EAP-TLS 1.3: Using the Extensible Authentication Protocol with TLS 1.3
draft-ietf-emu-eap-tls13-21

Approval announcement
Draft of message to be sent after approval:

Announcement

From: The IESG <iesg-secretary@ietf.org>
To: IETF-Announce <ietf-announce@ietf.org>
Cc: Joseph Salowey <joe@salowey.net>, The IESG <iesg@ietf.org>, draft-ietf-emu-eap-tls13@ietf.org, emu-chairs@ietf.org, emu@ietf.org, joe@salowey.net, rdd@cert.org, rfc-editor@rfc-editor.org
Subject: Protocol Action: 'Using EAP-TLS with TLS 1.3 (EAP-TLS 1.3)' to Proposed Standard (draft-ietf-emu-eap-tls13-21.txt)

The IESG has approved the following document:
- 'Using EAP-TLS with TLS 1.3 (EAP-TLS 1.3)'
  (draft-ietf-emu-eap-tls13-21.txt) as Proposed Standard

This document is the product of the EAP Method Update Working Group.

The IESG contact persons are Benjamin Kaduk and Roman Danyliw.

A URL of this Internet Draft is:
https://datatracker.ietf.org/doc/draft-ietf-emu-eap-tls13/

Ballot Text

Technical Summary


   The Extensible Authentication Protocol (EAP), defined in RFC 3748,
   provides a standard mechanism for support of multiple authentication
   methods.  This document specifies the use of EAP-Transport Layer
   Security (EAP-TLS) with TLS 1.3 while remaining backwards compatible
   with existing implementations of EAP-TLS.  TLS 1.3 provides
   significantly improved security, privacy, and reduced latency when
   compared to earlier versions of TLS.  EAP-TLS with TLS 1.3 (EAP-TLS
   1.3) further improves security and privacy by always providing
   forward secrecy, never disclosing the peer identity, and by mandating
   use of revocation checking.  This document also provides guidance on
   authentication, authorization, and resumption for EAP-TLS in general
   (regardless of the underlying TLS version used).  This document
   updates RFC 5216.

Working Group Summary

The document had a lot of review and discussion.  There is in general good consensus for moving the document forward.  Towards the end of the WG discussion, an additional consensus call was needed to agree produce the normative language on OCSP usage.

This document was sent for IESG review in February 2021.  IESG review uncovered a design issue (https://mailarchive.ietf.org/arch/msg/emu/3ZFWAx0of-67P6yhtMIdmx9BLNs/) which sent the document back to the WG.  This document was updated, sent through WG and IETF LC and is now returning again to the IESG.

Document Quality

Much of the discussion on the list was based on comments from implemented of the previous version of the protocol or the proposed version of the protocol. 

At least two public implementations of the protocol are available:

wpa_supplicant - https://w1.fi/cgit/hostap/ 

free radius - https://github.com/FreeRADIUS/freeradius-server

Personnel

Document Shepherd - Joe Salowey

Responsible AD - Roman Danyliw

RFC Editor Note