7 Network Working Group B. Aboba
8 Request for Comments: 3748 Microsoft
9 Obsoletes: 2284 L. Blunk
10 Category: Standards Track Merit Network, Inc
12 Vollbrecht Consulting LLC
20 Extensible Authentication Protocol (EAP)
24 This document specifies an Internet standards track protocol for the
25 Internet community, and requests discussion and suggestions for
26 improvements. Please refer to the current edition of the "Internet
27 Official Protocol Standards" (STD 1) for the standardization state
28 and status of this protocol. Distribution of this memo is unlimited.
32 Copyright (C) The Internet Society (2004).
36 This document defines the Extensible Authentication Protocol (EAP),
37 an authentication framework which supports multiple authentication
38 methods. EAP typically runs directly over data link layers such as
39 Point-to-Point Protocol (PPP) or IEEE 802, without requiring IP. EAP
40 provides its own support for duplicate elimination and
41 retransmission, but is reliant on lower layer ordering guarantees.
42 Fragmentation is not supported within EAP itself; however, individual
43 EAP methods may support this.
45 This document obsoletes RFC 2284. A summary of the changes between
46 this document and RFC 2284 is available in Appendix A.
58 Aboba, et al. Standards Track [Page 1]
60 RFC 3748 EAP June 2004
65 1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . 3
66 1.1. Specification of Requirements . . . . . . . . . . . . . 4
67 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . 4
68 1.3. Applicability . . . . . . . . . . . . . . . . . . . . . 6
69 2. Extensible Authentication Protocol (EAP). . . . . . . . . . . 7
70 2.1. Support for Sequences . . . . . . . . . . . . . . . . . 9
71 2.2. EAP Multiplexing Model. . . . . . . . . . . . . . . . . 10
72 2.3. Pass-Through Behavior . . . . . . . . . . . . . . . . . 12
73 2.4. Peer-to-Peer Operation. . . . . . . . . . . . . . . . . 14
74 3. Lower Layer Behavior. . . . . . . . . . . . . . . . . . . . . 15
75 3.1. Lower Layer Requirements. . . . . . . . . . . . . . . . 15
76 3.2. EAP Usage Within PPP. . . . . . . . . . . . . . . . . . 18
77 3.2.1. PPP Configuration Option Format. . . . . . . . . 18
78 3.3. EAP Usage Within IEEE 802 . . . . . . . . . . . . . . . 19
79 3.4. Lower Layer Indications . . . . . . . . . . . . . . . . 19
80 4. EAP Packet Format . . . . . . . . . . . . . . . . . . . . . . 20
81 4.1. Request and Response. . . . . . . . . . . . . . . . . . 21
82 4.2. Success and Failure . . . . . . . . . . . . . . . . . . 23
83 4.3. Retransmission Behavior . . . . . . . . . . . . . . . . 26
84 5. Initial EAP Request/Response Types. . . . . . . . . . . . . . 27
85 5.1. Identity. . . . . . . . . . . . . . . . . . . . . . . . 28
86 5.2. Notification. . . . . . . . . . . . . . . . . . . . . . 29
87 5.3. Nak . . . . . . . . . . . . . . . . . . . . . . . . . . 31
88 5.3.1. Legacy Nak . . . . . . . . . . . . . . . . . . . 31
89 5.3.2. Expanded Nak . . . . . . . . . . . . . . . . . . 32
90 5.4. MD5-Challenge . . . . . . . . . . . . . . . . . . . . . 35
91 5.5. One-Time Password (OTP) . . . . . . . . . . . . . . . . 36
92 5.6. Generic Token Card (GTC). . . . . . . . . . . . . . . . 37
93 5.7. Expanded Types. . . . . . . . . . . . . . . . . . . . . 38
94 5.8. Experimental. . . . . . . . . . . . . . . . . . . . . . 40
95 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 40
96 6.1. Packet Codes. . . . . . . . . . . . . . . . . . . . . . 41
97 6.2. Method Types. . . . . . . . . . . . . . . . . . . . . . 41
98 7. Security Considerations . . . . . . . . . . . . . . . . . . . 42
99 7.1. Threat Model. . . . . . . . . . . . . . . . . . . . . . 42
100 7.2. Security Claims . . . . . . . . . . . . . . . . . . . . 43
101 7.2.1. Security Claims Terminology for EAP Methods. . . 44
102 7.3. Identity Protection . . . . . . . . . . . . . . . . . . 46
103 7.4. Man-in-the-Middle Attacks . . . . . . . . . . . . . . . 47
104 7.5. Packet Modification Attacks . . . . . . . . . . . . . . 48
105 7.6. Dictionary Attacks. . . . . . . . . . . . . . . . . . . 49
106 7.7. Connection to an Untrusted Network. . . . . . . . . . . 49
107 7.8. Negotiation Attacks . . . . . . . . . . . . . . . . . . 50
108 7.9. Implementation Idiosyncrasies . . . . . . . . . . . . . 50
109 7.10. Key Derivation. . . . . . . . . . . . . . . . . . . . . 51
110 7.11. Weak Ciphersuites . . . . . . . . . . . . . . . . . . . 53
114 Aboba, et al. Standards Track [Page 2]
116 RFC 3748 EAP June 2004
119 7.12. Link Layer. . . . . . . . . . . . . . . . . . . . . . . 53
120 7.13. Separation of Authenticator and Backend Authentication
121 Server. . . . . . . . . . . . . . . . . . . . . . . . . 54
122 7.14. Cleartext Passwords . . . . . . . . . . . . . . . . . . 55
123 7.15. Channel Binding . . . . . . . . . . . . . . . . . . . . 55
124 7.16. Protected Result Indications. . . . . . . . . . . . . . 56
125 8. Acknowledgements. . . . . . . . . . . . . . . . . . . . . . . 58
126 9. References. . . . . . . . . . . . . . . . . . . . . . . . . . 59
127 9.1. Normative References. . . . . . . . . . . . . . . . . . 59
128 9.2. Informative References. . . . . . . . . . . . . . . . . 60
129 Appendix A. Changes from RFC 2284. . . . . . . . . . . . . . . . . 64
130 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 66
131 Full Copyright Statement . . . . . . . . . . . . . . . . . . . . . 67
135 This document defines the Extensible Authentication Protocol (EAP),
136 an authentication framework which supports multiple authentication
137 methods. EAP typically runs directly over data link layers such as
138 Point-to-Point Protocol (PPP) or IEEE 802, without requiring IP. EAP
139 provides its own support for duplicate elimination and
140 retransmission, but is reliant on lower layer ordering guarantees.
141 Fragmentation is not supported within EAP itself; however, individual
142 EAP methods may support this.
144 EAP may be used on dedicated links, as well as switched circuits, and
145 wired as well as wireless links. To date, EAP has been implemented
146 with hosts and routers that connect via switched circuits or dial-up
147 lines using PPP [RFC1661]. It has also been implemented with
148 switches and access points using IEEE 802 [IEEE-802]. EAP
149 encapsulation on IEEE 802 wired media is described in [IEEE-802.1X],
150 and encapsulation on IEEE wireless LANs in [IEEE-802.11i].
152 One of the advantages of the EAP architecture is its flexibility.
153 EAP is used to select a specific authentication mechanism, typically
154 after the authenticator requests more information in order to
155 determine the specific authentication method to be used. Rather than
156 requiring the authenticator to be updated to support each new
157 authentication method, EAP permits the use of a backend
158 authentication server, which may implement some or all authentication
159 methods, with the authenticator acting as a pass-through for some or
160 all methods and peers.
162 Within this document, authenticator requirements apply regardless of
163 whether the authenticator is operating as a pass-through or not.
164 Where the requirement is meant to apply to either the authenticator
165 or backend authentication server, depending on where the EAP
166 authentication is terminated, the term "EAP server" will be used.
170 Aboba, et al. Standards Track [Page 3]
172 RFC 3748 EAP June 2004
175 1.1. Specification of Requirements
177 In this document, several words are used to signify the requirements
178 of the specification. The key words "MUST", "MUST NOT", "REQUIRED",
179 "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY",
180 and "OPTIONAL" in this document are to be interpreted as described in
185 This document frequently uses the following terms:
188 The end of the link initiating EAP authentication. The term
189 authenticator is used in [IEEE-802.1X], and has the same meaning
193 The end of the link that responds to the authenticator. In
194 [IEEE-802.1X], this end is known as the Supplicant.
197 The end of the link that responds to the authenticator in [IEEE-
198 802.1X]. In this document, this end of the link is called the
201 backend authentication server
202 A backend authentication server is an entity that provides an
203 authentication service to an authenticator. When used, this
204 server typically executes EAP methods for the authenticator. This
205 terminology is also used in [IEEE-802.1X].
208 Authentication, Authorization, and Accounting. AAA protocols with
209 EAP support include RADIUS [RFC3579] and Diameter [DIAM-EAP]. In
210 this document, the terms "AAA server" and "backend authentication
211 server" are used interchangeably.
214 This is interpreted to be a human readable string of characters.
215 The message encoding MUST follow the UTF-8 transformation format
226 Aboba, et al. Standards Track [Page 4]
228 RFC 3748 EAP June 2004
232 The entity that terminates the EAP authentication method with the
233 peer. In the case where no backend authentication server is used,
234 the EAP server is part of the authenticator. In the case where
235 the authenticator operates in pass-through mode, the EAP server is
236 located on the backend authentication server.
239 This means the implementation discards the packet without further
240 processing. The implementation SHOULD provide the capability of
241 logging the event, including the contents of the silently
242 discarded packet, and SHOULD record the event in a statistics
245 Successful Authentication
246 In the context of this document, "successful authentication" is an
247 exchange of EAP messages, as a result of which the authenticator
248 decides to allow access by the peer, and the peer decides to use
249 this access. The authenticator's decision typically involves both
250 authentication and authorization aspects; the peer may
251 successfully authenticate to the authenticator, but access may be
252 denied by the authenticator due to policy reasons.
254 Message Integrity Check (MIC)
255 A keyed hash function used for authentication and integrity
256 protection of data. This is usually called a Message
257 Authentication Code (MAC), but IEEE 802 specifications (and this
258 document) use the acronym MIC to avoid confusion with Medium
261 Cryptographic Separation
262 Two keys (x and y) are "cryptographically separate" if an
263 adversary that knows all messages exchanged in the protocol cannot
264 compute x from y or y from x without "breaking" some cryptographic
265 assumption. In particular, this definition allows that the
266 adversary has the knowledge of all nonces sent in cleartext, as
267 well as all predictable counter values used in the protocol.
268 Breaking a cryptographic assumption would typically require
269 inverting a one-way function or predicting the outcome of a
270 cryptographic pseudo-random number generator without knowledge of
271 the secret state. In other words, if the keys are
272 cryptographically separate, there is no shortcut to compute x from
273 y or y from x, but the work an adversary must do to perform this
274 computation is equivalent to performing an exhaustive search for
275 the secret state value.
282 Aboba, et al. Standards Track [Page 5]
284 RFC 3748 EAP June 2004
287 Master Session Key (MSK)
288 Keying material that is derived between the EAP peer and server
289 and exported by the EAP method. The MSK is at least 64 octets in
290 length. In existing implementations, a AAA server acting as an
291 EAP server transports the MSK to the authenticator.
293 Extended Master Session Key (EMSK)
294 Additional keying material derived between the EAP client and
295 server that is exported by the EAP method. The EMSK is at least
296 64 octets in length. The EMSK is not shared with the
297 authenticator or any other third party. The EMSK is reserved for
298 future uses that are not defined yet.
301 A method provides result indications if after the method's last
302 message is sent and received:
304 1) The peer is aware of whether it has authenticated the server,
305 as well as whether the server has authenticated it.
307 2) The server is aware of whether it has authenticated the peer,
308 as well as whether the peer has authenticated it.
310 In the case where successful authentication is sufficient to
311 authorize access, then the peer and authenticator will also know if
312 the other party is willing to provide or accept access. This may not
313 always be the case. An authenticated peer may be denied access due
314 to lack of authorization (e.g., session limit) or other reasons.
315 Since the EAP exchange is run between the peer and the server, other
316 nodes (such as AAA proxies) may also affect the authorization
317 decision. This is discussed in more detail in Section 7.16.
321 EAP was designed for use in network access authentication, where IP
322 layer connectivity may not be available. Use of EAP for other
323 purposes, such as bulk data transport, is NOT RECOMMENDED.
325 Since EAP does not require IP connectivity, it provides just enough
326 support for the reliable transport of authentication protocols, and
329 EAP is a lock-step protocol which only supports a single packet in
330 flight. As a result, EAP cannot efficiently transport bulk data,
331 unlike transport protocols such as TCP [RFC793] or SCTP [RFC2960].
338 Aboba, et al. Standards Track [Page 6]
340 RFC 3748 EAP June 2004
343 While EAP provides support for retransmission, it assumes ordering
344 guarantees provided by the lower layer, so out of order reception is
347 Since EAP does not support fragmentation and reassembly, EAP
348 authentication methods generating payloads larger than the minimum
349 EAP MTU need to provide fragmentation support.
351 While authentication methods such as EAP-TLS [RFC2716] provide
352 support for fragmentation and reassembly, the EAP methods defined in
353 this document do not. As a result, if the EAP packet size exceeds
354 the EAP MTU of the link, these methods will encounter difficulties.
356 EAP authentication is initiated by the server (authenticator),
357 whereas many authentication protocols are initiated by the client
358 (peer). As a result, it may be necessary for an authentication
359 algorithm to add one or two additional messages (at most one
360 roundtrip) in order to run over EAP.
362 Where certificate-based authentication is supported, the number of
363 additional roundtrips may be much larger due to fragmentation of
364 certificate chains. In general, a fragmented EAP packet will require
365 as many round-trips to send as there are fragments. For example, a
366 certificate chain 14960 octets in size would require ten round-trips
367 to send with a 1496 octet EAP MTU.
369 Where EAP runs over a lower layer in which significant packet loss is
370 experienced, or where the connection between the authenticator and
371 authentication server experiences significant packet loss, EAP
372 methods requiring many round-trips can experience difficulties. In
373 these situations, use of EAP methods with fewer roundtrips is
376 2. Extensible Authentication Protocol (EAP)
378 The EAP authentication exchange proceeds as follows:
380 [1] The authenticator sends a Request to authenticate the peer. The
381 Request has a Type field to indicate what is being requested.
382 Examples of Request Types include Identity, MD5-challenge, etc.
383 The MD5-challenge Type corresponds closely to the CHAP
384 authentication protocol [RFC1994]. Typically, the authenticator
385 will send an initial Identity Request; however, an initial
386 Identity Request is not required, and MAY be bypassed. For
387 example, the identity may not be required where it is determined
388 by the port to which the peer has connected (leased lines,
394 Aboba, et al. Standards Track [Page 7]
396 RFC 3748 EAP June 2004
399 dedicated switch or dial-up ports), or where the identity is
400 obtained in another fashion (via calling station identity or MAC
401 address, in the Name field of the MD5-Challenge Response, etc.).
403 [2] The peer sends a Response packet in reply to a valid Request. As
404 with the Request packet, the Response packet contains a Type
405 field, which corresponds to the Type field of the Request.
407 [3] The authenticator sends an additional Request packet, and the
408 peer replies with a Response. The sequence of Requests and
409 Responses continues as long as needed. EAP is a 'lock step'
410 protocol, so that other than the initial Request, a new Request
411 cannot be sent prior to receiving a valid Response. The
412 authenticator is responsible for retransmitting requests as
413 described in Section 4.1. After a suitable number of
414 retransmissions, the authenticator SHOULD end the EAP
415 conversation. The authenticator MUST NOT send a Success or
416 Failure packet when retransmitting or when it fails to get a
417 response from the peer.
419 [4] The conversation continues until the authenticator cannot
420 authenticate the peer (unacceptable Responses to one or more
421 Requests), in which case the authenticator implementation MUST
422 transmit an EAP Failure (Code 4). Alternatively, the
423 authentication conversation can continue until the authenticator
424 determines that successful authentication has occurred, in which
425 case the authenticator MUST transmit an EAP Success (Code 3).
429 o The EAP protocol can support multiple authentication mechanisms
430 without having to pre-negotiate a particular one.
432 o Network Access Server (NAS) devices (e.g., a switch or access
433 point) do not have to understand each authentication method and
434 MAY act as a pass-through agent for a backend authentication
435 server. Support for pass-through is optional. An authenticator
436 MAY authenticate local peers, while at the same time acting as a
437 pass-through for non-local peers and authentication methods it
438 does not implement locally.
440 o Separation of the authenticator from the backend authentication
441 server simplifies credentials management and policy decision
450 Aboba, et al. Standards Track [Page 8]
452 RFC 3748 EAP June 2004
457 o For use in PPP, EAP requires the addition of a new authentication
458 Type to PPP LCP and thus PPP implementations will need to be
459 modified to use it. It also strays from the previous PPP
460 authentication model of negotiating a specific authentication
461 mechanism during LCP. Similarly, switch or access point
462 implementations need to support [IEEE-802.1X] in order to use EAP.
464 o Where the authenticator is separate from the backend
465 authentication server, this complicates the security analysis and,
466 if needed, key distribution.
468 2.1. Support for Sequences
470 An EAP conversation MAY utilize a sequence of methods. A common
471 example of this is an Identity request followed by a single EAP
472 authentication method such as an MD5-Challenge. However, the peer
473 and authenticator MUST utilize only one authentication method (Type 4
474 or greater) within an EAP conversation, after which the authenticator
475 MUST send a Success or Failure packet.
477 Once a peer has sent a Response of the same Type as the initial
478 Request, an authenticator MUST NOT send a Request of a different Type
479 prior to completion of the final round of a given method (with the
480 exception of a Notification-Request) and MUST NOT send a Request for
481 an additional method of any Type after completion of the initial
482 authentication method; a peer receiving such Requests MUST treat them
483 as invalid, and silently discard them. As a result, Identity Requery
486 A peer MUST NOT send a Nak (legacy or expanded) in reply to a Request
487 after an initial non-Nak Response has been sent. Since spoofed EAP
488 Request packets may be sent by an attacker, an authenticator
489 receiving an unexpected Nak SHOULD discard it and log the event.
491 Multiple authentication methods within an EAP conversation are not
492 supported due to their vulnerability to man-in-the-middle attacks
493 (see Section 7.4) and incompatibility with existing implementations.
495 Where a single EAP authentication method is utilized, but other
496 methods are run within it (a "tunneled" method), the prohibition
497 against multiple authentication methods does not apply. Such
498 "tunneled" methods appear as a single authentication method to EAP.
499 Backward compatibility can be provided, since a peer not supporting a
500 "tunneled" method can reply to the initial EAP-Request with a Nak
506 Aboba, et al. Standards Track [Page 9]
508 RFC 3748 EAP June 2004
511 (legacy or expanded). To address security vulnerabilities,
512 "tunneled" methods MUST support protection against man-in-the-middle
515 2.2. EAP Multiplexing Model
517 Conceptually, EAP implementations consist of the following
520 [a] Lower layer. The lower layer is responsible for transmitting and
521 receiving EAP frames between the peer and authenticator. EAP has
522 been run over a variety of lower layers including PPP, wired IEEE
523 802 LANs [IEEE-802.1X], IEEE 802.11 wireless LANs [IEEE-802.11],
524 UDP (L2TP [RFC2661] and IKEv2 [IKEv2]), and TCP [PIC]. Lower
525 layer behavior is discussed in Section 3.
527 [b] EAP layer. The EAP layer receives and transmits EAP packets via
528 the lower layer, implements duplicate detection and
529 retransmission, and delivers and receives EAP messages to and
530 from the EAP peer and authenticator layers.
532 [c] EAP peer and authenticator layers. Based on the Code field, the
533 EAP layer demultiplexes incoming EAP packets to the EAP peer and
534 authenticator layers. Typically, an EAP implementation on a
535 given host will support either peer or authenticator
536 functionality, but it is possible for a host to act as both an
537 EAP peer and authenticator. In such an implementation both EAP
538 peer and authenticator layers will be present.
540 [d] EAP method layers. EAP methods implement the authentication
541 algorithms and receive and transmit EAP messages via the EAP peer
542 and authenticator layers. Since fragmentation support is not
543 provided by EAP itself, this is the responsibility of EAP
544 methods, which are discussed in Section 5.
546 The EAP multiplexing model is illustrated in Figure 1 below. Note
547 that there is no requirement that an implementation conform to this
548 model, as long as the on-the-wire behavior is consistent with it.
562 Aboba, et al. Standards Track [Page 10]
564 RFC 3748 EAP June 2004
567 +-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+
569 | EAP method| EAP method| | EAP method| EAP method|
570 | Type = X | Type = Y | | Type = X | Type = Y |
572 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
574 | EAP ! Peer layer | | EAP ! Auth. layer |
576 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
578 | EAP ! layer | | EAP ! layer |
580 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
582 | Lower ! layer | | Lower ! layer |
584 +-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
586 ! Peer ! Authenticator
587 +------------>-------------+
589 Figure 1: EAP Multiplexing Model
591 Within EAP, the Code field functions much like a protocol number in
592 IP. It is assumed that the EAP layer demultiplexes incoming EAP
593 packets according to the Code field. Received EAP packets with
594 Code=1 (Request), 3 (Success), and 4 (Failure) are delivered by the
595 EAP layer to the EAP peer layer, if implemented. EAP packets with
596 Code=2 (Response) are delivered to the EAP authenticator layer, if
599 Within EAP, the Type field functions much like a port number in UDP
600 or TCP. It is assumed that the EAP peer and authenticator layers
601 demultiplex incoming EAP packets according to their Type, and deliver
602 them only to the EAP method corresponding to that Type. An EAP
603 method implementation on a host may register to receive packets from
604 the peer or authenticator layers, or both, depending on which role(s)
607 Since EAP authentication methods may wish to access the Identity,
608 implementations SHOULD make the Identity Request and Response
609 accessible to authentication methods (Types 4 or greater), in
610 addition to the Identity method. The Identity Type is discussed in
618 Aboba, et al. Standards Track [Page 11]
620 RFC 3748 EAP June 2004
623 A Notification Response is only used as confirmation that the peer
624 received the Notification Request, not that it has processed it, or
625 displayed the message to the user. It cannot be assumed that the
626 contents of the Notification Request or Response are available to
627 another method. The Notification Type is discussed in Section 5.2.
629 Nak (Type 3) or Expanded Nak (Type 254) are utilized for the purposes
630 of method negotiation. Peers respond to an initial EAP Request for
631 an unacceptable Type with a Nak Response (Type 3) or Expanded Nak
632 Response (Type 254). It cannot be assumed that the contents of the
633 Nak Response(s) are available to another method. The Nak Type(s) are
634 discussed in Section 5.3.
636 EAP packets with Codes of Success or Failure do not include a Type
637 field, and are not delivered to an EAP method. Success and Failure
638 are discussed in Section 4.2.
640 Given these considerations, the Success, Failure, Nak Response(s),
641 and Notification Request/Response messages MUST NOT be used to carry
642 data destined for delivery to other EAP methods.
644 2.3. Pass-Through Behavior
646 When operating as a "pass-through authenticator", an authenticator
647 performs checks on the Code, Identifier, and Length fields as
648 described in Section 4.1. It forwards EAP packets received from the
649 peer and destined to its authenticator layer to the backend
650 authentication server; packets received from the backend
651 authentication server destined to the peer are forwarded to it.
653 A host receiving an EAP packet may only do one of three things with
654 it: act on it, drop it, or forward it. The forwarding decision is
655 typically based only on examination of the Code, Identifier, and
656 Length fields. A pass-through authenticator implementation MUST be
657 capable of forwarding EAP packets received from the peer with Code=2
658 (Response) to the backend authentication server. It also MUST be
659 capable of receiving EAP packets from the backend authentication
660 server and forwarding EAP packets of Code=1 (Request), Code=3
661 (Success), and Code=4 (Failure) to the peer.
663 Unless the authenticator implements one or more authentication
664 methods locally which support the authenticator role, the EAP method
665 layer header fields (Type, Type-Data) are not examined as part of the
666 forwarding decision. Where the authenticator supports local
667 authentication methods, it MAY examine the Type field to determine
668 whether to act on the packet itself or forward it. Compliant pass-
669 through authenticator implementations MUST by default forward EAP
674 Aboba, et al. Standards Track [Page 12]
676 RFC 3748 EAP June 2004
679 EAP packets received with Code=1 (Request), Code=3 (Success), and
680 Code=4 (Failure) are demultiplexed by the EAP layer and delivered to
681 the peer layer. Therefore, unless a host implements an EAP peer
682 layer, these packets will be silently discarded. Similarly, EAP
683 packets received with Code=2 (Response) are demultiplexed by the EAP
684 layer and delivered to the authenticator layer. Therefore, unless a
685 host implements an EAP authenticator layer, these packets will be
686 silently discarded. The behavior of a "pass-through peer" is
687 undefined within this specification, and is unsupported by AAA
688 protocols such as RADIUS [RFC3579] and Diameter [DIAM-EAP].
690 The forwarding model is illustrated in Figure 2.
692 Peer Pass-through Authenticator Authentication
695 +-+-+-+-+-+-+ +-+-+-+-+-+-+
697 |EAP method | |EAP method |
699 +-+-+-!-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-!-+-+-+
700 | ! | |EAP | EAP | | | ! |
701 | ! | |Peer | Auth.| EAP Auth. | | ! |
702 |EAP ! peer| | | +-----------+ | |EAP !Auth.|
703 | ! | | | ! | ! | | ! |
704 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
705 | ! | | ! | ! | | ! |
706 |EAP !layer| | EAP !layer| EAP !layer | |EAP !layer|
707 | ! | | ! | ! | | ! |
708 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
709 | ! | | ! | ! | | ! |
710 |Lower!layer| | Lower!layer| AAA ! /IP | | AAA ! /IP |
711 | ! | | ! | ! | | ! |
712 +-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
715 +-------->--------+ +--------->-------+
718 Figure 2: Pass-through Authenticator
720 For sessions in which the authenticator acts as a pass-through, it
721 MUST determine the outcome of the authentication solely based on the
722 Accept/Reject indication sent by the backend authentication server;
723 the outcome MUST NOT be determined by the contents of an EAP packet
724 sent along with the Accept/Reject indication, or the absence of such
725 an encapsulated EAP packet.
730 Aboba, et al. Standards Track [Page 13]
732 RFC 3748 EAP June 2004
735 2.4. Peer-to-Peer Operation
737 Since EAP is a peer-to-peer protocol, an independent and simultaneous
738 authentication may take place in the reverse direction (depending on
739 the capabilities of the lower layer). Both ends of the link may act
740 as authenticators and peers at the same time. In this case, it is
741 necessary for both ends to implement EAP authenticator and peer
742 layers. In addition, the EAP method implementations on both peers
743 must support both authenticator and peer functionality.
745 Although EAP supports peer-to-peer operation, some EAP
746 implementations, methods, AAA protocols, and link layers may not
747 support this. Some EAP methods may support asymmetric
748 authentication, with one type of credential being required for the
749 peer and another type for the authenticator. Hosts supporting peer-
750 to-peer operation with such a method would need to be provisioned
751 with both types of credentials.
753 For example, EAP-TLS [RFC2716] is a client-server protocol in which
754 distinct certificate profiles are typically utilized for the client
755 and server. This implies that a host supporting peer-to-peer
756 authentication with EAP-TLS would need to implement both the EAP peer
757 and authenticator layers, support both peer and authenticator roles
758 in the EAP-TLS implementation, and provision certificates appropriate
761 AAA protocols such as RADIUS/EAP [RFC3579] and Diameter EAP [DIAM-
762 EAP] only support "pass-through authenticator" operation. As noted
763 in [RFC3579] Section 2.6.2, a RADIUS server responds to an Access-
764 Request encapsulating an EAP-Request, Success, or Failure packet with
765 an Access-Reject. There is therefore no support for "pass-through
768 Even where a method is used which supports mutual authentication and
769 result indications, several considerations may dictate that two EAP
770 authentications (one in each direction) are required. These include:
772 [1] Support for bi-directional session key derivation in the lower
773 layer. Lower layers such as IEEE 802.11 may only support uni-
774 directional derivation and transport of transient session keys.
775 For example, the group-key handshake defined in [IEEE-802.11i] is
776 uni-directional, since in IEEE 802.11 infrastructure mode, only
777 the Access Point (AP) sends multicast/broadcast traffic. In IEEE
778 802.11 ad hoc mode, where either peer may send
779 multicast/broadcast traffic, two uni-directional group-key
786 Aboba, et al. Standards Track [Page 14]
788 RFC 3748 EAP June 2004
791 exchanges are required. Due to limitations of the design, this
792 also implies the need for unicast key derivations and EAP method
793 exchanges to occur in each direction.
795 [2] Support for tie-breaking in the lower layer. Lower layers such
796 as IEEE 802.11 ad hoc do not support "tie breaking" wherein two
797 hosts initiating authentication with each other will only go
798 forward with a single authentication. This implies that even if
799 802.11 were to support a bi-directional group-key handshake, then
800 two authentications, one in each direction, might still occur.
802 [3] Peer policy satisfaction. EAP methods may support result
803 indications, enabling the peer to indicate to the EAP server
804 within the method that it successfully authenticated the EAP
805 server, as well as for the server to indicate that it has
806 authenticated the peer. However, a pass-through authenticator
807 will not be aware that the peer has accepted the credentials
808 offered by the EAP server, unless this information is provided to
809 the authenticator via the AAA protocol. The authenticator SHOULD
810 interpret the receipt of a key attribute within an Accept packet
811 as an indication that the peer has successfully authenticated the
814 However, it is possible that the EAP peer's access policy was not
815 satisfied during the initial EAP exchange, even though mutual
816 authentication occurred. For example, the EAP authenticator may not
817 have demonstrated authorization to act in both peer and authenticator
818 roles. As a result, the peer may require an additional
819 authentication in the reverse direction, even if the peer provided an
820 indication that the EAP server had successfully authenticated to it.
822 3. Lower Layer Behavior
824 3.1. Lower Layer Requirements
826 EAP makes the following assumptions about lower layers:
828 [1] Unreliable transport. In EAP, the authenticator retransmits
829 Requests that have not yet received Responses so that EAP does
830 not assume that lower layers are reliable. Since EAP defines its
831 own retransmission behavior, it is possible (though undesirable)
832 for retransmission to occur both in the lower layer and the EAP
833 layer when EAP is run over a reliable lower layer.
842 Aboba, et al. Standards Track [Page 15]
844 RFC 3748 EAP June 2004
847 Note that EAP Success and Failure packets are not retransmitted.
848 Without a reliable lower layer, and with a non-negligible error rate,
849 these packets can be lost, resulting in timeouts. It is therefore
850 desirable for implementations to improve their resilience to loss of
851 EAP Success or Failure packets, as described in Section 4.2.
853 [2] Lower layer error detection. While EAP does not assume that the
854 lower layer is reliable, it does rely on lower layer error
855 detection (e.g., CRC, Checksum, MIC, etc.). EAP methods may not
856 include a MIC, or if they do, it may not be computed over all the
857 fields in the EAP packet, such as the Code, Identifier, Length,
858 or Type fields. As a result, without lower layer error
859 detection, undetected errors could creep into the EAP layer or
860 EAP method layer header fields, resulting in authentication
863 For example, EAP TLS [RFC2716], which computes its MIC over the
864 Type-Data field only, regards MIC validation failures as a fatal
865 error. Without lower layer error detection, this method, and
866 others like it, will not perform reliably.
868 [3] Lower layer security. EAP does not require lower layers to
869 provide security services such as per-packet confidentiality,
870 authentication, integrity, and replay protection. However, where
871 these security services are available, EAP methods supporting Key
872 Derivation (see Section 7.2.1) can be used to provide dynamic
873 keying material. This makes it possible to bind the EAP
874 authentication to subsequent data and protect against data
875 modification, spoofing, or replay. See Section 7.1 for details.
877 [4] Minimum MTU. EAP is capable of functioning on lower layers that
878 provide an EAP MTU size of 1020 octets or greater.
880 EAP does not support path MTU discovery, and fragmentation and
881 reassembly is not supported by EAP, nor by the methods defined in
882 this specification: Identity (1), Notification (2), Nak Response
883 (3), MD5-Challenge (4), One Time Password (5), Generic Token Card
884 (6), and expanded Nak Response (254) Types.
886 Typically, the EAP peer obtains information on the EAP MTU from
887 the lower layers and sets the EAP frame size to an appropriate
888 value. Where the authenticator operates in pass-through mode,
889 the authentication server does not have a direct way of
890 determining the EAP MTU, and therefore relies on the
891 authenticator to provide it with this information, such as via
892 the Framed-MTU attribute, as described in [RFC3579], Section 2.4.
898 Aboba, et al. Standards Track [Page 16]
900 RFC 3748 EAP June 2004
903 While methods such as EAP-TLS [RFC2716] support fragmentation and
904 reassembly, EAP methods originally designed for use within PPP
905 where a 1500 octet MTU is guaranteed for control frames (see
906 [RFC1661], Section 6.1) may lack fragmentation and reassembly
909 EAP methods can assume a minimum EAP MTU of 1020 octets in the
910 absence of other information. EAP methods SHOULD include support
911 for fragmentation and reassembly if their payloads can be larger
912 than this minimum EAP MTU.
914 EAP is a lock-step protocol, which implies a certain inefficiency
915 when handling fragmentation and reassembly. Therefore, if the
916 lower layer supports fragmentation and reassembly (such as where
917 EAP is transported over IP), it may be preferable for
918 fragmentation and reassembly to occur in the lower layer rather
919 than in EAP. This can be accomplished by providing an
920 artificially large EAP MTU to EAP, causing fragmentation and
921 reassembly to be handled within the lower layer.
923 [5] Possible duplication. Where the lower layer is reliable, it will
924 provide the EAP layer with a non-duplicated stream of packets.
925 However, while it is desirable that lower layers provide for
926 non-duplication, this is not a requirement. The Identifier field
927 provides both the peer and authenticator with the ability to
930 [6] Ordering guarantees. EAP does not require the Identifier to be
931 monotonically increasing, and so is reliant on lower layer
932 ordering guarantees for correct operation. EAP was originally
933 defined to run on PPP, and [RFC1661] Section 1 has an ordering
936 "The Point-to-Point Protocol is designed for simple links
937 which transport packets between two peers. These links
938 provide full-duplex simultaneous bi-directional operation,
939 and are assumed to deliver packets in order."
941 Lower layer transports for EAP MUST preserve ordering between a
942 source and destination at a given priority level (the ordering
943 guarantee provided by [IEEE-802]).
945 Reordering, if it occurs, will typically result in an EAP
946 authentication failure, causing EAP authentication to be re-run.
947 In an environment in which reordering is likely, it is therefore
948 expected that EAP authentication failures will be common. It is
949 RECOMMENDED that EAP only be run over lower layers that provide
950 ordering guarantees; running EAP over raw IP or UDP transport is
954 Aboba, et al. Standards Track [Page 17]
956 RFC 3748 EAP June 2004
959 NOT RECOMMENDED. Encapsulation of EAP within RADIUS [RFC3579]
960 satisfies ordering requirements, since RADIUS is a "lockstep"
961 protocol that delivers packets in order.
963 3.2. EAP Usage Within PPP
965 In order to establish communications over a point-to-point link, each
966 end of the PPP link first sends LCP packets to configure the data
967 link during the Link Establishment phase. After the link has been
968 established, PPP provides for an optional Authentication phase before
969 proceeding to the Network-Layer Protocol phase.
971 By default, authentication is not mandatory. If authentication of
972 the link is desired, an implementation MUST specify the
973 Authentication Protocol Configuration Option during the Link
976 If the identity of the peer has been established in the
977 Authentication phase, the server can use that identity in the
978 selection of options for the following network layer negotiations.
980 When implemented within PPP, EAP does not select a specific
981 authentication mechanism at the PPP Link Control Phase, but rather
982 postpones this until the Authentication Phase. This allows the
983 authenticator to request more information before determining the
984 specific authentication mechanism. This also permits the use of a
985 "backend" server which actually implements the various mechanisms
986 while the PPP authenticator merely passes through the authentication
987 exchange. The PPP Link Establishment and Authentication phases, and
988 the Authentication Protocol Configuration Option, are defined in The
989 Point-to-Point Protocol (PPP) [RFC1661].
991 3.2.1. PPP Configuration Option Format
993 A summary of the PPP Authentication Protocol Configuration Option
994 format to negotiate EAP follows. The fields are transmitted from
997 Exactly one EAP packet is encapsulated in the Information field of a
998 PPP Data Link Layer frame where the protocol field indicates type hex
1010 Aboba, et al. Standards Track [Page 18]
1012 RFC 3748 EAP June 2004
1016 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1017 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1018 | Type | Length | Authentication Protocol |
1019 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1029 Authentication Protocol
1031 C227 (Hex) for Extensible Authentication Protocol (EAP)
1033 3.3. EAP Usage Within IEEE 802
1035 The encapsulation of EAP over IEEE 802 is defined in [IEEE-802.1X].
1036 The IEEE 802 encapsulation of EAP does not involve PPP, and IEEE
1037 802.1X does not include support for link or network layer
1038 negotiations. As a result, within IEEE 802.1X, it is not possible to
1039 negotiate non-EAP authentication mechanisms, such as PAP or CHAP
1042 3.4. Lower Layer Indications
1044 The reliability and security of lower layer indications is dependent
1045 on the lower layer. Since EAP is media independent, the presence or
1046 absence of lower layer security is not taken into account in the
1047 processing of EAP messages.
1049 To improve reliability, if a peer receives a lower layer success
1050 indication as defined in Section 7.2, it MAY conclude that a Success
1051 packet has been lost, and behave as if it had actually received a
1052 Success packet. This includes choosing to ignore the Success in some
1053 circumstances as described in Section 4.2.
1055 A discussion of some reliability and security issues with lower layer
1056 indications in PPP, IEEE 802 wired networks, and IEEE 802.11 wireless
1057 LANs can be found in the Security Considerations, Section 7.12.
1059 After EAP authentication is complete, the peer will typically
1060 transmit and receive data via the authenticator. It is desirable to
1061 provide assurance that the entities transmitting data are the same
1062 ones that successfully completed EAP authentication. To accomplish
1066 Aboba, et al. Standards Track [Page 19]
1068 RFC 3748 EAP June 2004
1071 this, it is necessary for the lower layer to provide per-packet
1072 integrity, authentication and replay protection, and to bind these
1073 per-packet services to the keys derived during EAP authentication.
1074 Otherwise, it is possible for subsequent data traffic to be modified,
1075 spoofed, or replayed.
1077 Where keying material for the lower layer ciphersuite is itself
1078 provided by EAP, ciphersuite negotiation and key activation are
1079 controlled by the lower layer. In PPP, ciphersuites are negotiated
1080 within ECP so that it is not possible to use keys derived from EAP
1081 authentication until the completion of ECP. Therefore, an initial
1082 EAP exchange cannot be protected by a PPP ciphersuite, although EAP
1083 re-authentication can be protected.
1085 In IEEE 802 media, initial key activation also typically occurs after
1086 completion of EAP authentication. Therefore an initial EAP exchange
1087 typically cannot be protected by the lower layer ciphersuite,
1088 although an EAP re-authentication or pre-authentication exchange can
1091 4. EAP Packet Format
1093 A summary of the EAP packet format is shown below. The fields are
1094 transmitted from left to right.
1097 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1098 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1099 | Code | Identifier | Length |
1100 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1106 The Code field is one octet and identifies the Type of EAP packet.
1107 EAP Codes are assigned as follows:
1114 Since EAP only defines Codes 1-4, EAP packets with other codes
1115 MUST be silently discarded by both authenticators and peers.
1122 Aboba, et al. Standards Track [Page 20]
1124 RFC 3748 EAP June 2004
1129 The Identifier field is one octet and aids in matching Responses
1134 The Length field is two octets and indicates the length, in
1135 octets, of the EAP packet including the Code, Identifier, Length,
1136 and Data fields. Octets outside the range of the Length field
1137 should be treated as Data Link Layer padding and MUST be ignored
1138 upon reception. A message with the Length field set to a value
1139 larger than the number of received octets MUST be silently
1144 The Data field is zero or more octets. The format of the Data
1145 field is determined by the Code field.
1147 4.1. Request and Response
1151 The Request packet (Code field set to 1) is sent by the
1152 authenticator to the peer. Each Request has a Type field which
1153 serves to indicate what is being requested. Additional Request
1154 packets MUST be sent until a valid Response packet is received, an
1155 optional retry counter expires, or a lower layer failure
1156 indication is received.
1158 Retransmitted Requests MUST be sent with the same Identifier value
1159 in order to distinguish them from new Requests. The content of
1160 the data field is dependent on the Request Type. The peer MUST
1161 send a Response packet in reply to a valid Request packet.
1162 Responses MUST only be sent in reply to a valid Request and never
1163 be retransmitted on a timer.
1165 If a peer receives a valid duplicate Request for which it has
1166 already sent a Response, it MUST resend its original Response
1167 without reprocessing the Request. Requests MUST be processed in
1168 the order that they are received, and MUST be processed to their
1169 completion before inspecting the next Request.
1171 A summary of the Request and Response packet format follows. The
1172 fields are transmitted from left to right.
1178 Aboba, et al. Standards Track [Page 21]
1180 RFC 3748 EAP June 2004
1184 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1185 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1186 | Code | Identifier | Length |
1187 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1188 | Type | Type-Data ...
1189 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
1198 The Identifier field is one octet. The Identifier field MUST be
1199 the same if a Request packet is retransmitted due to a timeout
1200 while waiting for a Response. Any new (non-retransmission)
1201 Requests MUST modify the Identifier field.
1203 The Identifier field of the Response MUST match that of the
1204 currently outstanding Request. An authenticator receiving a
1205 Response whose Identifier value does not match that of the
1206 currently outstanding Request MUST silently discard the Response.
1208 In order to avoid confusion between new Requests and
1209 retransmissions, the Identifier value chosen for each new Request
1210 need only be different from the previous Request, but need not be
1211 unique within the conversation. One way to achieve this is to
1212 start the Identifier at an initial value and increment it for each
1213 new Request. Initializing the first Identifier with a random
1214 number rather than starting from zero is recommended, since it
1215 makes sequence attacks somewhat more difficult.
1217 Since the Identifier space is unique to each session,
1218 authenticators are not restricted to only 256 simultaneous
1219 authentication conversations. Similarly, with re-authentication,
1220 an EAP conversation might continue over a long period of time, and
1221 is not limited to only 256 roundtrips.
1223 Implementation Note: The authenticator is responsible for
1224 retransmitting Request messages. If the Request message is obtained
1225 from elsewhere (such as from a backend authentication server), then
1226 the authenticator will need to save a copy of the Request in order to
1227 accomplish this. The peer is responsible for detecting and handling
1228 duplicate Request messages before processing them in any way,
1229 including passing them on to an outside party. The authenticator is
1230 also responsible for discarding Response messages with a non-matching
1234 Aboba, et al. Standards Track [Page 22]
1236 RFC 3748 EAP June 2004
1239 Identifier value before acting on them in any way, including passing
1240 them on to the backend authentication server for verification. Since
1241 the authenticator can retransmit before receiving a Response from the
1242 peer, the authenticator can receive multiple Responses, each with a
1243 matching Identifier. Until a new Request is received by the
1244 authenticator, the Identifier value is not updated, so that the
1245 authenticator forwards Responses to the backend authentication
1246 server, one at a time.
1250 The Length field is two octets and indicates the length of the EAP
1251 packet including the Code, Identifier, Length, Type, and Type-Data
1252 fields. Octets outside the range of the Length field should be
1253 treated as Data Link Layer padding and MUST be ignored upon
1254 reception. A message with the Length field set to a value larger
1255 than the number of received octets MUST be silently discarded.
1259 The Type field is one octet. This field indicates the Type of
1260 Request or Response. A single Type MUST be specified for each EAP
1261 Request or Response. An initial specification of Types follows in
1262 Section 5 of this document.
1264 The Type field of a Response MUST either match that of the
1265 Request, or correspond to a legacy or Expanded Nak (see Section
1266 5.3) indicating that a Request Type is unacceptable to the peer.
1267 A peer MUST NOT send a Nak (legacy or expanded) in response to a
1268 Request, after an initial non-Nak Response has been sent. An EAP
1269 server receiving a Response not meeting these requirements MUST
1270 silently discard it.
1274 The Type-Data field varies with the Type of Request and the
1275 associated Response.
1277 4.2. Success and Failure
1279 The Success packet is sent by the authenticator to the peer after
1280 completion of an EAP authentication method (Type 4 or greater) to
1281 indicate that the peer has authenticated successfully to the
1282 authenticator. The authenticator MUST transmit an EAP packet with
1283 the Code field set to 3 (Success). If the authenticator cannot
1284 authenticate the peer (unacceptable Responses to one or more
1285 Requests), then after unsuccessful completion of the EAP method in
1286 progress, the implementation MUST transmit an EAP packet with the
1290 Aboba, et al. Standards Track [Page 23]
1292 RFC 3748 EAP June 2004
1295 Code field set to 4 (Failure). An authenticator MAY wish to issue
1296 multiple Requests before sending a Failure response in order to allow
1297 for human typing mistakes. Success and Failure packets MUST NOT
1298 contain additional data.
1300 Success and Failure packets MUST NOT be sent by an EAP authenticator
1301 if the specification of the given method does not explicitly permit
1302 the method to finish at that point. A peer EAP implementation
1303 receiving a Success or Failure packet where sending one is not
1304 explicitly permitted MUST silently discard it. By default, an EAP
1305 peer MUST silently discard a "canned" Success packet (a Success
1306 packet sent immediately upon connection). This ensures that a rogue
1307 authenticator will not be able to bypass mutual authentication by
1308 sending a Success packet prior to conclusion of the EAP method
1311 Implementation Note: Because the Success and Failure packets are not
1312 acknowledged, they are not retransmitted by the authenticator, and
1313 may be potentially lost. A peer MUST allow for this circumstance as
1314 described in this note. See also Section 3.4 for guidance on the
1315 processing of lower layer success and failure indications.
1317 As described in Section 2.1, only a single EAP authentication method
1318 is allowed within an EAP conversation. EAP methods may implement
1319 result indications. After the authenticator sends a failure result
1320 indication to the peer, regardless of the response from the peer, it
1321 MUST subsequently send a Failure packet. After the authenticator
1322 sends a success result indication to the peer and receives a success
1323 result indication from the peer, it MUST subsequently send a Success
1326 On the peer, once the method completes unsuccessfully (that is,
1327 either the authenticator sends a failure result indication, or the
1328 peer decides that it does not want to continue the conversation,
1329 possibly after sending a failure result indication), the peer MUST
1330 terminate the conversation and indicate failure to the lower layer.
1331 The peer MUST silently discard Success packets and MAY silently
1332 discard Failure packets. As a result, loss of a Failure packet need
1333 not result in a timeout.
1335 On the peer, after success result indications have been exchanged by
1336 both sides, a Failure packet MUST be silently discarded. The peer
1337 MAY, in the event that an EAP Success is not received, conclude that
1338 the EAP Success packet was lost and that authentication concluded
1346 Aboba, et al. Standards Track [Page 24]
1348 RFC 3748 EAP June 2004
1351 If the authenticator has not sent a result indication, and the peer
1352 is willing to continue the conversation, the peer waits for a Success
1353 or Failure packet once the method completes, and MUST NOT silently
1354 discard either of them. In the event that neither a Success nor
1355 Failure packet is received, the peer SHOULD terminate the
1356 conversation to avoid lengthy timeouts in case the lost packet was an
1359 If the peer attempts to authenticate to the authenticator and fails
1360 to do so, the authenticator MUST send a Failure packet and MUST NOT
1361 grant access by sending a Success packet. However, an authenticator
1362 MAY omit having the peer authenticate to it in situations where
1363 limited access is offered (e.g., guest access). In this case, the
1364 authenticator MUST send a Success packet.
1366 Where the peer authenticates successfully to the authenticator, but
1367 the authenticator does not send a result indication, the
1368 authenticator MAY deny access by sending a Failure packet where the
1369 peer is not currently authorized for network access.
1371 A summary of the Success and Failure packet format is shown below.
1372 The fields are transmitted from left to right.
1375 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1376 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1377 | Code | Identifier | Length |
1378 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1387 The Identifier field is one octet and aids in matching replies to
1388 Responses. The Identifier field MUST match the Identifier field
1389 of the Response packet that it is sent in response to.
1402 Aboba, et al. Standards Track [Page 25]
1404 RFC 3748 EAP June 2004
1407 4.3. Retransmission Behavior
1409 Because the authentication process will often involve user input,
1410 some care must be taken when deciding upon retransmission strategies
1411 and authentication timeouts. By default, where EAP is run over an
1412 unreliable lower layer, the EAP retransmission timer SHOULD be
1413 dynamically estimated. A maximum of 3-5 retransmissions is
1416 When run over a reliable lower layer (e.g., EAP over ISAKMP/TCP, as
1417 within [PIC]), the authenticator retransmission timer SHOULD be set
1418 to an infinite value, so that retransmissions do not occur at the EAP
1419 layer. The peer may still maintain a timeout value so as to avoid
1420 waiting indefinitely for a Request.
1422 Where the authentication process requires user input, the measured
1423 round trip times may be determined by user responsiveness rather than
1424 network characteristics, so that dynamic RTO estimation may not be
1425 helpful. Instead, the retransmission timer SHOULD be set so as to
1426 provide sufficient time for the user to respond, with longer timeouts
1427 required in certain cases, such as where Token Cards (see Section
1430 In order to provide the EAP authenticator with guidance as to the
1431 appropriate timeout value, a hint can be communicated to the
1432 authenticator by the backend authentication server (such as via the
1433 RADIUS Session-Timeout attribute).
1435 In order to dynamically estimate the EAP retransmission timer, the
1436 algorithms for the estimation of SRTT, RTTVAR, and RTO described in
1437 [RFC2988] are RECOMMENDED, including use of Karn's algorithm, with
1438 the following potential modifications:
1440 [a] In order to avoid synchronization behaviors that can occur with
1441 fixed timers among distributed systems, the retransmission timer
1442 is calculated with a jitter by using the RTO value and randomly
1443 adding a value drawn between -RTOmin/2 and RTOmin/2. Alternative
1444 calculations to create jitter MAY be used. These MUST be
1445 pseudo-random. For a discussion of pseudo-random number
1446 generation, see [RFC1750].
1448 [b] When EAP is transported over a single link (as opposed to over
1449 the Internet), smaller values of RTOinitial, RTOmin, and RTOmax
1450 MAY be used. Recommended values are RTOinitial=1 second,
1451 RTOmin=200ms, and RTOmax=20 seconds.
1458 Aboba, et al. Standards Track [Page 26]
1460 RFC 3748 EAP June 2004
1463 [c] When EAP is transported over a single link (as opposed to over
1464 the Internet), estimates MAY be done on a per-authenticator
1465 basis, rather than a per-session basis. This enables the
1466 retransmission estimate to make the most use of information on
1467 link-layer behavior.
1469 [d] An EAP implementation MAY clear SRTT and RTTVAR after backing off
1470 the timer multiple times, as it is likely that the current SRTT
1471 and RTTVAR are bogus in this situation. Once SRTT and RTTVAR are
1472 cleared, they should be initialized with the next RTT sample
1473 taken as described in [RFC2988] equation 2.2.
1475 5. Initial EAP Request/Response Types
1477 This section defines the initial set of EAP Types used in Request/
1478 Response exchanges. More Types may be defined in future documents.
1479 The Type field is one octet and identifies the structure of an EAP
1480 Request or Response packet. The first 3 Types are considered special
1483 The remaining Types define authentication exchanges. Nak (Type 3) or
1484 Expanded Nak (Type 254) are valid only for Response packets, they
1485 MUST NOT be sent in a Request.
1487 All EAP implementations MUST support Types 1-4, which are defined in
1488 this document, and SHOULD support Type 254. Implementations MAY
1489 support other Types defined here or in future RFCs.
1493 3 Nak (Response only)
1495 5 One Time Password (OTP)
1496 6 Generic Token Card (GTC)
1498 255 Experimental use
1500 EAP methods MAY support authentication based on shared secrets. If
1501 the shared secret is a passphrase entered by the user,
1502 implementations MAY support entering passphrases with non-ASCII
1503 characters. In this case, the input should be processed using an
1504 appropriate stringprep [RFC3454] profile, and encoded in octets using
1505 UTF-8 encoding [RFC2279]. A preliminary version of a possible
1506 stringprep profile is described in [SASLPREP].
1514 Aboba, et al. Standards Track [Page 27]
1516 RFC 3748 EAP June 2004
1523 The Identity Type is used to query the identity of the peer.
1524 Generally, the authenticator will issue this as the initial
1525 Request. An optional displayable message MAY be included to
1526 prompt the peer in the case where there is an expectation of
1527 interaction with a user. A Response of Type 1 (Identity) SHOULD
1528 be sent in Response to a Request with a Type of 1 (Identity).
1530 Some EAP implementations piggy-back various options into the
1531 Identity Request after a NUL-character. By default, an EAP
1532 implementation SHOULD NOT assume that an Identity Request or
1533 Response can be larger than 1020 octets.
1535 It is RECOMMENDED that the Identity Response be used primarily for
1536 routing purposes and selecting which EAP method to use. EAP
1537 Methods SHOULD include a method-specific mechanism for obtaining
1538 the identity, so that they do not have to rely on the Identity
1539 Response. Identity Requests and Responses are sent in cleartext,
1540 so an attacker may snoop on the identity, or even modify or spoof
1541 identity exchanges. To address these threats, it is preferable
1542 for an EAP method to include an identity exchange that supports
1543 per-packet authentication, integrity and replay protection, and
1544 confidentiality. The Identity Response may not be the appropriate
1545 identity for the method; it may have been truncated or obfuscated
1546 so as to provide privacy, or it may have been decorated for
1547 routing purposes. Where the peer is configured to only accept
1548 authentication methods supporting protected identity exchanges,
1549 the peer MAY provide an abbreviated Identity Response (such as
1550 omitting the peer-name portion of the NAI [RFC2486]). For further
1551 discussion of identity protection, see Section 7.3.
1553 Implementation Note: The peer MAY obtain the Identity via user input.
1554 It is suggested that the authenticator retry the Identity Request in
1555 the case of an invalid Identity or authentication failure to allow
1556 for potential typos on the part of the user. It is suggested that
1557 the Identity Request be retried a minimum of 3 times before
1558 terminating the authentication. The Notification Request MAY be used
1559 to indicate an invalid authentication attempt prior to transmitting a
1560 new Identity Request (optionally, the failure MAY be indicated within
1561 the message of the new Identity Request itself).
1570 Aboba, et al. Standards Track [Page 28]
1572 RFC 3748 EAP June 2004
1581 This field MAY contain a displayable message in the Request,
1582 containing UTF-8 encoded ISO 10646 characters [RFC2279]. Where
1583 the Request contains a null, only the portion of the field prior
1584 to the null is displayed. If the Identity is unknown, the
1585 Identity Response field should be zero bytes in length. The
1586 Identity Response field MUST NOT be null terminated. In all
1587 cases, the length of the Type-Data field is derived from the
1588 Length field of the Request/Response packet.
1590 Security Claims (see Section 7.2):
1592 Auth. mechanism: None
1593 Ciphersuite negotiation: No
1594 Mutual authentication: No
1595 Integrity protection: No
1596 Replay protection: No
1600 Dictionary attack prot.: N/A
1603 Session independence: N/A
1611 The Notification Type is optionally used to convey a displayable
1612 message from the authenticator to the peer. An authenticator MAY
1613 send a Notification Request to the peer at any time when there is
1614 no outstanding Request, prior to completion of an EAP
1615 authentication method. The peer MUST respond to a Notification
1616 Request with a Notification Response unless the EAP authentication
1617 method specification prohibits the use of Notification messages.
1618 In any case, a Nak Response MUST NOT be sent in response to a
1619 Notification Request. Note that the default maximum length of a
1620 Notification Request is 1020 octets. By default, this leaves at
1621 most 1015 octets for the human readable message.
1626 Aboba, et al. Standards Track [Page 29]
1628 RFC 3748 EAP June 2004
1631 An EAP method MAY indicate within its specification that
1632 Notification messages must not be sent during that method. In
1633 this case, the peer MUST silently discard Notification Requests
1634 from the point where an initial Request for that Type is answered
1635 with a Response of the same Type.
1637 The peer SHOULD display this message to the user or log it if it
1638 cannot be displayed. The Notification Type is intended to provide
1639 an acknowledged notification of some imperative nature, but it is
1640 not an error indication, and therefore does not change the state
1641 of the peer. Examples include a password with an expiration time
1642 that is about to expire, an OTP sequence integer which is nearing
1643 0, an authentication failure warning, etc. In most circumstances,
1644 Notification should not be required.
1652 The Type-Data field in the Request contains a displayable message
1653 greater than zero octets in length, containing UTF-8 encoded ISO
1654 10646 characters [RFC2279]. The length of the message is
1655 determined by the Length field of the Request packet. The message
1656 MUST NOT be null terminated. A Response MUST be sent in reply to
1657 the Request with a Type field of 2 (Notification). The Type-Data
1658 field of the Response is zero octets in length. The Response
1659 should be sent immediately (independent of how the message is
1660 displayed or logged).
1662 Security Claims (see Section 7.2):
1664 Auth. mechanism: None
1665 Ciphersuite negotiation: No
1666 Mutual authentication: No
1667 Integrity protection: No
1668 Replay protection: No
1672 Dictionary attack prot.: N/A
1675 Session independence: N/A
1682 Aboba, et al. Standards Track [Page 30]
1684 RFC 3748 EAP June 2004
1693 The legacy Nak Type is valid only in Response messages. It is
1694 sent in reply to a Request where the desired authentication Type
1695 is unacceptable. Authentication Types are numbered 4 and above.
1696 The Response contains one or more authentication Types desired by
1697 the Peer. Type zero (0) is used to indicate that the sender has
1698 no viable alternatives, and therefore the authenticator SHOULD NOT
1699 send another Request after receiving a Nak Response containing a
1702 Since the legacy Nak Type is valid only in Responses and has very
1703 limited functionality, it MUST NOT be used as a general purpose
1704 error indication, such as for communication of error messages, or
1705 negotiation of parameters specific to a particular EAP method.
1713 The Identifier field is one octet and aids in matching Responses
1714 with Requests. The Identifier field of a legacy Nak Response MUST
1715 match the Identifier field of the Request packet that it is sent
1728 Where a peer receives a Request for an unacceptable authentication
1729 Type (4-253,255), or a peer lacking support for Expanded Types
1730 receives a Request for Type 254, a Nak Response (Type 3) MUST be
1731 sent. The Type-Data field of the Nak Response (Type 3) MUST
1732 contain one or more octets indicating the desired authentication
1733 Type(s), one octet per Type, or the value zero (0) to indicate no
1734 proposed alternative. A peer supporting Expanded Types that
1738 Aboba, et al. Standards Track [Page 31]
1740 RFC 3748 EAP June 2004
1743 receives a Request for an unacceptable authentication Type (4-253,
1744 255) MAY include the value 254 in the Nak Response (Type 3) to
1745 indicate the desire for an Expanded authentication Type. If the
1746 authenticator can accommodate this preference, it will respond
1747 with an Expanded Type Request (Type 254).
1749 Security Claims (see Section 7.2):
1751 Auth. mechanism: None
1752 Ciphersuite negotiation: No
1753 Mutual authentication: No
1754 Integrity protection: No
1755 Replay protection: No
1759 Dictionary attack prot.: N/A
1762 Session independence: N/A
1771 The Expanded Nak Type is valid only in Response messages. It MUST
1772 be sent only in reply to a Request of Type 254 (Expanded Type)
1773 where the authentication Type is unacceptable. The Expanded Nak
1774 Type uses the Expanded Type format itself, and the Response
1775 contains one or more authentication Types desired by the peer, all
1776 in Expanded Type format. Type zero (0) is used to indicate that
1777 the sender has no viable alternatives. The general format of the
1778 Expanded Type is described in Section 5.7.
1780 Since the Expanded Nak Type is valid only in Responses and has
1781 very limited functionality, it MUST NOT be used as a general
1782 purpose error indication, such as for communication of error
1783 messages, or negotiation of parameters specific to a particular
1794 Aboba, et al. Standards Track [Page 32]
1796 RFC 3748 EAP June 2004
1801 The Identifier field is one octet and aids in matching Responses
1802 with Requests. The Identifier field of an Expanded Nak Response
1803 MUST match the Identifier field of the Request packet that it is
1804 sent in response to.
1824 The Expanded Nak Type is only sent when the Request contains an
1825 Expanded Type (254) as defined in Section 5.7. The Vendor-Data
1826 field of the Nak Response MUST contain one or more authentication
1827 Types (4 or greater), all in expanded format, 8 octets per Type,
1828 or the value zero (0), also in Expanded Type format, to indicate
1829 no proposed alternative. The desired authentication Types may
1830 include a mixture of Vendor-Specific and IETF Types. For example,
1831 an Expanded Nak Response indicating a preference for OTP (Type 5),
1832 and an MIT (Vendor-Id=20) Expanded Type of 6 would appear as
1850 Aboba, et al. Standards Track [Page 33]
1852 RFC 3748 EAP June 2004
1856 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1857 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1858 | 2 | Identifier | Length=28 |
1859 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1860 | Type=254 | 0 (IETF) |
1861 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1863 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1864 | Type=254 | 0 (IETF) |
1865 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1867 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1868 | Type=254 | 20 (MIT) |
1869 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1871 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1873 An Expanded Nak Response indicating a no desired alternative would
1877 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1878 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1879 | 2 | Identifier | Length=20 |
1880 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1881 | Type=254 | 0 (IETF) |
1882 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1884 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1885 | Type=254 | 0 (IETF) |
1886 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1887 | 0 (No alternative) |
1888 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1890 Security Claims (see Section 7.2):
1892 Auth. mechanism: None
1893 Ciphersuite negotiation: No
1894 Mutual authentication: No
1895 Integrity protection: No
1896 Replay protection: No
1900 Dictionary attack prot.: N/A
1906 Aboba, et al. Standards Track [Page 34]
1908 RFC 3748 EAP June 2004
1911 Session independence: N/A
1920 The MD5-Challenge Type is analogous to the PPP CHAP protocol
1921 [RFC1994] (with MD5 as the specified algorithm). The Request
1922 contains a "challenge" message to the peer. A Response MUST be
1923 sent in reply to the Request. The Response MAY be either of Type
1924 4 (MD5-Challenge), Nak (Type 3), or Expanded Nak (Type 254). The
1925 Nak reply indicates the peer's desired authentication Type(s).
1926 EAP peer and EAP server implementations MUST support the MD5-
1927 Challenge mechanism. An authenticator that supports only pass-
1928 through MUST allow communication with a backend authentication
1929 server that is capable of supporting MD5-Challenge, although the
1930 EAP authenticator implementation need not support MD5-Challenge
1931 itself. However, if the EAP authenticator can be configured to
1932 authenticate peers locally (e.g., not operate in pass-through),
1933 then the requirement for support of the MD5-Challenge mechanism
1936 Note that the use of the Identifier field in the MD5-Challenge
1937 Type is different from that described in [RFC1994]. EAP allows
1938 for retransmission of MD5-Challenge Request packets, while
1939 [RFC1994] states that both the Identifier and Challenge fields
1940 MUST change each time a Challenge (the CHAP equivalent of the
1941 MD5-Challenge Request packet) is sent.
1943 Note: [RFC1994] treats the shared secret as an octet string, and
1944 does not specify how it is entered into the system (or if it is
1945 handled by the user at all). EAP MD5-Challenge implementations
1946 MAY support entering passphrases with non-ASCII characters. See
1947 Section 5 for instructions how the input should be processed and
1948 encoded into octets.
1956 The contents of the Type-Data field is summarized below. For
1957 reference on the use of these fields, see the PPP Challenge
1958 Handshake Authentication Protocol [RFC1994].
1962 Aboba, et al. Standards Track [Page 35]
1964 RFC 3748 EAP June 2004
1968 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1969 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1970 | Value-Size | Value ...
1971 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1973 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1975 Security Claims (see Section 7.2):
1977 Auth. mechanism: Password or pre-shared key.
1978 Ciphersuite negotiation: No
1979 Mutual authentication: No
1980 Integrity protection: No
1981 Replay protection: No
1985 Dictionary attack prot.: No
1988 Session independence: N/A
1992 5.5. One-Time Password (OTP)
1996 The One-Time Password system is defined in "A One-Time Password
1997 System" [RFC2289] and "OTP Extended Responses" [RFC2243]. The
1998 Request contains an OTP challenge in the format described in
1999 [RFC2289]. A Response MUST be sent in reply to the Request. The
2000 Response MUST be of Type 5 (OTP), Nak (Type 3), or Expanded Nak
2001 (Type 254). The Nak Response indicates the peer's desired
2002 authentication Type(s). The EAP OTP method is intended for use
2003 with the One-Time Password system only, and MUST NOT be used to
2004 provide support for cleartext passwords.
2018 Aboba, et al. Standards Track [Page 36]
2020 RFC 3748 EAP June 2004
2025 The Type-Data field contains the OTP "challenge" as a displayable
2026 message in the Request. In the Response, this field is used for
2027 the 6 words from the OTP dictionary [RFC2289]. The messages MUST
2028 NOT be null terminated. The length of the field is derived from
2029 the Length field of the Request/Reply packet.
2031 Note: [RFC2289] does not specify how the secret pass-phrase is
2032 entered by the user, or how the pass-phrase is converted into
2033 octets. EAP OTP implementations MAY support entering passphrases
2034 with non-ASCII characters. See Section 5 for instructions on how
2035 the input should be processed and encoded into octets.
2037 Security Claims (see Section 7.2):
2039 Auth. mechanism: One-Time Password
2040 Ciphersuite negotiation: No
2041 Mutual authentication: No
2042 Integrity protection: No
2043 Replay protection: Yes
2047 Dictionary attack prot.: No
2050 Session independence: N/A
2055 5.6. Generic Token Card (GTC)
2059 The Generic Token Card Type is defined for use with various Token
2060 Card implementations which require user input. The Request
2061 contains a displayable message and the Response contains the Token
2062 Card information necessary for authentication. Typically, this
2063 would be information read by a user from the Token card device and
2064 entered as ASCII text. A Response MUST be sent in reply to the
2065 Request. The Response MUST be of Type 6 (GTC), Nak (Type 3), or
2066 Expanded Nak (Type 254). The Nak Response indicates the peer's
2067 desired authentication Type(s). The EAP GTC method is intended
2068 for use with the Token Cards supporting challenge/response
2074 Aboba, et al. Standards Track [Page 37]
2076 RFC 3748 EAP June 2004
2079 authentication and MUST NOT be used to provide support for
2080 cleartext passwords in the absence of a protected tunnel with
2081 server authentication.
2089 The Type-Data field in the Request contains a displayable message
2090 greater than zero octets in length. The length of the message is
2091 determined by the Length field of the Request packet. The message
2092 MUST NOT be null terminated. A Response MUST be sent in reply to
2093 the Request with a Type field of 6 (Generic Token Card). The
2094 Response contains data from the Token Card required for
2095 authentication. The length of the data is determined by the
2096 Length field of the Response packet.
2098 EAP GTC implementations MAY support entering a response with non-
2099 ASCII characters. See Section 5 for instructions how the input
2100 should be processed and encoded into octets.
2102 Security Claims (see Section 7.2):
2104 Auth. mechanism: Hardware token.
2105 Ciphersuite negotiation: No
2106 Mutual authentication: No
2107 Integrity protection: No
2108 Replay protection: No
2112 Dictionary attack prot.: No
2115 Session independence: N/A
2124 Since many of the existing uses of EAP are vendor-specific, the
2125 Expanded method Type is available to allow vendors to support
2126 their own Expanded Types not suitable for general usage.
2130 Aboba, et al. Standards Track [Page 38]
2132 RFC 3748 EAP June 2004
2135 The Expanded Type is also used to expand the global Method Type
2136 space beyond the original 255 values. A Vendor-Id of 0 maps the
2137 original 255 possible Types onto a space of 2^32-1 possible Types.
2138 (Type 0 is only used in a Nak Response to indicate no acceptable
2141 An implementation that supports the Expanded attribute MUST treat
2142 EAP Types that are less than 256 equivalently, whether they appear
2143 as a single octet or as the 32-bit Vendor-Type within an Expanded
2144 Type where Vendor-Id is 0. Peers not equipped to interpret the
2145 Expanded Type MUST send a Nak as described in Section 5.3.1, and
2146 negotiate a more suitable authentication method.
2148 A summary of the Expanded Type format is shown below. The fields
2149 are transmitted from left to right.
2152 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
2153 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2154 | Type | Vendor-Id |
2155 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2157 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2159 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2163 254 for Expanded Type
2167 The Vendor-Id is 3 octets and represents the SMI Network
2168 Management Private Enterprise Code of the Vendor in network byte
2169 order, as allocated by IANA. A Vendor-Id of zero is reserved for
2170 use by the IETF in providing an expanded global EAP Type space.
2174 The Vendor-Type field is four octets and represents the vendor-
2175 specific method Type.
2177 If the Vendor-Id is zero, the Vendor-Type field is an extension
2178 and superset of the existing namespace for EAP Types. The first
2179 256 Types are reserved for compatibility with single-octet EAP
2180 Types that have already been assigned or may be assigned in the
2181 future. Thus, EAP Types from 0 through 255 are semantically
2182 identical, whether they appear as single octet EAP Types or as
2186 Aboba, et al. Standards Track [Page 39]
2188 RFC 3748 EAP June 2004
2191 Vendor-Types when Vendor-Id is zero. There is one exception to
2192 this rule: Expanded Nak and Legacy Nak packets share the same
2193 Type, but must be treated differently because they have a
2198 The Vendor-Data field is defined by the vendor. Where a Vendor-Id
2199 of zero is present, the Vendor-Data field will be used for
2200 transporting the contents of EAP methods of Types defined by the
2207 The Experimental Type has no fixed format or content. It is
2208 intended for use when experimenting with new EAP Types. This Type
2209 is intended for experimental and testing purposes. No guarantee
2210 is made for interoperability between peers using this Type, as
2211 outlined in [RFC3692].
2221 6. IANA Considerations
2223 This section provides guidance to the Internet Assigned Numbers
2224 Authority (IANA) regarding registration of values related to the EAP
2225 protocol, in accordance with BCP 26, [RFC2434].
2227 There are two name spaces in EAP that require registration: Packet
2228 Codes and method Types.
2230 EAP is not intended as a general-purpose protocol, and allocations
2231 SHOULD NOT be made for purposes unrelated to authentication.
2233 The following terms are used here with the meanings defined in BCP
2234 26: "name space", "assigned value", "registration".
2236 The following policies are used here with the meanings defined in BCP
2237 26: "Private Use", "First Come First Served", "Expert Review",
2238 "Specification Required", "IETF Consensus", "Standards Action".
2242 Aboba, et al. Standards Track [Page 40]
2244 RFC 3748 EAP June 2004
2247 For registration requests where a Designated Expert should be
2248 consulted, the responsible IESG area director should appoint the
2249 Designated Expert. The intention is that any allocation will be
2250 accompanied by a published RFC. But in order to allow for the
2251 allocation of values prior to the RFC being approved for publication,
2252 the Designated Expert can approve allocations once it seems clear
2253 that an RFC will be published. The Designated expert will post a
2254 request to the EAP WG mailing list (or a successor designated by the
2255 Area Director) for comment and review, including an Internet-Draft.
2256 Before a period of 30 days has passed, the Designated Expert will
2257 either approve or deny the registration request and publish a notice
2258 of the decision to the EAP WG mailing list or its successor, as well
2259 as informing IANA. A denial notice must be justified by an
2260 explanation, and in the cases where it is possible, concrete
2261 suggestions on how the request can be modified so as to become
2262 acceptable should be provided.
2266 Packet Codes have a range from 1 to 255, of which 1-4 have been
2267 allocated. Because a new Packet Code has considerable impact on
2268 interoperability, a new Packet Code requires Standards Action, and
2269 should be allocated starting at 5.
2273 The original EAP method Type space has a range from 1 to 255, and is
2274 the scarcest resource in EAP, and thus must be allocated with care.
2275 Method Types 1-45 have been allocated, with 20 available for re-use.
2276 Method Types 20 and 46-191 may be allocated on the advice of a
2277 Designated Expert, with Specification Required.
2279 Allocation of blocks of method Types (more than one for a given
2280 purpose) should require IETF Consensus. EAP Type Values 192-253 are
2281 reserved and allocation requires Standards Action.
2283 Method Type 254 is allocated for the Expanded Type. Where the
2284 Vendor-Id field is non-zero, the Expanded Type is used for functions
2285 specific only to one vendor's implementation of EAP, where no
2286 interoperability is deemed useful. When used with a Vendor-Id of
2287 zero, method Type 254 can also be used to provide for an expanded
2288 IETF method Type space. Method Type values 256-4294967295 may be
2289 allocated after Type values 1-191 have been allocated, on the advice
2290 of a Designated Expert, with Specification Required.
2292 Method Type 255 is allocated for Experimental use, such as testing of
2293 new EAP methods before a permanent Type is allocated.
2298 Aboba, et al. Standards Track [Page 41]
2300 RFC 3748 EAP June 2004
2303 7. Security Considerations
2305 This section defines a generic threat model as well as the EAP method
2306 security claims mitigating those threats.
2308 It is expected that the generic threat model and corresponding
2309 security claims will used to define EAP method requirements for use
2310 in specific environments. An example of such a requirements analysis
2311 is provided in [IEEE-802.11i-req]. A security claims section is
2312 required in EAP method specifications, so that EAP methods can be
2313 evaluated against the requirements.
2317 EAP was developed for use with PPP [RFC1661] and was later adapted
2318 for use in wired IEEE 802 networks [IEEE-802] in [IEEE-802.1X].
2319 Subsequently, EAP has been proposed for use on wireless LAN networks
2320 and over the Internet. In all these situations, it is possible for
2321 an attacker to gain access to links over which EAP packets are
2322 transmitted. For example, attacks on telephone infrastructure are
2323 documented in [DECEPTION].
2325 An attacker with access to the link may carry out a number of
2328 [1] An attacker may try to discover user identities by snooping
2329 authentication traffic.
2331 [2] An attacker may try to modify or spoof EAP packets.
2333 [3] An attacker may launch denial of service attacks by spoofing
2334 lower layer indications or Success/Failure packets, by replaying
2335 EAP packets, or by generating packets with overlapping
2338 [4] An attacker may attempt to recover the pass-phrase by mounting
2339 an offline dictionary attack.
2341 [5] An attacker may attempt to convince the peer to connect to an
2342 untrusted network by mounting a man-in-the-middle attack.
2344 [6] An attacker may attempt to disrupt the EAP negotiation in order
2345 cause a weak authentication method to be selected.
2347 [7] An attacker may attempt to recover keys by taking advantage of
2348 weak key derivation techniques used within EAP methods.
2354 Aboba, et al. Standards Track [Page 42]
2356 RFC 3748 EAP June 2004
2359 [8] An attacker may attempt to take advantage of weak ciphersuites
2360 subsequently used after the EAP conversation is complete.
2362 [9] An attacker may attempt to perform downgrading attacks on lower
2363 layer ciphersuite negotiation in order to ensure that a weaker
2364 ciphersuite is used subsequently to EAP authentication.
2366 [10] An attacker acting as an authenticator may provide incorrect
2367 information to the EAP peer and/or server via out-of-band
2368 mechanisms (such as via a AAA or lower layer protocol). This
2369 includes impersonating another authenticator, or providing
2370 inconsistent information to the peer and EAP server.
2372 Depending on the lower layer, these attacks may be carried out
2373 without requiring physical proximity. Where EAP is used over
2374 wireless networks, EAP packets may be forwarded by authenticators
2375 (e.g., pre-authentication) so that the attacker need not be within
2376 the coverage area of an authenticator in order to carry out an attack
2377 on it or its peers. Where EAP is used over the Internet, attacks may
2378 be carried out at an even greater distance.
2380 7.2. Security Claims
2382 In order to clearly articulate the security provided by an EAP
2383 method, EAP method specifications MUST include a Security Claims
2384 section, including the following declarations:
2386 [a] Mechanism. This is a statement of the authentication technology:
2387 certificates, pre-shared keys, passwords, token cards, etc.
2389 [b] Security claims. This is a statement of the claimed security
2390 properties of the method, using terms defined in Section 7.2.1:
2391 mutual authentication, integrity protection, replay protection,
2392 confidentiality, key derivation, dictionary attack resistance,
2393 fast reconnect, cryptographic binding. The Security Claims
2394 section of an EAP method specification SHOULD provide
2395 justification for the claims that are made. This can be
2396 accomplished by including a proof in an Appendix, or including a
2397 reference to a proof.
2399 [c] Key strength. If the method derives keys, then the effective key
2400 strength MUST be estimated. This estimate is meant for potential
2401 users of the method to determine if the keys produced are strong
2402 enough for the intended application.
2410 Aboba, et al. Standards Track [Page 43]
2412 RFC 3748 EAP June 2004
2415 The effective key strength SHOULD be stated as a number of bits,
2416 defined as follows: If the effective key strength is N bits, the
2417 best currently known methods to recover the key (with non-
2418 negligible probability) require, on average, an effort comparable
2419 to 2^(N-1) operations of a typical block cipher. The statement
2420 SHOULD be accompanied by a short rationale, explaining how this
2421 number was derived. This explanation SHOULD include the
2422 parameters required to achieve the stated key strength based on
2423 current knowledge of the algorithms.
2425 (Note: Although it is difficult to define what "comparable
2426 effort" and "typical block cipher" exactly mean, reasonable
2427 approximations are sufficient here. Refer to e.g. [SILVERMAN]
2428 for more discussion.)
2430 The key strength depends on the methods used to derive the keys.
2431 For instance, if keys are derived from a shared secret (such as a
2432 password or a long-term secret), and possibly some public
2433 information such as nonces, the effective key strength is limited
2434 by the strength of the long-term secret (assuming that the
2435 derivation procedure is computationally simple). To take another
2436 example, when using public key algorithms, the strength of the
2437 symmetric key depends on the strength of the public keys used.
2439 [d] Description of key hierarchy. EAP methods deriving keys MUST
2440 either provide a reference to a key hierarchy specification, or
2441 describe how Master Session Keys (MSKs) and Extended Master
2442 Session Keys (EMSKs) are to be derived.
2444 [e] Indication of vulnerabilities. In addition to the security
2445 claims that are made, the specification MUST indicate which of
2446 the security claims detailed in Section 7.2.1 are NOT being made.
2448 7.2.1. Security Claims Terminology for EAP Methods
2450 These terms are used to describe the security properties of EAP
2453 Protected ciphersuite negotiation
2454 This refers to the ability of an EAP method to negotiate the
2455 ciphersuite used to protect the EAP conversation, as well as to
2456 integrity protect the negotiation. It does not refer to the
2457 ability to negotiate the ciphersuite used to protect data.
2466 Aboba, et al. Standards Track [Page 44]
2468 RFC 3748 EAP June 2004
2471 Mutual authentication
2472 This refers to an EAP method in which, within an interlocked
2473 exchange, the authenticator authenticates the peer and the peer
2474 authenticates the authenticator. Two independent one-way methods,
2475 running in opposite directions do not provide mutual
2476 authentication as defined here.
2478 Integrity protection
2479 This refers to providing data origin authentication and protection
2480 against unauthorized modification of information for EAP packets
2481 (including EAP Requests and Responses). When making this claim, a
2482 method specification MUST describe the EAP packets and fields
2483 within the EAP packet that are protected.
2486 This refers to protection against replay of an EAP method or its
2487 messages, including success and failure result indications.
2490 This refers to encryption of EAP messages, including EAP Requests
2491 and Responses, and success and failure result indications. A
2492 method making this claim MUST support identity protection (see
2496 This refers to the ability of the EAP method to derive exportable
2497 keying material, such as the Master Session Key (MSK), and
2498 Extended Master Session Key (EMSK). The MSK is used only for
2499 further key derivation, not directly for protection of the EAP
2500 conversation or subsequent data. Use of the EMSK is reserved.
2503 If the effective key strength is N bits, the best currently known
2504 methods to recover the key (with non-negligible probability)
2505 require, on average, an effort comparable to 2^(N-1) operations of
2506 a typical block cipher.
2508 Dictionary attack resistance
2509 Where password authentication is used, passwords are commonly
2510 selected from a small set (as compared to a set of N-bit keys),
2511 which raises a concern about dictionary attacks. A method may be
2512 said to provide protection against dictionary attacks if, when it
2513 uses a password as a secret, the method does not allow an offline
2514 attack that has a work factor based on the number of passwords in
2515 an attacker's dictionary.
2522 Aboba, et al. Standards Track [Page 45]
2524 RFC 3748 EAP June 2004
2528 The ability, in the case where a security association has been
2529 previously established, to create a new or refreshed security
2530 association more efficiently or in a smaller number of round-
2533 Cryptographic binding
2534 The demonstration of the EAP peer to the EAP server that a single
2535 entity has acted as the EAP peer for all methods executed within a
2536 tunnel method. Binding MAY also imply that the EAP server
2537 demonstrates to the peer that a single entity has acted as the EAP
2538 server for all methods executed within a tunnel method. If
2539 executed correctly, binding serves to mitigate man-in-the-middle
2542 Session independence
2543 The demonstration that passive attacks (such as capture of the EAP
2544 conversation) or active attacks (including compromise of the MSK
2545 or EMSK) does not enable compromise of subsequent or prior MSKs or
2549 This refers to whether an EAP method supports fragmentation and
2550 reassembly. As noted in Section 3.1, EAP methods should support
2551 fragmentation and reassembly if EAP packets can exceed the minimum
2555 The communication within an EAP method of integrity-protected
2556 channel properties such as endpoint identifiers which can be
2557 compared to values communicated via out of band mechanisms (such
2558 as via a AAA or lower layer protocol).
2560 Note: This list of security claims is not exhaustive. Additional
2561 properties, such as additional denial-of-service protection, may be
2564 7.3. Identity Protection
2566 An Identity exchange is optional within the EAP conversation.
2567 Therefore, it is possible to omit the Identity exchange entirely, or
2568 to use a method-specific identity exchange once a protected channel
2569 has been established.
2571 However, where roaming is supported as described in [RFC2607], it may
2572 be necessary to locate the appropriate backend authentication server
2573 before the authentication conversation can proceed. The realm
2574 portion of the Network Access Identifier (NAI) [RFC2486] is typically
2578 Aboba, et al. Standards Track [Page 46]
2580 RFC 3748 EAP June 2004
2583 included within the EAP-Response/Identity in order to enable the
2584 authentication exchange to be routed to the appropriate backend
2585 authentication server. Therefore, while the peer-name portion of the
2586 NAI may be omitted in the EAP-Response/Identity where proxies or
2587 relays are present, the realm portion may be required.
2589 It is possible for the identity in the identity response to be
2590 different from the identity authenticated by the EAP method. This
2591 may be intentional in the case of identity privacy. An EAP method
2592 SHOULD use the authenticated identity when making access control
2595 7.4. Man-in-the-Middle Attacks
2597 Where EAP is tunneled within another protocol that omits peer
2598 authentication, there exists a potential vulnerability to a man-in-
2599 the-middle attack. For details, see [BINDING] and [MITM].
2601 As noted in Section 2.1, EAP does not permit untunneled sequences of
2602 authentication methods. Were a sequence of EAP authentication
2603 methods to be permitted, the peer might not have proof that a single
2604 entity has acted as the authenticator for all EAP methods within the
2605 sequence. For example, an authenticator might terminate one EAP
2606 method, then forward the next method in the sequence to another party
2607 without the peer's knowledge or consent. Similarly, the
2608 authenticator might not have proof that a single entity has acted as
2609 the peer for all EAP methods within the sequence.
2611 Tunneling EAP within another protocol enables an attack by a rogue
2612 EAP authenticator tunneling EAP to a legitimate server. Where the
2613 tunneling protocol is used for key establishment but does not require
2614 peer authentication, an attacker convincing a legitimate peer to
2615 connect to it will be able to tunnel EAP packets to a legitimate
2616 server, successfully authenticating and obtaining the key. This
2617 allows the attacker to successfully establish itself as a man-in-
2618 the-middle, gaining access to the network, as well as the ability to
2619 decrypt data traffic between the legitimate peer and server.
2621 This attack may be mitigated by the following measures:
2623 [a] Requiring mutual authentication within EAP tunneling mechanisms.
2625 [b] Requiring cryptographic binding between the EAP tunneling
2626 protocol and the tunneled EAP methods. Where cryptographic
2627 binding is supported, a mechanism is also needed to protect
2628 against downgrade attacks that would bypass it. For further
2629 details on cryptographic binding, see [BINDING].
2634 Aboba, et al. Standards Track [Page 47]
2636 RFC 3748 EAP June 2004
2639 [c] Limiting the EAP methods authorized for use without protection,
2640 based on peer and authenticator policy.
2642 [d] Avoiding the use of tunnels when a single, strong method is
2645 7.5. Packet Modification Attacks
2647 While EAP methods may support per-packet data origin authentication,
2648 integrity, and replay protection, support is not provided within the
2651 Since the Identifier is only a single octet, it is easy to guess,
2652 allowing an attacker to successfully inject or replay EAP packets.
2653 An attacker may also modify EAP headers (Code, Identifier, Length,
2654 Type) within EAP packets where the header is unprotected. This could
2655 cause packets to be inappropriately discarded or misinterpreted.
2657 To protect EAP packets against modification, spoofing, or replay,
2658 methods supporting protected ciphersuite negotiation, mutual
2659 authentication, and key derivation, as well as integrity and replay
2660 protection, are recommended. See Section 7.2.1 for definitions of
2661 these security claims.
2663 Method-specific MICs may be used to provide protection. If a per-
2664 packet MIC is employed within an EAP method, then peers,
2665 authentication servers, and authenticators not operating in pass-
2666 through mode MUST validate the MIC. MIC validation failures SHOULD
2667 be logged. Whether a MIC validation failure is considered a fatal
2668 error or not is determined by the EAP method specification.
2670 It is RECOMMENDED that methods providing integrity protection of EAP
2671 packets include coverage of all the EAP header fields, including the
2672 Code, Identifier, Length, Type, and Type-Data fields.
2674 Since EAP messages of Types Identity, Notification, and Nak do not
2675 include their own MIC, it may be desirable for the EAP method MIC to
2676 cover information contained within these messages, as well as the
2677 header of each EAP message.
2679 To provide protection, EAP also may be encapsulated within a
2680 protected channel created by protocols such as ISAKMP [RFC2408], as
2681 is done in [IKEv2] or within TLS [RFC2246]. However, as noted in
2682 Section 7.4, EAP tunneling may result in a man-in-the-middle
2690 Aboba, et al. Standards Track [Page 48]
2692 RFC 3748 EAP June 2004
2695 Existing EAP methods define message integrity checks (MICs) that
2696 cover more than one EAP packet. For example, EAP-TLS [RFC2716]
2697 defines a MIC over a TLS record that could be split into multiple
2698 fragments; within the FINISHED message, the MIC is computed over
2699 previous messages. Where the MIC covers more than one EAP packet, a
2700 MIC validation failure is typically considered a fatal error.
2702 Within EAP-TLS [RFC2716], a MIC validation failure is treated as a
2703 fatal error, since that is what is specified in TLS [RFC2246].
2704 However, it is also possible to develop EAP methods that support
2705 per-packet MICs, and respond to verification failures by silently
2706 discarding the offending packet.
2708 In this document, descriptions of EAP message handling assume that
2709 per-packet MIC validation, where it occurs, is effectively performed
2710 as though it occurs before sending any responses or changing the
2711 state of the host which received the packet.
2713 7.6. Dictionary Attacks
2715 Password authentication algorithms such as EAP-MD5, MS-CHAPv1
2716 [RFC2433], and Kerberos V [RFC1510] are known to be vulnerable to
2717 dictionary attacks. MS-CHAPv1 vulnerabilities are documented in
2718 [PPTPv1]; MS-CHAPv2 vulnerabilities are documented in [PPTPv2];
2719 Kerberos vulnerabilities are described in [KRBATTACK], [KRBLIM], and
2722 In order to protect against dictionary attacks, authentication
2723 methods resistant to dictionary attacks (as defined in Section 7.2.1)
2726 If an authentication algorithm is used that is known to be vulnerable
2727 to dictionary attacks, then the conversation may be tunneled within a
2728 protected channel in order to provide additional protection.
2729 However, as noted in Section 7.4, EAP tunneling may result in a man-
2730 in-the-middle vulnerability, and therefore dictionary attack
2731 resistant methods are preferred.
2733 7.7. Connection to an Untrusted Network
2735 With EAP methods supporting one-way authentication, such as EAP-MD5,
2736 the peer does not authenticate the authenticator, making the peer
2737 vulnerable to attack by a rogue authenticator. Methods supporting
2738 mutual authentication (as defined in Section 7.2.1) address this
2741 In EAP there is no requirement that authentication be full duplex or
2742 that the same protocol be used in both directions. It is perfectly
2746 Aboba, et al. Standards Track [Page 49]
2748 RFC 3748 EAP June 2004
2751 acceptable for different protocols to be used in each direction.
2752 This will, of course, depend on the specific protocols negotiated.
2753 However, in general, completing a single unitary mutual
2754 authentication is preferable to two one-way authentications, one in
2755 each direction. This is because separate authentications that are
2756 not bound cryptographically so as to demonstrate they are part of the
2757 same session are subject to man-in-the-middle attacks, as discussed
2760 7.8. Negotiation Attacks
2762 In a negotiation attack, the attacker attempts to convince the peer
2763 and authenticator to negotiate a less secure EAP method. EAP does
2764 not provide protection for Nak Response packets, although it is
2765 possible for a method to include coverage of Nak Responses within a
2766 method-specific MIC.
2768 Within or associated with each authenticator, it is not anticipated
2769 that a particular named peer will support a choice of methods. This
2770 would make the peer vulnerable to attacks that negotiate the least
2771 secure method from among a set. Instead, for each named peer, there
2772 SHOULD be an indication of exactly one method used to authenticate
2773 that peer name. If a peer needs to make use of different
2774 authentication methods under different circumstances, then distinct
2775 identities SHOULD be employed, each of which identifies exactly one
2776 authentication method.
2778 7.9. Implementation Idiosyncrasies
2780 The interaction of EAP with lower layers such as PPP and IEEE 802 are
2781 highly implementation dependent.
2783 For example, upon failure of authentication, some PPP implementations
2784 do not terminate the link, instead limiting traffic in Network-Layer
2785 Protocols to a filtered subset, which in turn allows the peer the
2786 opportunity to update secrets or send mail to the network
2787 administrator indicating a problem. Similarly, while an
2788 authentication failure will result in denied access to the controlled
2789 port in [IEEE-802.1X], limited traffic may be permitted on the
2792 In EAP there is no provision for retries of failed authentication.
2793 However, in PPP the LCP state machine can renegotiate the
2794 authentication protocol at any time, thus allowing a new attempt.
2795 Similarly, in IEEE 802.1X the Supplicant or Authenticator can re-
2796 authenticate at any time. It is recommended that any counters used
2797 for authentication failure not be reset until after successful
2798 authentication, or subsequent termination of the failed link.
2802 Aboba, et al. Standards Track [Page 50]
2804 RFC 3748 EAP June 2004
2807 7.10. Key Derivation
2809 It is possible for the peer and EAP server to mutually authenticate
2810 and derive keys. In order to provide keying material for use in a
2811 subsequently negotiated ciphersuite, an EAP method supporting key
2812 derivation MUST export a Master Session Key (MSK) of at least 64
2813 octets, and an Extended Master Session Key (EMSK) of at least 64
2814 octets. EAP Methods deriving keys MUST provide for mutual
2815 authentication between the EAP peer and the EAP Server.
2817 The MSK and EMSK MUST NOT be used directly to protect data; however,
2818 they are of sufficient size to enable derivation of a AAA-Key
2819 subsequently used to derive Transient Session Keys (TSKs) for use
2820 with the selected ciphersuite. Each ciphersuite is responsible for
2821 specifying how to derive the TSKs from the AAA-Key.
2823 The AAA-Key is derived from the keying material exported by the EAP
2824 method (MSK and EMSK). This derivation occurs on the AAA server. In
2825 many existing protocols that use EAP, the AAA-Key and MSK are
2826 equivalent, but more complicated mechanisms are possible (see
2827 [KEYFRAME] for details).
2829 EAP methods SHOULD ensure the freshness of the MSK and EMSK, even in
2830 cases where one party may not have a high quality random number
2831 generator. A RECOMMENDED method is for each party to provide a nonce
2832 of at least 128 bits, used in the derivation of the MSK and EMSK.
2834 EAP methods export the MSK and EMSK, but not Transient Session Keys
2835 so as to allow EAP methods to be ciphersuite and media independent.
2836 Keying material exported by EAP methods MUST be independent of the
2837 ciphersuite negotiated to protect data.
2839 Depending on the lower layer, EAP methods may run before or after
2840 ciphersuite negotiation, so that the selected ciphersuite may not be
2841 known to the EAP method. By providing keying material usable with
2842 any ciphersuite, EAP methods can used with a wide range of
2843 ciphersuites and media.
2845 In order to preserve algorithm independence, EAP methods deriving
2846 keys SHOULD support (and document) the protected negotiation of the
2847 ciphersuite used to protect the EAP conversation between the peer and
2848 server. This is distinct from the ciphersuite negotiated between the
2849 peer and authenticator, used to protect data.
2851 The strength of Transient Session Keys (TSKs) used to protect data is
2852 ultimately dependent on the strength of keys generated by the EAP
2853 method. If an EAP method cannot produce keying material of
2854 sufficient strength, then the TSKs may be subject to a brute force
2858 Aboba, et al. Standards Track [Page 51]
2860 RFC 3748 EAP June 2004
2863 attack. In order to enable deployments requiring strong keys, EAP
2864 methods supporting key derivation SHOULD be capable of generating an
2865 MSK and EMSK, each with an effective key strength of at least 128
2868 Methods supporting key derivation MUST demonstrate cryptographic
2869 separation between the MSK and EMSK branches of the EAP key
2870 hierarchy. Without violating a fundamental cryptographic assumption
2871 (such as the non-invertibility of a one-way function), an attacker
2872 recovering the MSK or EMSK MUST NOT be able to recover the other
2873 quantity with a level of effort less than brute force.
2875 Non-overlapping substrings of the MSK MUST be cryptographically
2876 separate from each other, as defined in Section 7.2.1. That is,
2877 knowledge of one substring MUST NOT help in recovering some other
2878 substring without breaking some hard cryptographic assumption. This
2879 is required because some existing ciphersuites form TSKs by simply
2880 splitting the AAA-Key to pieces of appropriate length. Likewise,
2881 non-overlapping substrings of the EMSK MUST be cryptographically
2882 separate from each other, and from substrings of the MSK.
2884 The EMSK is reserved for future use and MUST remain on the EAP peer
2885 and EAP server where it is derived; it MUST NOT be transported to, or
2886 shared with, additional parties, or used to derive any other keys.
2887 (This restriction will be relaxed in a future document that specifies
2888 how the EMSK can be used.)
2890 Since EAP does not provide for explicit key lifetime negotiation, EAP
2891 peers, authenticators, and authentication servers MUST be prepared
2892 for situations in which one of the parties discards the key state,
2893 which remains valid on another party.
2895 This specification does not provide detailed guidance on how EAP
2896 methods derive the MSK and EMSK, how the AAA-Key is derived from the
2897 MSK and/or EMSK, or how the TSKs are derived from the AAA-Key.
2899 The development and validation of key derivation algorithms is
2900 difficult, and as a result, EAP methods SHOULD re-use well
2901 established and analyzed mechanisms for key derivation (such as those
2902 specified in IKE [RFC2409] or TLS [RFC2246]), rather than inventing
2903 new ones. EAP methods SHOULD also utilize well established and
2904 analyzed mechanisms for MSK and EMSK derivation. Further details on
2905 EAP Key Derivation are provided within [KEYFRAME].
2914 Aboba, et al. Standards Track [Page 52]
2916 RFC 3748 EAP June 2004
2919 7.11. Weak Ciphersuites
2921 If after the initial EAP authentication, data packets are sent
2922 without per-packet authentication, integrity, and replay protection,
2923 an attacker with access to the media can inject packets, "flip bits"
2924 within existing packets, replay packets, or even hijack the session
2925 completely. Without per-packet confidentiality, it is possible to
2928 To protect against data modification, spoofing, or snooping, it is
2929 recommended that EAP methods supporting mutual authentication and key
2930 derivation (as defined by Section 7.2.1) be used, along with lower
2931 layers providing per-packet confidentiality, authentication,
2932 integrity, and replay protection.
2934 Additionally, if the lower layer performs ciphersuite negotiation, it
2935 should be understood that EAP does not provide by itself integrity
2936 protection of that negotiation. Therefore, in order to avoid
2937 downgrading attacks which would lead to weaker ciphersuites being
2938 used, clients implementing lower layer ciphersuite negotiation SHOULD
2939 protect against negotiation downgrading.
2941 This can be done by enabling users to configure which ciphersuites
2942 are acceptable as a matter of security policy, or the ciphersuite
2943 negotiation MAY be authenticated using keying material derived from
2944 the EAP authentication and a MIC algorithm agreed upon in advance by
2949 There are reliability and security issues with link layer indications
2950 in PPP, IEEE 802 LANs, and IEEE 802.11 wireless LANs:
2952 [a] PPP. In PPP, link layer indications such as LCP-Terminate (a
2953 link failure indication) and NCP (a link success indication) are
2954 not authenticated or integrity protected. They can therefore be
2955 spoofed by an attacker with access to the link.
2957 [b] IEEE 802. IEEE 802.1X EAPOL-Start and EAPOL-Logoff frames are
2958 not authenticated or integrity protected. They can therefore be
2959 spoofed by an attacker with access to the link.
2961 [c] IEEE 802.11. In IEEE 802.11, link layer indications include
2962 Disassociate and Deauthenticate frames (link failure
2963 indications), and the first message of the 4-way handshake (link
2964 success indication). These messages are not authenticated or
2965 integrity protected, and although they are not forwardable, they
2966 are spoofable by an attacker within range.
2970 Aboba, et al. Standards Track [Page 53]
2972 RFC 3748 EAP June 2004
2975 In IEEE 802.11, IEEE 802.1X data frames may be sent as Class 3
2976 unicast data frames, and are therefore forwardable. This implies
2977 that while EAPOL-Start and EAPOL-Logoff messages may be authenticated
2978 and integrity protected, they can be spoofed by an authenticated
2979 attacker far from the target when "pre-authentication" is enabled.
2981 In IEEE 802.11, a "link down" indication is an unreliable indication
2982 of link failure, since wireless signal strength can come and go and
2983 may be influenced by radio frequency interference generated by an
2984 attacker. To avoid unnecessary resets, it is advisable to damp these
2985 indications, rather than passing them directly to the EAP. Since EAP
2986 supports retransmission, it is robust against transient connectivity
2989 7.13. Separation of Authenticator and Backend Authentication Server
2991 It is possible for the EAP peer and EAP server to mutually
2992 authenticate and derive a AAA-Key for a ciphersuite used to protect
2993 subsequent data traffic. This does not present an issue on the peer,
2994 since the peer and EAP client reside on the same machine; all that is
2995 required is for the client to derive the AAA-Key from the MSK and
2996 EMSK exported by the EAP method, and to subsequently pass a Transient
2997 Session Key (TSK) to the ciphersuite module.
2999 However, in the case where the authenticator and authentication
3000 server reside on different machines, there are several implications
3003 [a] Authentication will occur between the peer and the authentication
3004 server, not between the peer and the authenticator. This means
3005 that it is not possible for the peer to validate the identity of
3006 the authenticator that it is speaking to, using EAP alone.
3008 [b] As discussed in [RFC3579], the authenticator is dependent on the
3009 AAA protocol in order to know the outcome of an authentication
3010 conversation, and does not look at the encapsulated EAP packet
3011 (if one is present) to determine the outcome. In practice, this
3012 implies that the AAA protocol spoken between the authenticator
3013 and authentication server MUST support per-packet authentication,
3014 integrity, and replay protection.
3016 [c] After completion of the EAP conversation, where lower layer
3017 security services such as per-packet confidentiality,
3018 authentication, integrity, and replay protection will be enabled,
3019 a secure association protocol SHOULD be run between the peer and
3020 authenticator in order to provide mutual authentication between
3026 Aboba, et al. Standards Track [Page 54]
3028 RFC 3748 EAP June 2004
3031 the peer and authenticator, guarantee liveness of transient
3032 session keys, provide protected ciphersuite and capabilities
3033 negotiation for subsequent data, and synchronize key usage.
3035 [d] A AAA-Key derived from the MSK and/or EMSK negotiated between the
3036 peer and authentication server MAY be transmitted to the
3037 authenticator. Therefore, a mechanism needs to be provided to
3038 transmit the AAA-Key from the authentication server to the
3039 authenticator that needs it. The specification of the AAA-key
3040 derivation, transport, and wrapping mechanisms is outside the
3041 scope of this document. Further details on AAA-Key Derivation
3042 are provided within [KEYFRAME].
3044 7.14. Cleartext Passwords
3046 This specification does not define a mechanism for cleartext password
3047 authentication. The omission is intentional. Use of cleartext
3048 passwords would allow the password to be captured by an attacker with
3049 access to a link over which EAP packets are transmitted.
3051 Since protocols encapsulating EAP, such as RADIUS [RFC3579], may not
3052 provide confidentiality, EAP packets may be subsequently encapsulated
3053 for transport over the Internet where they may be captured by an
3056 As a result, cleartext passwords cannot be securely used within EAP,
3057 except where encapsulated within a protected tunnel with server
3058 authentication. Some of the same risks apply to EAP methods without
3059 dictionary attack resistance, as defined in Section 7.2.1. For
3060 details, see Section 7.6.
3062 7.15. Channel Binding
3064 It is possible for a compromised or poorly implemented EAP
3065 authenticator to communicate incorrect information to the EAP peer
3066 and/or server. This may enable an authenticator to impersonate
3067 another authenticator or communicate incorrect information via out-
3068 of-band mechanisms (such as via a AAA or lower layer protocol).
3070 Where EAP is used in pass-through mode, the EAP peer typically does
3071 not verify the identity of the pass-through authenticator, it only
3072 verifies that the pass-through authenticator is trusted by the EAP
3073 server. This creates a potential security vulnerability.
3075 Section 4.3.7 of [RFC3579] describes how an EAP pass-through
3076 authenticator acting as a AAA client can be detected if it attempts
3077 to impersonate another authenticator (such by sending incorrect NAS-
3078 Identifier [RFC2865], NAS-IP-Address [RFC2865] or NAS-IPv6-Address
3082 Aboba, et al. Standards Track [Page 55]
3084 RFC 3748 EAP June 2004
3087 [RFC3162] attributes via the AAA protocol). However, it is possible
3088 for a pass-through authenticator acting as a AAA client to provide
3089 correct information to the AAA server while communicating misleading
3090 information to the EAP peer via a lower layer protocol.
3092 For example, it is possible for a compromised authenticator to
3093 utilize another authenticator's Called-Station-Id or NAS-Identifier
3094 in communicating with the EAP peer via a lower layer protocol, or for
3095 a pass-through authenticator acting as a AAA client to provide an
3096 incorrect peer Calling-Station-Id [RFC2865][RFC3580] to the AAA
3097 server via the AAA protocol.
3099 In order to address this vulnerability, EAP methods may support a
3100 protected exchange of channel properties such as endpoint
3101 identifiers, including (but not limited to): Called-Station-Id
3102 [RFC2865][RFC3580], Calling-Station-Id [RFC2865][RFC3580], NAS-
3103 Identifier [RFC2865], NAS-IP-Address [RFC2865], and NAS-IPv6-Address
3106 Using such a protected exchange, it is possible to match the channel
3107 properties provided by the authenticator via out-of-band mechanisms
3108 against those exchanged within the EAP method. Where discrepancies
3109 are found, these SHOULD be logged; additional actions MAY also be
3110 taken, such as denying access.
3112 7.16. Protected Result Indications
3114 Within EAP, Success and Failure packets are neither acknowledged nor
3115 integrity protected. Result indications improve resilience to loss
3116 of Success and Failure packets when EAP is run over lower layers
3117 which do not support retransmission or synchronization of the
3118 authentication state. In media such as IEEE 802.11, which provides
3119 for retransmission, as well as synchronization of authentication
3120 state via the 4-way handshake defined in [IEEE-802.11i], additional
3121 resilience is typically of marginal benefit.
3123 Depending on the method and circumstances, result indications can be
3124 spoofable by an attacker. A method is said to provide protected
3125 result indications if it supports result indications, as well as the
3126 "integrity protection" and "replay protection" claims. A method
3127 supporting protected result indications MUST indicate which result
3128 indications are protected, and which are not.
3130 Protected result indications are not required to protect against
3131 rogue authenticators. Within a mutually authenticating method,
3132 requiring that the server authenticate to the peer before the peer
3133 will accept a Success packet prevents an attacker from acting as a
3134 rogue authenticator.
3138 Aboba, et al. Standards Track [Page 56]
3140 RFC 3748 EAP June 2004
3143 However, it is possible for an attacker to forge a Success packet
3144 after the server has authenticated to the peer, but before the peer
3145 has authenticated to the server. If the peer were to accept the
3146 forged Success packet and attempt to access the network when it had
3147 not yet successfully authenticated to the server, a denial of service
3148 attack could be mounted against the peer. After such an attack, if
3149 the lower layer supports failure indications, the authenticator can
3150 synchronize state with the peer by providing a lower layer failure
3151 indication. See Section 7.12 for details.
3153 If a server were to authenticate the peer and send a Success packet
3154 prior to determining whether the peer has authenticated the
3155 authenticator, an idle timeout can occur if the authenticator is not
3156 authenticated by the peer. Where supported by the lower layer, an
3157 authenticator sensing the absence of the peer can free resources.
3159 In a method supporting result indications, a peer that has
3160 authenticated the server does not consider the authentication
3161 successful until it receives an indication that the server
3162 successfully authenticated it. Similarly, a server that has
3163 successfully authenticated the peer does not consider the
3164 authentication successful until it receives an indication that the
3165 peer has authenticated the server.
3167 In order to avoid synchronization problems, prior to sending a
3168 success result indication, it is desirable for the sender to verify
3169 that sufficient authorization exists for granting access, though, as
3170 discussed below, this is not always possible.
3172 While result indications may enable synchronization of the
3173 authentication result between the peer and server, this does not
3174 guarantee that the peer and authenticator will be synchronized in
3175 terms of their authorization or that timeouts will not occur. For
3176 example, the EAP server may not be aware of an authorization decision
3177 made by a AAA proxy; the AAA server may check authorization only
3178 after authentication has completed successfully, to discover that
3179 authorization cannot be granted, or the AAA server may grant access
3180 but the authenticator may be unable to provide it due to a temporary
3181 lack of resources. In these situations, synchronization may only be
3182 achieved via lower layer result indications.
3184 Success indications may be explicit or implicit. For example, where
3185 a method supports error messages, an implicit success indication may
3186 be defined as the reception of a specific message without a preceding
3187 error message. Failures are typically indicated explicitly. As
3188 described in Section 4.2, a peer silently discards a Failure packet
3189 received at a point where the method does not explicitly permit this
3194 Aboba, et al. Standards Track [Page 57]
3196 RFC 3748 EAP June 2004
3199 to be sent. For example, a method providing its own error messages
3200 might require the peer to receive an error message prior to accepting
3203 Per-packet authentication, integrity, and replay protection of result
3204 indications protects against spoofing. Since protected result
3205 indications require use of a key for per-packet authentication and
3206 integrity protection, methods supporting protected result indications
3207 MUST also support the "key derivation", "mutual authentication",
3208 "integrity protection", and "replay protection" claims.
3210 Protected result indications address some denial-of-service
3211 vulnerabilities due to spoofing of Success and Failure packets,
3212 though not all. EAP methods can typically provide protected result
3213 indications only in some circumstances. For example, errors can
3214 occur prior to key derivation, and so it may not be possible to
3215 protect all failure indications. It is also possible that result
3216 indications may not be supported in both directions or that
3217 synchronization may not be achieved in all modes of operation.
3219 For example, within EAP-TLS [RFC2716], in the client authentication
3220 handshake, the server authenticates the peer, but does not receive a
3221 protected indication of whether the peer has authenticated it. In
3222 contrast, the peer authenticates the server and is aware of whether
3223 the server has authenticated it. In the session resumption
3224 handshake, the peer authenticates the server, but does not receive a
3225 protected indication of whether the server has authenticated it. In
3226 this mode, the server authenticates the peer and is aware of whether
3227 the peer has authenticated it.
3231 This protocol derives much of its inspiration from Dave Carrel's AHA
3232 document, as well as the PPP CHAP protocol [RFC1994]. Valuable
3233 feedback was provided by Yoshihiro Ohba of Toshiba America Research,
3234 Jari Arkko of Ericsson, Sachin Seth of Microsoft, Glen Zorn of Cisco
3235 Systems, Jesse Walker of Intel, Bill Arbaugh, Nick Petroni and Bryan
3236 Payne of the University of Maryland, Steve Bellovin of AT&T Research,
3237 Paul Funk of Funk Software, Pasi Eronen of Nokia, Joseph Salowey of
3238 Cisco, Paul Congdon of HP, and members of the EAP working group.
3240 The use of Security Claims sections for EAP methods, as required by
3241 Section 7.2 and specified for each EAP method described in this
3242 document, was inspired by Glen Zorn through [EAP-EVAL].
3250 Aboba, et al. Standards Track [Page 58]
3252 RFC 3748 EAP June 2004
3257 9.1. Normative References
3259 [RFC1661] Simpson, W., "The Point-to-Point Protocol (PPP)",
3260 STD 51, RFC 1661, July 1994.
3262 [RFC1994] Simpson, W., "PPP Challenge Handshake
3263 Authentication Protocol (CHAP)", RFC 1994, August
3266 [RFC2119] Bradner, S., "Key words for use in RFCs to
3267 Indicate Requirement Levels", BCP 14, RFC 2119,
3270 [RFC2243] Metz, C., "OTP Extended Responses", RFC 2243,
3273 [RFC2279] Yergeau, F., "UTF-8, a transformation format of
3274 ISO 10646", RFC 2279, January 1998.
3276 [RFC2289] Haller, N., Metz, C., Nesser, P. and M. Straw, "A
3277 One-Time Password System", RFC 2289, February
3280 [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for
3281 Writing an IANA Considerations Section in RFCs",
3282 BCP 26, RFC 2434, October 1998.
3284 [RFC2988] Paxson, V. and M. Allman, "Computing TCP's
3285 Retransmission Timer", RFC 2988, November 2000.
3287 [IEEE-802] Institute of Electrical and Electronics Engineers,
3288 "Local and Metropolitan Area Networks: Overview
3289 and Architecture", IEEE Standard 802, 1990.
3291 [IEEE-802.1X] Institute of Electrical and Electronics Engineers,
3292 "Local and Metropolitan Area Networks: Port-Based
3293 Network Access Control", IEEE Standard 802.1X,
3306 Aboba, et al. Standards Track [Page 59]
3308 RFC 3748 EAP June 2004
3311 9.2. Informative References
3313 [RFC793] Postel, J., "Transmission Control Protocol", STD
3314 7, RFC 793, September 1981.
3316 [RFC1510] Kohl, J. and B. Neuman, "The Kerberos Network
3317 Authentication Service (V5)", RFC 1510, September
3320 [RFC1750] Eastlake, D., Crocker, S. and J. Schiller,
3321 "Randomness Recommendations for Security", RFC
3322 1750, December 1994.
3324 [RFC2246] Dierks, T., Allen, C., Treese, W., Karlton, P.,
3325 Freier, A. and P. Kocher, "The TLS Protocol
3326 Version 1.0", RFC 2246, January 1999.
3328 [RFC2284] Blunk, L. and J. Vollbrecht, "PPP Extensible
3329 Authentication Protocol (EAP)", RFC 2284, March
3332 [RFC2486] Aboba, B. and M. Beadles, "The Network Access
3333 Identifier", RFC 2486, January 1999.
3335 [RFC2408] Maughan, D., Schneider, M. and M. Schertler,
3336 "Internet Security Association and Key Management
3337 Protocol (ISAKMP)", RFC 2408, November 1998.
3339 [RFC2409] Harkins, D. and D. Carrel, "The Internet Key
3340 Exchange (IKE)", RFC 2409, November 1998.
3342 [RFC2433] Zorn, G. and S. Cobb, "Microsoft PPP CHAP
3343 Extensions", RFC 2433, October 1998.
3345 [RFC2607] Aboba, B. and J. Vollbrecht, "Proxy Chaining and
3346 Policy Implementation in Roaming", RFC 2607, June
3349 [RFC2661] Townsley, W., Valencia, A., Rubens, A., Pall, G.,
3350 Zorn, G. and B. Palter, "Layer Two Tunneling
3351 Protocol "L2TP"", RFC 2661, August 1999.
3353 [RFC2716] Aboba, B. and D. Simon, "PPP EAP TLS
3354 Authentication Protocol", RFC 2716, October 1999.
3356 [RFC2865] Rigney, C., Willens, S., Rubens, A. and W.
3357 Simpson, "Remote Authentication Dial In User
3358 Service (RADIUS)", RFC 2865, June 2000.
3362 Aboba, et al. Standards Track [Page 60]
3364 RFC 3748 EAP June 2004
3367 [RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C.,
3368 Schwarzbauer, H., Taylor, T., Rytina, I., Kalla,
3369 M., Zhang, L. and V. Paxson, "Stream Control
3370 Transmission Protocol", RFC 2960, October 2000.
3372 [RFC3162] Aboba, B., Zorn, G. and D. Mitton, "RADIUS and
3373 IPv6", RFC 3162, August 2001.
3375 [RFC3454] Hoffman, P. and M. Blanchet, "Preparation of
3376 Internationalized Strings ("stringprep")", RFC
3377 3454, December 2002.
3379 [RFC3579] Aboba, B. and P. Calhoun, "RADIUS (Remote
3380 Authentication Dial In User Service) Support For
3381 Extensible Authentication Protocol (EAP)", RFC
3382 3579, September 2003.
3384 [RFC3580] Congdon, P., Aboba, B., Smith, A., Zorn, G. and J.
3385 Roese, "IEEE 802.1X Remote Authentication Dial In
3386 User Service (RADIUS) Usage Guidelines", RFC 3580,
3389 [RFC3692] Narten, T., "Assigning Experimental and Testing
3390 Numbers Considered Useful", BCP 82, RFC 3692,
3393 [DECEPTION] Slatalla, M. and J. Quittner, "Masters of
3394 Deception", Harper-Collins, New York, 1995.
3396 [KRBATTACK] Wu, T., "A Real-World Analysis of Kerberos
3397 Password Security", Proceedings of the 1999 ISOC
3398 Network and Distributed System Security Symposium,
3399 http://www.isoc.org/isoc/conferences/ndss/99/
3400 proceedings/papers/wu.pdf.
3402 [KRBLIM] Bellovin, S. and M. Merrit, "Limitations of the
3403 Kerberos authentication system", Proceedings of
3404 the 1991 Winter USENIX Conference, pp. 253-267,
3407 [KERB4WEAK] Dole, B., Lodin, S. and E. Spafford, "Misplaced
3408 trust: Kerberos 4 session keys", Proceedings of
3409 the Internet Society Network and Distributed
3410 System Security Symposium, pp. 60-70, March 1997.
3418 Aboba, et al. Standards Track [Page 61]
3420 RFC 3748 EAP June 2004
3423 [PIC] Aboba, B., Krawczyk, H. and Y. Sheffer, "PIC, A
3424 Pre-IKE Credential Provisioning Protocol", Work in
3425 Progress, October 2002.
3427 [IKEv2] Kaufman, C., "Internet Key Exchange (IKEv2)
3428 Protocol", Work in Progress, January 2004.
3430 [PPTPv1] Schneier, B. and Mudge, "Cryptanalysis of
3431 Microsoft's Point-to- Point Tunneling Protocol",
3432 Proceedings of the 5th ACM Conference on
3433 Communications and Computer Security, ACM Press,
3436 [IEEE-802.11] Institute of Electrical and Electronics Engineers,
3437 "Wireless LAN Medium Access Control (MAC) and
3438 Physical Layer (PHY) Specifications", IEEE
3439 Standard 802.11, 1999.
3441 [SILVERMAN] Silverman, Robert D., "A Cost-Based Security
3442 Analysis of Symmetric and Asymmetric Key Lengths",
3443 RSA Laboratories Bulletin 13, April 2000 (Revised
3445 http://www.rsasecurity.com/rsalabs/bulletins/
3448 [KEYFRAME] Aboba, B., "EAP Key Management Framework", Work in
3449 Progress, October 2003.
3451 [SASLPREP] Zeilenga, K., "SASLprep: Stringprep profile for
3452 user names and passwords", Work in Progress, March
3455 [IEEE-802.11i] Institute of Electrical and Electronics Engineers,
3456 "Unapproved Draft Supplement to Standard for
3457 Telecommunications and Information Exchange
3458 Between Systems - LAN/MAN Specific Requirements -
3459 Part 11: Wireless LAN Medium Access Control (MAC)
3460 and Physical Layer (PHY) Specifications:
3461 Specification for Enhanced Security", IEEE Draft
3462 802.11i (work in progress), 2003.
3464 [DIAM-EAP] Eronen, P., Hiller, T. and G. Zorn, "Diameter
3465 Extensible Authentication Protocol (EAP)
3466 Application", Work in Progress, February 2004.
3468 [EAP-EVAL] Zorn, G., "Specifying Security Claims for EAP
3469 Authentication Types", Work in Progress, October
3474 Aboba, et al. Standards Track [Page 62]
3476 RFC 3748 EAP June 2004
3479 [BINDING] Puthenkulam, J., "The Compound Authentication
3480 Binding Problem", Work in Progress, October 2003.
3482 [MITM] Asokan, N., Niemi, V. and K. Nyberg, "Man-in-the-
3483 Middle in Tunneled Authentication Protocols", IACR
3484 ePrint Archive Report 2002/163, October 2002,
3485 <http://eprint.iacr.org/2002/163>.
3487 [IEEE-802.11i-req] Stanley, D., "EAP Method Requirements for Wireless
3488 LANs", Work in Progress, February 2004.
3490 [PPTPv2] Schneier, B. and Mudge, "Cryptanalysis of
3491 Microsoft's PPTP Authentication Extensions (MS-
3492 CHAPv2)", CQRE 99, Springer-Verlag, 1999, pp.
3530 Aboba, et al. Standards Track [Page 63]
3532 RFC 3748 EAP June 2004
3535 Appendix A. Changes from RFC 2284
3537 This section lists the major changes between [RFC2284] and this
3538 document. Minor changes, including style, grammar, spelling, and
3539 editorial changes are not mentioned here.
3541 o The Terminology section (Section 1.2) has been expanded, defining
3542 more concepts and giving more exact definitions.
3544 o The concepts of Mutual Authentication, Key Derivation, and Result
3545 Indications are introduced and discussed throughout the document
3548 o In Section 2, it is explicitly specified that more than one
3549 exchange of Request and Response packets may occur as part of the
3550 EAP authentication exchange. How this may be used and how it may
3551 not be used is specified in detail in Section 2.1.
3553 o Also in Section 2, some requirements have been made explicit for
3554 the authenticator when acting in pass-through mode.
3556 o An EAP multiplexing model (Section 2.2) has been added to
3557 illustrate a typical implementation of EAP. There is no
3558 requirement that an implementation conform to this model, as long
3559 as the on-the-wire behavior is consistent with it.
3561 o As EAP is now in use with a variety of lower layers, not just PPP
3562 for which it was first designed, Section 3 on lower layer behavior
3565 o In the description of the EAP Request and Response interaction
3566 (Section 4.1), both the behavior on receiving duplicate requests,
3567 and when packets should be silently discarded has been more
3568 exactly specified. The implementation notes in this section have
3569 been substantially expanded.
3571 o In Section 4.2, it has been clarified that Success and Failure
3572 packets must not contain additional data, and the implementation
3573 note has been expanded. A subsection giving requirements on
3574 processing of success and failure packets has been added.
3576 o Section 5 on EAP Request/Response Types lists two new Type values:
3577 the Expanded Type (Section 5.7), which is used to expand the Type
3578 value number space, and the Experimental Type. In the Expanded
3579 Type number space, the new Expanded Nak (Section 5.3.2) Type has
3580 been added. Clarifications have been made in the description of
3581 most of the existing Types. Security claims summaries have been
3582 added for authentication methods.
3586 Aboba, et al. Standards Track [Page 64]
3588 RFC 3748 EAP June 2004
3591 o In Sections 5, 5.1, and 5.2, a requirement has been added such
3592 that fields with displayable messages should contain UTF-8 encoded
3593 ISO 10646 characters.
3595 o It is now required in Section 5.1 that if the Type-Data field of
3596 an Identity Request contains a NUL-character, only the part before
3597 the null is displayed. RFC 2284 prohibits the null termination of
3598 the Type-Data field of Identity messages. This rule has been
3599 relaxed for Identity Request messages and the Identity Request
3600 Type-Data field may now be null terminated.
3602 o In Section 5.5, support for OTP Extended Responses [RFC2243] has
3603 been added to EAP OTP.
3605 o An IANA Considerations section (Section 6) has been added, giving
3606 registration policies for the numbering spaces defined for EAP.
3608 o The Security Considerations (Section 7) have been greatly
3609 expanded, giving a much more comprehensive coverage of possible
3610 threats and other security considerations.
3612 o In Section 7.5, text has been added on method-specific behavior,
3613 providing guidance on how EAP method-specific integrity checks
3614 should be processed. Where possible, it is desirable for a
3615 method-specific MIC to be computed over the entire EAP packet,
3616 including the EAP layer header (Code, Identifier, Length) and EAP
3617 method layer header (Type, Type-Data).
3619 o In Section 7.14 the security risks involved in use of cleartext
3620 passwords with EAP are described.
3622 o In Section 7.15 text has been added relating to detection of rogue
3642 Aboba, et al. Standards Track [Page 65]
3644 RFC 3748 EAP June 2004
3650 Microsoft Corporation
3655 Phone: +1 425 706 6605
3656 Fax: +1 425 936 6605
3657 EMail: bernarda@microsoft.com
3661 4251 Plymouth Rd., Suite 2000
3662 Ann Arbor, MI 48105-2785
3665 Phone: +1 734-647-9563
3666 Fax: +1 734-647-3185
3667 EMail: ljb@merit.edu
3670 Vollbrecht Consulting LLC
3671 9682 Alice Hill Drive
3675 EMail: jrv@umich.edu
3678 Sun Microsystems, Inc
3680 Burlington, MA 01803-2757
3683 Phone: +1 781 442 2084
3684 Fax: +1 781 442 1677
3685 EMail: james.d.carlson@sun.com
3693 Phone: +46 708 32 16 08
3694 EMail: henrik@levkowetz.com
3698 Aboba, et al. Standards Track [Page 66]
3700 RFC 3748 EAP June 2004
3703 Full Copyright Statement
3705 Copyright (C) The Internet Society (2004). This document is subject
3706 to the rights, licenses and restrictions contained in BCP 78, and
3707 except as set forth therein, the authors retain all their rights.
3709 This document and the information contained herein are provided on an
3710 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
3711 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
3712 ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
3713 INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
3714 INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
3715 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
3717 Intellectual Property
3719 The IETF takes no position regarding the validity or scope of any
3720 Intellectual Property Rights or other rights that might be claimed to
3721 pertain to the implementation or use of the technology described in
3722 this document or the extent to which any license under such rights
3723 might or might not be available; nor does it represent that it has
3724 made any independent effort to identify any such rights. Information
3725 on the procedures with respect to rights in RFC documents can be
3726 found in BCP 78 and BCP 79.
3728 Copies of IPR disclosures made to the IETF Secretariat and any
3729 assurances of licenses to be made available, or the result of an
3730 attempt made to obtain a general license or permission for the use of
3731 such proprietary rights by implementers or users of this
3732 specification can be obtained from the IETF on-line IPR repository at
3733 http://www.ietf.org/ipr.
3735 The IETF invites any interested party to bring to its attention any
3736 copyrights, patents or patent applications, or other proprietary
3737 rights that may cover technology that may be required to implement
3738 this standard. Please address the information to the IETF at ietf-
3743 Funding for the RFC Editor function is currently provided by the
3754 Aboba, et al. Standards Track [Page 67]