Dynamic Provisioning Using Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST)
RFC 5422
Document | Type |
RFC - Informational
(March 2009; No errata)
Was draft-cam-winget-eap-fast-provisioning (individual in gen area)
|
|
---|---|---|---|
Authors | Joseph Salowey , Hao Zhou , Nancy Cam-Winget , David McGrew | ||
Last updated | 2015-10-14 | ||
Stream | Internent Engineering Task Force (IETF) | ||
Formats | plain text html pdf htmlized (tools) htmlized bibtex | ||
Reviews | |||
Stream | WG state | (None) | |
Document shepherd | No shepherd assigned | ||
IESG | IESG state | RFC 5422 (Informational) | |
Action Holders |
(None)
|
||
Consensus Boilerplate | Unknown | ||
Telechat date | |||
Responsible AD | Tim Polk | ||
Send notices to | (None) |
Network Working Group N. Cam-Winget Request for Comments: 5422 D. McGrew Category: Informational J. Salowey H. Zhou Cisco Systems March 2009 Dynamic Provisioning Using Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST) Status of This Memo This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. Copyright Notice Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents in effect on the date of publication of this document (http://trustee.ietf.org/license-info). Please review these documents carefully, as they describe your rights and restrictions with respect to this document. This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The person(s) controlling the copyright in some of this material may not have granted the IETF Trust the right to allow modifications of such material outside the IETF Standards Process. Without obtaining an adequate license from the person(s) controlling the copyright in such materials, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process, except to format it for publication as an RFC or to translate it into languages other than English. IESG Note EAP-FAST has been implemented by many vendors and it is used in the Internet. Publication of this specification is intended to promote interoperability by documenting current use of existing EAP methods within EAP-FAST. Cam-Winget, et al. Informational [Page 1] RFC 5422 Dynamic Provisioning Using EAP-FAST March 2009 The EAP method EAP-FAST-MSCHAPv2 reuses the EAP type code assigned to EAP-MSCHAPv2 (26) for authentication within an anonymous TLS tunnel. In order to minimize the risk associated with an anonymous tunnel, changes to the method were made that are not interoperable with EAP- MSCHAPv2. Since EAP-MSCHAPv2 does not support method-specific version negotiation, the use of EAP-FAST-MSCHAPv2 is implied by the use of an anonymous EAP-FAST tunnel. This behavior may cause problems in implementations where the use of unaltered EAP-MSCHAPv2 is needed inside an anonymous EAP-FAST tunnel. Since such support requires special case execution of a method within a tunnel, it also complicates implementations that use the same method code both within and outside of the tunnel method. If EAP-FAST were to be designed today, these difficulties could be avoided by utilization of unique EAP Type codes. Given these issues, assigned method types must not be re-used with different meaning inside tunneled methods in the future. Abstract The Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST) method enables secure communication between a peer and a server by using Transport Layer Security (TLS) to establish a mutually authenticated tunnel. EAP- FAST also enables the provisioning credentials or other information through this protected tunnel. This document describes the use of EAP-FAST for dynamic provisioning. Table of Contents 1. Introduction ....................................................4 1.1. Specification Requirements .................................4 1.2. Terminology ................................................4 2. EAP-FAST Provisioning Modes .....................................5 3. Dynamic Provisioning Using EAP-FAST Conversation ................6 3.1. Phase 1 TLS Tunnel .........................................7 3.1.1. Server-Authenticated Tunnel .........................7 3.1.2. Server-Unauthenticated Tunnel .......................7 3.2. Phase 2 - Tunneled Authentication and Provisioning .........7 3.2.1. Server-Authenticated Tunneled Authentication ........8 3.2.2. Server-Unauthenticated Tunneled Authentication ......8 3.2.3. Authenticating Using EAP-FAST-MSCHAPv2 ..............8 3.2.4. Use of Other Inner EAP Methods for EAP-FAST Provisioning ........................................9 3.3. Key Derivations Used in the EAP-FAST Provisioning Exchange ..................................................10Show full document text