A new Request for Comments is now available in online RFC libraries.
RFC 7029
Title: Extensible Authentication Protocol (EAP) Mutual
Cryptographic Binding
Author: S. Hartman,
M. Wasserman,
D. Zhang
Status: Informational
Stream: IETF
Date: October 2013
Mailbox: hartmans-ietf@mit.edu,
mrw@painless-security.com,
zhangdacheng@huawei.com
Pages: 19
Characters: 45360
Updates/Obsoletes/SeeAlso: None
I-D Tag: draft-ietf-emu-crypto-bind-04.txt
URL: http://www.rfc-editor.org/rfc/rfc7029.txt
As the Extensible Authentication Protocol (EAP) evolves, EAP peers
rely increasingly on information received from the EAP server. EAP
extensions such as channel binding or network posture information are
often carried in tunnel methods; peers are likely to rely on this
information. Cryptographic binding is a facility described in RFC
3748 that protects tunnel methods against man-in-the-middle attacks.
However, cryptographic binding focuses on protecting the server
rather than the peer. This memo explores attacks possible when the
peer is not protected from man-in-the-middle attacks and recommends
cryptographic binding based on an Extended Master Session Key, a new
form of cryptographic binding that protects both peer and server
along with other mitigations.
This document is a product of the EAP Method Update Working Group of the IETF.
INFORMATIONAL: This memo provides information for the Internet community.
It does not specify an Internet standard of any kind. Distribution of
this memo is unlimited.
This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
http://www.ietf.org/mailman/listinfo/ietf-announce
http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist
For searching the RFC series, see http://www.rfc-editor.org/search/rfc_search.php
For downloading RFCs, see http://www.rfc-editor.org/rfc.html
Requests for special distribution should be addressed to either the
author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.
The RFC Editor Team
Association Management Solutions, LLC
