
octets, and an Extended Master Session Key (EMSK) of at least 64
2814
octets. EAP Methods deriving keys MUST provide for mutual
2815
authentication between the EAP peer and the EAP Server.
2816
2817
The MSK and EMSK MUST NOT be used directly to protect data; however,
2818
they are of sufficient size to enable derivation of a AAA-Key
2819
subsequently used to derive Transient Session Keys (TSKs) for use
2820
with the selected ciphersuite. Each ciphersuite is responsible for
2821
specifying how to derive the TSKs from the AAA-Key.
2822
2823
The AAA-Key is derived from the keying material exported by the EAP
2824
method (MSK and EMSK). This derivation occurs on the AAA server. In
2825
many existing protocols that use EAP, the AAA-Key and MSK are
2826
equivalent, but more complicated mechanisms are possible (see
2827
[KEYFRAME] for details).
2828
2829
EAP methods SHOULD ensure the freshness of the MSK and EMSK, even in
2830
cases where one party may not have a high quality random number
2831
generator. A RECOMMENDED method is for each party to provide a nonce
2832
of at least 128 bits, used in the derivation of the MSK and EMSK.
2833
2834
EAP methods export the MSK and EMSK, but not Transient Session Keys
2835
so as to allow EAP methods to be ciphersuite and media independent.
2836
Keying material exported by EAP methods MUST be independent of the
2837
ciphersuite negotiated to protect data.
2838
2839
Depending on the lower layer, EAP methods may run before or after
2840
ciphersuite negotiation, so that the selected ciphersuite may not be
2841
known to the EAP method. By providing keying material usable with
2842
any ciphersuite, EAP methods can used with a wide range of
2843
ciphersuites and media.
2844
2845
In order to preserve algorithm independence, EAP methods deriving
2846
keys SHOULD support (and document) the protected negotiation of the
2847
ciphersuite used to protect the EAP conversation between the peer and
2848
server. This is distinct from the ciphersuite negotiated between the
2849
peer and authenticator, used to protect data.
2850
2851
The strength of Transient Session Keys (TSKs) used to protect data is
2852
ultimately dependent on the strength of keys generated by the EAP
2853
method. If an EAP method cannot produce keying material of
2854
sufficient strength, then the TSKs may be subject to a brute force
2855
2856
2857
2858
Aboba, et al. Standards Track [Page 51]
2859
2860
RFC 3748 EAP June 2004
2861
2862
2863
attack. In order to enable deployments requiring strong keys, EAP
2864
methods supporting key derivation SHOULD be capable of generating an
2865
MSK and EMSK, each with an effective key strength of at least 128
2866
bits.
2867
2868
Methods supporting key derivation MUST demonstrate cryptographic
2869
separation between the MSK and EMSK branches of the EAP key
2870
hierarchy. Without violating a fundamental cryptographic assumption
2871
(such as the non-invertibility of a one-way function), an attacker
2872
recovering the MSK or EMSK MUST NOT be able to recover the other
2873
quantity with a level of effort less than brute force.
2874
2875
Non-overlapping substrings of the MSK MUST be cryptographically
2876
separate from each other, as defined in Section 7.2.1. That is,
2877
knowledge of one substring MUST NOT help in recovering some other
2878
substring without breaking some hard cryptographic assumption. This
2879
is required because some existing ciphersuites form TSKs by simply
2880
splitting the AAA-Key to pieces of appropriate length. Likewise,
2881
non-overlapping substrings of the EMSK MUST be cryptographically
2882
separate from each other, and from substrings of the MSK.
2883
2884
The EMSK is reserved for future use and MUST remain on the EAP peer
2885
and EAP server where it is derived; it MUST NOT be transported to, or
2886
shared with, additional parties, or used to derive any other keys.
2887
(This restriction will be relaxed in a future document that specifies
2888
how the EMSK can be used.)
2889
2890
Since EAP does not provide for explicit key lifetime negotiation, EAP
2891
peers, authenticators, and authentication servers MUST be prepared
2892
for situations in which one of the parties discards the key state,
2893
which remains valid on another party.
2894
2895
This specification does not provide detailed guidance on how EAP
2896
methods derive the MSK and EMSK, how the AAA-Key is derived from the
2897
MSK and/or EMSK, or how the TSKs are derived from the AAA-Key.
2898
2899
The development and validation of key derivation algorithms is
2900
difficult, and as a result, EAP methods SHOULD re-use well
2901
established and analyzed mechanisms for key derivation (such as those
2902
specified in IKE [RFC2409] or TLS [RFC2246]), rather than inventing
2903
new ones. EAP methods SHOULD also utilize well established and
2904
analyzed mechanisms for MSK and EMSK derivation. Further details on
2905
EAP Key Derivation are provided within [KEYFRAME].
2906
2907
2908
2909
2910
2911
2912
2913
2914
Aboba, et al. Standards Track [Page 52]
2915
2916
RFC 3748 EAP June 2004
2917
2918
2919
7.11. Weak Ciphersuites
2920
2921
If after the initial EAP authentication, data packets are sent
2922
without per-packet authentication, integrity, and replay protection,
2923
an attacker with access to the media can inject packets, "flip bits"
2924
within existing packets, replay packets, or even hijack the session
2925
completely. Without per-packet confidentiality, it is possible to
2926
snoop data packets.
2927
2928
To protect against data modification, spoofing, or snooping, it is
2929
recommended that EAP methods supporting mutual authentication and key
2930
derivation (as defined by Section 7.2.1) be used, along with lower
2931
layers providing per-packet confidentiality, authentication,
2932
integrity, and replay protection.
2933
2934
Additionally, if the lower layer performs ciphersuite negotiation, it
2935
should be understood that EAP does not provide by itself integrity
2936
protection of that negotiation. Therefore, in order to avoid
2937
downgrading attacks which would lead to weaker ciphersuites being
2938
used, clients implementing lower layer ciphersuite negotiation SHOULD
2939
protect against negotiation downgrading.
2940
2941
This can be done by enabling users to configure which ciphersuites
2942
are acceptable as a matter of security policy, or the ciphersuite
2943
negotiation MAY be authenticated using keying material derived from
2944
the EAP authentication and a MIC algorithm agreed upon in advance by
2945
lower-layer peers.
2946
2947
7.12. Link Layer
2948
2949
There are reliability and security issues with link layer indications
2950
in PPP, IEEE 802 LANs, and IEEE 802.11 wireless LANs:
2951
2952
[a] PPP. In PPP, link layer indications such as LCP-Terminate (a
2953
link failure indication) and NCP (a link success indication) are
2954
not authenticated or integrity protected. They can therefore be
2955
spoofed by an attacker with access to the link.
2956
2957
[b] IEEE 802. IEEE 802.1X EAPOL-Start and EAPOL-Logoff frames are
2958
not authenticated or integrity protected. They can therefore be
2959
spoofed by an attacker with access to the link.
2960
2961
[c] IEEE 802.11. In IEEE 802.11, link layer indications include
2962
Disassociate and Deauthenticate frames (link failure
2963
indications), and the first message of the 4-way handshake (link
2964
success indication). These messages are not authenticated or
2965
integrity protected, and although they are not forwardable, they
2966
are spoofable by an attacker within range.
2967
2968
2969
2970
Aboba, et al. Standards Track [Page 53]
2971
2972
RFC 3748 EAP June 2004
2973
2974
2975
In IEEE 802.11, IEEE 802.1X data frames may be sent as Class 3
2976
unicast data frames, and are therefore forwardable. This implies
2977
that while EAPOL-Start and EAPOL-Logoff messages may be authenticated
2978
and integrity protected, they can be spoofed by an authenticated
2979
attacker far from the target when "pre-authentication" is enabled.
2980
2981
In IEEE 802.11, a "link down" indication is an unreliable indication
2982
of link failure, since wireless signal strength can come and go and
2983
may be influenced by radio frequency interference generated by an
2984
attacker. To avoid unnecessary resets, it is advisable to damp these
2985
indications, rather than passing them directly to the EAP. Since EAP
2986
supports retransmission, it is robust against transient connectivity
2987
losses.
2988
2989
7.13. Separation of Authenticator and Backend Authentication Server
2990
2991
It is possible for the EAP peer and EAP server to mutually
2992
authenticate and derive a AAA-Key for a ciphersuite used to protect
2993
subsequent data traffic. This does not present an issue on the peer,
2994
since the peer and EAP client reside on the same machine; all that is
2995
required is for the client to derive the AAA-Key from the MSK and
2996
EMSK exported by the EAP method, and to subsequently pass a Transient
2997
Session Key (TSK) to the ciphersuite module.
2998
2999
However, in the case where the authenticator and authentication
3000
server reside on different machines, there are several implications
3001
for security.
3002
3003
[a] Authentication will occur between the peer and the authentication
3004
server, not between the peer and the authenticator. This means
3005
that it is not possible for the peer to validate the identity of
3006
the authenticator that it is speaking to, using EAP alone.
3007
3008
[b] As discussed in [RFC3579], the authenticator is dependent on the
3009
AAA protocol in order to know the outcome of an authentication
3010
conversation, and does not look at the encapsulated EAP packet
3011
(if one is present) to determine the outcome. In practice, this
3012
implies that the AAA protocol spoken between the authenticator
3013
and authentication server MUST support per-packet authentication,
3014
integrity, and replay protection.
3015
3016
[c] After completion of the EAP conversation, where lower layer
3017
security services such as per-packet confidentiality,
3018
authentication, integrity, and replay protection will be enabled,
3019
a secure association protocol SHOULD be run between the peer and
3020
authenticator in order to provide mutual authentication between
3021
3022
3023
3024
3025
3026
Aboba, et al. Standards Track [Page 54]
3027
3028
RFC 3748 EAP June 2004
3029
3030
3031
the peer and authenticator, guarantee liveness of transient
3032
session keys, provide protected ciphersuite and capabilities
3033
negotiation for subsequent data, and synchronize key usage.
3034
3035
[d] A AAA-Key derived from the MSK and/or EMSK negotiated between the
3036
peer and authentication server MAY be transmitted to the
3037
authenticator. Therefore, a mechanism needs to be provided to
3038
transmit the AAA-Key from the authentication server to the
3039
authenticator that needs it. The specification of the AAA-key
3040
derivation, transport, and wrapping mechanisms is outside the
3041
scope of this document. Further details on AAA-Key Derivation
3042
are provided within [KEYFRAME].
3043
3044
7.14. Cleartext Passwords
3045
3046
This specification does not define a mechanism for cleartext password
3047
authentication. The omission is intentional. Use of cleartext
3048
passwords would allow the password to be captured by an attacker with
3049
access to a link over which EAP packets are transmitted.
3050
3051
Since protocols encapsulating EAP, such as RADIUS [RFC3579], may not
3052
provide confidentiality, EAP packets may be subsequently encapsulated
3053
for transport over the Internet where they may be captured by an
3054
attacker.
3055
3056
As a result, cleartext passwords cannot be securely used within EAP,
3057
except where encapsulated within a protected tunnel with server
3058
authentication. Some of the same risks apply to EAP methods without
3059
dictionary attack resistance, as defined in Section 7.2.1. For
3060
details, see Section 7.6.
3061
3062
7.15. Channel Binding
3063
3064
It is possible for a compromised or poorly implemented EAP
3065
authenticator to communicate incorrect information to the EAP peer
3066
and/or server. This may enable an authenticator to impersonate
3067
another authenticator or communicate incorrect information via out-
3068
of-band mechanisms (such as via a AAA or lower layer protocol).
3069
3070
Where EAP is used in pass-through mode, the EAP peer typically does
3071
not verify the identity of the pass-through authenticator, it only
3072
verifies that the pass-through authenticator is trusted by the EAP
3073
server. This creates a potential security vulnerability.
3074
3075
Section 4.3.7 of [RFC3579] describes how an EAP pass-through
3076
authenticator acting as a AAA client can be detected if it attempts
3077
to impersonate another authenticator (such by sending incorrect NAS-
3078
Identifier [RFC2865], NAS-IP-Address [RFC2865] or NAS-IPv6-Address
3079
3080
3081
3082
Aboba, et al. Standards Track [Page 55]
3083
3084
RFC 3748 EAP June 2004
3085
3086
3087
[RFC3162] attributes via the AAA protocol). However, it is possible
3088
for a pass-through authenticator acting as a AAA client to provide
3089
correct information to the AAA server while communicating misleading
3090
information to the EAP peer via a lower layer protocol.
3091
3092
For example, it is possible for a compromised authenticator to
3093
utilize another authenticator's Called-Station-Id or NAS-Identifier
3094
in communicating with the EAP peer via a lower layer protocol, or for
3095
a pass-through authenticator acting as a AAA client to provide an
3096
incorrect peer Calling-Station-Id [RFC2865][RFC3580] to the AAA
3097
server via the AAA protocol.
3098
3099
In order to address this vulnerability, EAP methods may support a
3100
protected exchange of channel properties such as endpoint
3101
identifiers, including (but not limited to): Called-Station-Id
3102
[RFC2865][RFC3580], Calling-Station-Id [RFC2865][RFC3580], NAS-
3103
Identifier [RFC2865], NAS-IP-Address [RFC2865], and NAS-IPv6-Address
3104
[RFC3162].
3105
3106
Using such a protected exchange, it is possible to match the channel
3107
properties provided by the authenticator via out-of-band mechanisms
3108
against those exchanged within the EAP method. Where discrepancies
3109
are found, these SHOULD be logged; additional actions MAY also be
3110
taken, such as denying access.
3111
3112
7.16. Protected Result Indications
3113
3114
Within EAP, Success and Failure packets are neither acknowledged nor
3115
integrity protected. Result indications improve resilience to loss
3116
of Success and Failure packets when EAP is run over lower layers
3117
which do not support retransmission or synchronization of the
3118
authentication state. In media such as IEEE 802.11, which provides
3119
for retransmission, as well as synchronization of authentication
3120
state via the 4-way handshake defined in [IEEE-802.11i], additional
3121
resilience is typically of marginal benefit.
3122
3123
Depending on the method and circumstances, result indications can be
3124
spoofable by an attacker. A method is said to provide protected
3125
result indications if it supports result indications, as well as the
3126
"integrity protection" and "replay protection" claims. A method
3127
supporting protected result indications MUST indicate which result
3128
indications are protected, and which are not.
3129
3130
Protected result indications are not required to protect against
3131
rogue authenticators. Within a mutually authenticating method,
3132
requiring that the server authenticate to the peer before the peer
3133
will accept a Success packet prevents an attacker from acting as a
3134
rogue authenticator.
3135
3136
3137
3138
Aboba, et al. Standards Track [Page 56]
3139
3140
RFC 3748 EAP June 2004
3141
3142
3143
However, it is possible for an attacker to forge a Success packet
3144
after the server has authenticated to the peer, but before the peer
3145
has authenticated to the server. If the peer were to accept the
3146
forged Success packet and attempt to access the network when it had
3147
not yet successfully authenticated to the server, a denial of service
3148
attack could be mounted against the peer. After such an attack, if
3149
the lower layer supports failure indications, the authenticator can
3150
synchronize state with the peer by providing a lower layer failure
3151
indication. See Section 7.12 for details.
3152
3153
If a server were to authenticate the peer and send a Success packet
3154
prior to determining whether the peer has authenticated the
3155
authenticator, an idle timeout can occur if the authenticator is not
3156
authenticated by the peer. Where supported by the lower layer, an
3157
authenticator sensing the absence of the peer can free resources.
3158
3159
In a method supporting result indications, a peer that has
3160
authenticated the server does not consider the authentication
3161
successful until it receives an indication that the server
3162
successfully authenticated it. Similarly, a server that has
3163
successfully authenticated the peer does not consider the
3164
authentication successful until it receives an indication that the
3165
peer has authenticated the server.
3166
3167
In order to avoid synchronization problems, prior to sending a
3168
success result indication, it is desirable for the sender to verify
3169
that sufficient authorization exists for granting access, though, as
3170
discussed below, this is not always possible.
3171
3172
While result indications may enable synchronization of the
3173
authentication result between the peer and server, this does not
3174
guarantee that the peer and authenticator will be synchronized in
3175
terms of their authorization or that timeouts will not occur. For
3176
example, the EAP server may not be aware of an authorization decision
3177
made by a AAA proxy; the AAA server may check authorization only
3178
after authentication has completed successfully, to discover that
3179
authorization cannot be granted, or the AAA server may grant access
3180
but the authenticator may be unable to provide it due to a temporary
3181
lack of resources. In these situations, synchronization may only be
3182
achieved via lower layer result indications.
3183
3184
Success indications may be explicit or implicit. For example, where
3185
a method supports error messages, an implicit success indication may
3186
be defined as the reception of a specific message without a preceding
3187
error message. Failures are typically indicated explicitly. As
3188
described in Section 4.2, a peer silently discards a Failure packet
3189
received at a point where the method does not explicitly permit this
3190
3191
3192
3193
3194
Aboba, et al. Standards Track [Page 57]
3195
3196
RFC 3748 EAP June 2004
3197
3198
3199
to be sent. For example, a method providing its own error messages
3200
might require the peer to receive an error message prior to accepting
3201
a Failure packet.
3202
3203
Per-packet authentication, integrity, and replay protection of result
3204
indications protects against spoofing. Since protected result
3205
indications require use of a key for per-packet authentication and
3206
integrity protection, methods supporting protected result indications
3207
MUST also support the "key derivation", "mutual authentication",
3208
"integrity protection", and "replay protection" claims.
3209
3210
Protected result indications address some denial-of-service
3211
vulnerabilities due to spoofing of Success and Failure packets,
3212
though not all. EAP methods can typically provide protected result
3213
indications only in some circumstances. For example, errors can
3214
occur prior to key derivation, and so it may not be possible to
3215
protect all failure indications. It is also possible that result
3216
indications may not be supported in both directions or that
3217
synchronization may not be achieved in all modes of operation.
3218
3219
For example, within EAP-TLS [RFC2716], in the client authentication
3220
handshake, the server authenticates the peer, but does not receive a
3221
protected indication of whether the peer has authenticated it. In
3222
contrast, the peer authenticates the server and is aware of whether
3223
the server has authenticated it. In the session resumption
3224
handshake, the peer authenticates the server, but does not receive a
3225
protected indication of whether the server has authenticated it. In
3226
this mode, the server authenticates the peer and is aware of whether
3227
the peer has authenticated it.
3228
3229
8. Acknowledgements
3230
3231
This protocol derives much of its inspiration from Dave Carrel's AHA
3232
document, as well as the PPP CHAP protocol [RFC1994]. Valuable
3233
feedback was provided by Yoshihiro Ohba of Toshiba America Research,
3234
Jari Arkko of Ericsson, Sachin Seth of Microsoft, Glen Zorn of Cisco
3235
Systems, Jesse Walker of Intel, Bill Arbaugh, Nick Petroni and Bryan
3236
Payne of the University of Maryland, Steve Bellovin of AT&T Research,
3237
Paul Funk of Funk Software, Pasi Eronen of Nokia, Joseph Salowey of
3238
Cisco, Paul Congdon of HP, and members of the EAP working group.
3239
3240
The use of Security Claims sections for EAP methods, as required by
3241
Section 7.2 and specified for each EAP method described in this
3242
document, was inspired by Glen Zorn through [EAP-EVAL].
3243
3244
3245
3246
3247
3248
3249
3250
Aboba, et al. Standards Track [Page 58]
3251
3252
RFC 3748 EAP June 2004
3253
3254
3255
9. References
3256
3257
9.1. Normative References
3258
3259
[RFC1661] Simpson, W., "The Point-to-Point Protocol (PPP)",
3260
STD 51, RFC 1661, July 1994.
3261
3262
[RFC1994] Simpson, W., "PPP Challenge Handshake
3263
Authentication Protocol (CHAP)", RFC 1994, August
3264
1996.
3265
3266
[RFC2119] Bradner, S., "Key words for use in RFCs to
3267
Indicate Requirement Levels", BCP 14, RFC 2119,
3268
March 1997.
3269
3270
[RFC2243] Metz, C., "OTP Extended Responses", RFC 2243,
3271
November 1997.
3272
3273
[RFC2279] Yergeau, F., "UTF-8, a transformation format of
3274
ISO 10646", RFC 2279, January 1998.
3275
3276
[RFC2289] Haller, N., Metz, C., Nesser, P. and M. Straw, "A
3277
One-Time Password System", RFC 2289, February
3278
1998.
3279
3280
[RFC2434] Narten, T. and H. Alvestrand, "Guidelines for
3281
Writing an IANA Considerations Section in RFCs",
3282
BCP 26, RFC 2434, October 1998.
3283
3284
[RFC2988] Paxson, V. and M. Allman, "Computing TCP's
3285
Retransmission Timer", RFC 2988, November 2000.
3286
3287
[IEEE-802] Institute of Electrical and Electronics Engineers,
3288
"Local and Metropolitan Area Networks: Overview
3289
and Architecture", IEEE Standard 802, 1990.
3290
3291
[IEEE-802.1X] Institute of Electrical and Electronics Engineers,
3292
"Local and Metropolitan Area Networks: Port-Based
3293
Network Access Control", IEEE Standard 802.1X,
3294
September 2001.
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
Aboba, et al. Standards Track [Page 59]
3307
3308
RFC 3748 EAP June 2004
3309
3310
3311
9.2. Informative References
3312
3313
[RFC793] Postel, J., "Transmission Control Protocol", STD
3314
7, RFC 793, September 1981.
3315
3316
[RFC1510] Kohl, J. and B. Neuman, "The Kerberos Network
3317
Authentication Service (V5)", RFC 1510, September
3318
1993.
3319
3320
[RFC1750] Eastlake, D., Crocker, S. and J. Schiller,
3321
"Randomness Recommendations for Security", RFC
3322
1750, December 1994.
3323
3324
[RFC2246] Dierks, T., Allen, C., Treese, W., Karlton, P.,
3325
Freier, A. and P. Kocher, "The TLS Protocol
3326
Version 1.0", RFC 2246, January 1999.
3327
3328
[RFC2284] Blunk, L. and J. Vollbrecht, "PPP Extensible
3329
Authentication Protocol (EAP)", RFC 2284, March
3330
1998.
3331
3332
[RFC2486] Aboba, B. and M. Beadles, "The Network Access
3333
Identifier", RFC 2486, January 1999.
3334
3335
[RFC2408] Maughan, D., Schneider, M. and M. Schertler,
3336
"Internet Security Association and Key Management
3337
Protocol (ISAKMP)", RFC 2408, November 1998.
3338
3339
[RFC2409] Harkins, D. and D. Carrel, "The Internet Key
3340
Exchange (IKE)", RFC 2409, November 1998.
3341
3342
[RFC2433] Zorn, G. and S. Cobb, "Microsoft PPP CHAP
3343
Extensions", RFC 2433, October 1998.
3344
3345
[RFC2607] Aboba, B. and J. Vollbrecht, "Proxy Chaining and
3346
Policy Implementation in Roaming", RFC 2607, June
3347
1999.
3348
3349
[RFC2661] Townsley, W., Valencia, A., Rubens, A., Pall, G.,
3350
Zorn, G. and B. Palter, "Layer Two Tunneling
3351
Protocol "L2TP"", RFC 2661, August 1999.
3352
3353
[RFC2716] Aboba, B. and D. Simon, "PPP EAP TLS
3354
Authentication Protocol", RFC 2716, October 1999.
3355
3356
[RFC2865] Rigney, C., Willens, S., Rubens, A. and W.
3357
Simpson, "Remote Authentication Dial In User
3358
Service (RADIUS)", RFC 2865, June 2000.
3359
3360
3361
3362
Aboba, et al. Standards Track [Page 60]
3363
3364
RFC 3748 EAP June 2004
3365
3366
3367
[RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C.,
3368
Schwarzbauer, H., Taylor, T., Rytina, I., Kalla,
3369
M., Zhang, L. and V. Paxson, "Stream Control
3370
Transmission Protocol", RFC 2960, October 2000.
3371
3372
[RFC3162] Aboba, B., Zorn, G. and D. Mitton, "RADIUS and
3373
IPv6", RFC 3162, August 2001.
3374
3375
[RFC3454] Hoffman, P. and M. Blanchet, "Preparation of
3376
Internationalized Strings ("stringprep")", RFC
3377
3454, December 2002.
3378
3379
[RFC3579] Aboba, B. and P. Calhoun, "RADIUS (Remote
3380
Authentication Dial In User Service) Support For
3381
Extensible Authentication Protocol (EAP)", RFC
3382
3579, September 2003.
3383
3384
[RFC3580] Congdon, P., Aboba, B., Smith, A., Zorn, G. and J.
3385
Roese, "IEEE 802.1X Remote Authentication Dial In
3386
User Service (RADIUS) Usage Guidelines", RFC 3580,
3387
September 2003.
3388
3389
[RFC3692] Narten, T., "Assigning Experimental and Testing
3390
Numbers Considered Useful", BCP 82, RFC 3692,
3391
January 2004.
3392
3393
[DECEPTION] Slatalla, M. and J. Quittner, "Masters of
3394
Deception", Harper-Collins, New York, 1995.
3395
3396
[KRBATTACK] Wu, T., "A Real-World Analysis of Kerberos
3397
Password Security", Proceedings of the 1999 ISOC
3398
Network and Distributed System Security Symposium,
3399
http://www.isoc.org/isoc/conferences/ndss/99/
3400
proceedings/papers/wu.pdf.
3401
3402
[KRBLIM] Bellovin, S. and M. Merrit, "Limitations of the
3403
Kerberos authentication system", Proceedings of
3404
the 1991 Winter USENIX Conference, pp. 253-267,
3405
1991.
3406
3407
[KERB4WEAK] Dole, B., Lodin, S. and E. Spafford, "Misplaced
3408
trust: Kerberos 4 session keys", Proceedings of
3409
the Internet Society Network and Distributed
3410
System Security Symposium, pp. 60-70, March 1997.
3411
3412
3413
3414
3415
3416
3417
3418
Aboba, et al. Standards Track [Page 61]
3419
3420
RFC 3748 EAP June 2004
3421
3422
3423
[PIC] Aboba, B., Krawczyk, H. and Y. Sheffer, "PIC, A
3424
Pre-IKE Credential Provisioning Protocol", Work in
3425
Progress, October 2002.
3426
3427
[IKEv2] Kaufman, C., "Internet Key Exchange (IKEv2)
3428
Protocol", Work in Progress, January 2004.
3429
3430
[PPTPv1] Schneier, B. and Mudge, "Cryptanalysis of
3431
Microsoft's Point-to- Point Tunneling Protocol",
3432
Proceedings of the 5th ACM Conference on
3433
Communications and Computer Security, ACM Press,
3434
November 1998.
3435
3436
[IEEE-802.11] Institute of Electrical and Electronics Engineers,
3437
"Wireless LAN Medium Access Control (MAC) and
3438
Physical Layer (PHY) Specifications", IEEE
3439
Standard 802.11, 1999.
3440
3441
[SILVERMAN] Silverman, Robert D., "A Cost-Based Security
3442
Analysis of Symmetric and Asymmetric Key Lengths",
3443
RSA Laboratories Bulletin 13, April 2000 (Revised
3444
November 2001),
3445
http://www.rsasecurity.com/rsalabs/bulletins/
3446
bulletin13.html.
3447
3448
[KEYFRAME] Aboba, B., "EAP Key Management Framework", Work in
3449
Progress, October 2003.
3450
3451
[SASLPREP] Zeilenga, K., "SASLprep: Stringprep profile for
3452
user names and passwords", Work in Progress, March
3453
2004.
3454
3455
[IEEE-802.11i] Institute of Electrical and Electronics Engineers,
3456
"Unapproved Draft Supplement to Standard for
3457
Telecommunications and Information Exchange
3458
Between Systems - LAN/MAN Specific Requirements -
3459
Part 11: Wireless LAN Medium Access Control (MAC)
3460
and Physical Layer (PHY) Specifications:
3461
Specification for Enhanced Security", IEEE Draft
3462
802.11i (work in progress), 2003.
3463
3464
[DIAM-EAP] Eronen, P., Hiller, T. and G. Zorn, "Diameter
3465
Extensible Authentication Protocol (EAP)
3466
Application", Work in Progress, February 2004.
3467
3468
[EAP-EVAL] Zorn, G., "Specifying Security Claims for EAP
3469
Authentication Types", Work in Progress, October
3470
2002.
3471
3472
3473
3474
Aboba, et al. Standards Track [Page 62]
3475
3476
RFC 3748 EAP June 2004
3477
3478
3479
[BINDING] Puthenkulam, J., "The Compound Authentication
3480
Binding Problem", Work in Progress, October 2003.
3481
3482
[MITM] Asokan, N., Niemi, V. and K. Nyberg, "Man-in-the-
3483
Middle in Tunneled Authentication Protocols", IACR
3484
ePrint Archive Report 2002/163, October 2002,
3485
<http://eprint.iacr.org/2002/163>.
3486
3487
[IEEE-802.11i-req] Stanley, D., "EAP Method Requirements for Wireless
3488
LANs", Work in Progress, February 2004.
3489
3490
[PPTPv2] Schneier, B. and Mudge, "Cryptanalysis of
3491
Microsoft's PPTP Authentication Extensions (MS-
3492
CHAPv2)", CQRE 99, Springer-Verlag, 1999, pp.
3493
192-203.
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
Aboba, et al. Standards Track [Page 63]
3531
3532
RFC 3748 EAP June 2004
3533
3534
3535
Appendix A. Changes from RFC 2284
3536
3537
This section lists the major changes between [RFC2284] and this
3538
document. Minor changes, including style, grammar, spelling, and
3539
editorial changes are not mentioned here.
3540
3541
o The Terminology section (Section 1.2) has been expanded, defining
3542
more concepts and giving more exact definitions.
3543
3544
o The concepts of Mutual Authentication, Key Derivation, and Result
3545
Indications are introduced and discussed throughout the document
3546
where appropriate.
3547
3548
o In Section 2, it is explicitly specified that more than one
3549
exchange of Request and Response packets may occur as part of the
3550
EAP authentication exchange. How this may be used and how it may
3551
not be used is specified in detail in Section 2.1.
3552
3553
o Also in Section 2, some requirements have been made explicit for
3554
the authenticator when acting in pass-through mode.
3555
3556
o An EAP multiplexing model (Section 2.2) has been added to
3557
illustrate a typical implementation of EAP. There is no
3558
requirement that an implementation conform to this model, as long
3559
as the on-the-wire behavior is consistent with it.
3560
3561
o As EAP is now in use with a variety of lower layers, not just PPP
3562
for which it was first designed, Section 3 on lower layer behavior
3563
has been added.
3564
3565
o In the description of the EAP Request and Response interaction
3566
(Section 4.1), both the behavior on receiving duplicate requests,
3567
and when packets should be silently discarded has been more
3568
exactly specified. The implementation notes in this section have
3569
been substantially expanded.
3570
3571
o In Section 4.2, it has been clarified that Success and Failure
3572
packets must not contain additional data, and the implementation
3573
note has been expanded. A subsection giving requirements on
3574
processing of success and failure packets has been added.
3575
3576
o Section 5 on EAP Request/Response Types lists two new Type values:
3577
the Expanded Type (Section 5.7), which is used to expand the Type
3578
value number space, and the Experimental Type. In the Expanded
3579
Type number space, the new Expanded Nak (Section 5.3.2) Type has
3580
been added. Clarifications have been made in the description of
3581
most of the existing Types. Security claims summaries have been
3582
added for authentication methods.
3583
3584
3585
3586
Aboba, et al. Standards Track [Page 64]
3587
3588
RFC 3748 EAP June 2004
3589
3590
3591
o In Sections 5, 5.1, and 5.2, a requirement has been added such
3592
that fields with displayable messages should contain UTF-8 encoded
3593
ISO 10646 characters.
3594
3595
o It is now required in Section 5.1 that if the Type-Data field of
3596
an Identity Request contains a NUL-character, only the part before
3597
the null is displayed. RFC 2284 prohibits the null termination of
3598
the Type-Data field of Identity messages. This rule has been
3599
relaxed for Identity Request messages and the Identity Request
3600
Type-Data field may now be null terminated.
3601
3602
o In Section 5.5, support for OTP Extended Responses [RFC2243] has
3603
been added to EAP OTP.
3604
3605
o An IANA Considerations section (Section 6) has been added, giving
3606
registration policies for the numbering spaces defined for EAP.
3607
3608
o The Security Considerations (Section 7) have been greatly
3609
expanded, giving a much more comprehensive coverage of possible
3610
threats and other security considerations.
3611
3612
o In Section 7.5, text has been added on method-specific behavior,
3613
providing guidance on how EAP method-specific integrity checks
3614
should be processed. Where possible, it is desirable for a
3615
method-specific MIC to be computed over the entire EAP packet,
3616
including the EAP layer header (Code, Identifier, Length) and EAP
3617
method layer header (Type, Type-Data).
3618
3619
o In Section 7.14 the security risks involved in use of cleartext
3620
passwords with EAP are described.
3621
3622
o In Section 7.15 text has been added relating to detection of rogue
3623
NAS behavior.
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642
Aboba, et al. Standards Track [Page 65]
3643
3644
RFC 3748 EAP June 2004
3645
3646
3647
Authors' Addresses
3648
3649
Bernard Aboba
3650
Microsoft Corporation
3651
One Microsoft Way
3652
Redmond, WA 98052
3653
USA
3654
3655
Phone: +1 425 706 6605
3656
Fax: +1 425 936 6605
3657
EMail: bernarda@microsoft.com
3658
3659
Larry J. Blunk
3660
Merit Network, Inc
3661
4251 Plymouth Rd., Suite 2000
3662
Ann Arbor, MI 48105-2785
3663
USA
3664
3665
Phone: +1 734-647-9563
3666
Fax: +1 734-647-3185
3667
EMail: ljb@merit.edu
3668
3669
John R. Vollbrecht
3670
Vollbrecht Consulting LLC
3671
9682 Alice Hill Drive
3672
Dexter, MI 48130
3673
USA
3674
3675
EMail: jrv@umich.edu
3676
3677
James Carlson
3678
Sun Microsystems, Inc
3679
1 Network Drive
3680
Burlington, MA 01803-2757
3681
USA
3682
3683
Phone: +1 781 442 2084
3684
Fax: +1 781 442 1677
3685
EMail: james.d.carlson@sun.com
3686
3687
Henrik Levkowetz
3688
ipUnplugged AB
3689
Arenavagen 33
3690
Stockholm S-121 28
3691
SWEDEN
3692
3693
Phone: +46 708 32 16 08
3694
EMail: henrik@levkowetz.com
3695
3696
3697
3698
Aboba, et al. Standards Track [Page 66]
3699
3700
RFC 3748 EAP June 2004
3701
3702
3703
Full Copyright Statement
3704
3705
Copyright (C) The Internet Society (2004). This document is subject
3706
to the rights, licenses and restrictions contained in BCP 78, and
3707
except as set forth therein, the authors retain all their rights.
3708
3709
This document and the information contained herein are provided on an
3710
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
3711
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
3712
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
3713
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
3714
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
3715
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
3716
3717
Intellectual Property
3718
3719
The IETF takes no position regarding the validity or scope of any
3720
Intellectual Property Rights or other rights that might be claimed to
3721
pertain to the implementation or use of the technology described in
3722
this document or the extent to which any license under such rights
3723
might or might not be available; nor does it represent that it has
3724
made any independent effort to identify any such rights. Information
3725
on the procedures with respect to rights in RFC documents can be
3726
found in BCP 78 and BCP 79.
3727
3728
Copies of IPR disclosures made to the IETF Secretariat and any
3729
assurances of licenses to be made available, or the result of an
3730
attempt made to obtain a general license or permission for the use of
3731
such proprietary rights by implementers or users of this
3732
specification can be obtained from the IETF on-line IPR repository at
3733
http://www.ietf.org/ipr.
3734
3735
The IETF invites any interested party to bring to its attention any
3736
copyrights, patents or patent applications, or other proprietary
3737
rights that may cover technology that may be required to implement
3738
this standard. Please address the information to the IETF at ietf-
3739
ipr@ietf.org.
3740
3741
Acknowledgement
3742
3743
Funding for the RFC Editor function is currently provided by the
3744
Internet Society.
3745
3746
3747
3748
3749
3750
3751
3752
3753
3754
Aboba, et al. Standards Track [Page 67]
3755
Loggerhead is a web-based interface for Breezy
Version: 2.0.1