RFC 3748 – Extensible Authentication Protocol (EAP)

RFC 3748 – Extensible Authentication Protocol (EAP)

rating packets with overlapping

   [4]  An attacker may attempt to recover the pass-phrase by mounting
        an offline dictionary attack.

   [5]  An attacker may attempt to convince the peer to connect to an
        untrusted network by mounting a man-in-the-middle attack.

   [6]  An attacker may attempt to disrupt the EAP negotiation in order
        cause a weak authentication method to be selected.

   [7]  An attacker may attempt to recover keys by taking advantage of
        weak key derivation techniques used within EAP methods.

Aboba, et al.               Standards Track                    [Page 42]
RFC 3748                          EAP                          June 2004

   [8]  An attacker may attempt to take advantage of weak ciphersuites
        subsequently used after the EAP conversation is complete.

   [9]  An attacker may attempt to perform downgrading attacks on lower
        layer ciphersuite negotiation in order to ensure that a weaker
        ciphersuite is used subsequently to EAP authentication.

   [10] An attacker acting as an authenticator may provide incorrect
        information to the EAP peer and/or server via out-of-band
        mechanisms (such as via a AAA or lower layer protocol).  This
        includes impersonating another authenticator, or providing
        inconsistent information to the peer and EAP server.

   Depending on the lower layer, these attacks may be carried out
   without requiring physical proximity.  Where EAP is used over
   wireless networks, EAP packets may be forwarded by authenticators
   (e.g., pre-authentication) so that the attacker need not be within
   the coverage area of an authenticator in order to carry out an attack
   on it or its peers.  Where EAP is used over the Internet, attacks may
   be carried out at an even greater distance.

7.2.  Security Claims

   In order to clearly articulate the security provided by an EAP
   method, EAP method specifications MUST include a Security Claims
   section, including the following declarations:

   [a] Mechanism.  This is a statement of the authentication technology:
       certificates, pre-shared keys, passwords, token cards, etc.

   [b] Security claims.  This is a statement of the claimed security
       properties of the method, using terms defined in Section 7.2.1:
       mutual authentication, integrity protection, replay protection,
       confidentiality, key derivation, dictionary attack resistance,
       fast reconnect, cryptographic binding.  The Security Claims
       section of an EAP method specification SHOULD provide
       justification for the claims that are made.  This can be
       accomplished by including a proof in an Appendix, or including a
       reference to a proof.

   [c] Key strength.  If the method derives keys, then the effective key
       strength MUST be estimated.  This estimate is meant for potential
       users of the method to determine if the keys produced are strong
       enough for the intended application.

Aboba, et al.               Standards Track                    [Page 43]
RFC 3748                          EAP                          June 2004

       The effective key strength SHOULD be stated as a number of bits,
       defined as follows: If the effective key strength is N bits, the
       best currently known methods to recover the key (with non-
       negligible probability) require, on average, an effort comparable
       to 2^(N-1) operations of a typical block cipher.  The statement
       SHOULD be accompanied by a short rationale, explaining how this
       number was derived.  This explanation SHOULD include the
       parameters required to achieve the stated key strength based on
       current knowledge of the algorithms.

       (Note: Although it is difficult to define what "comparable
       effort" and "typical block cipher" exactly mean, reasonable
       approximations are sufficient here.  Refer to e.g. [SILVERMAN]
       for more discussion.)

       The key strength depends on the methods used to derive the keys.
       For instance, if keys are derived from a shared secret (such as a
       password or a long-term secret), and possibly some public
       information such as nonces, the effective key strength is limited
       by the strength of the long-term secret (assuming that the
       derivation procedure is computationally simple).  To take another
       example, when using public key algorithms, the strength of the
       symmetric key depends on the strength of the public keys used.

   [d] Description of key hierarchy.  EAP methods deriving keys MUST
       either provide a reference to a key hierarchy specification, or
       describe how Master Session Keys (MSKs) and Extended Master
       Session Keys (EMSKs) are to be derived.

   [e] Indication of vulnerabilities.  In addition to the security
       claims that are made, the specification MUST indicate which of
       the security claims detailed in Section 7.2.1 are NOT being made.

7.2.1.  Security Claims Terminology for EAP Methods

   These terms are used to describe the security properties of EAP

   Protected ciphersuite negotiation
      This refers to the ability of an EAP method to negotiate the
      ciphersuite used to protect the EAP conversation, as well as to
      integrity protect the negotiation.  It does not refer to the
      ability to negotiate the ciphersuite used to protect data.

Aboba, et al.               Standards Track                    [Page 44]
RFC 3748                          EAP                          June 2004

   Mutual authentication
      This refers to an EAP method in which, within an interlocked
      exchange, the authenticator authenticates the peer and the peer
      authenticates the authenticator.  Two independent one-way methods,
      running in opposite directions do not provide mutual
      authentication as defined here.

   Integrity protection
      This refers to providing data origin authentication and protection
      against unauthorized modification of information for EAP packets
      (including EAP Requests and Responses).  When making this claim, a
      method specification MUST describe the EAP packets and fields
      within the EAP packet that are protected.

   Replay protection
      This refers to protection against replay of an EAP method or its
      messages, including success and failure result indications.

      This refers to encryption of EAP messages, including EAP Requests
      and Responses, and success and failure result indications.  A
      method making this claim MUST support identity protection (see
      Section 7.3).

   Key derivation
      This refers to the ability of the EAP method to derive exportable
      keying material, such as the Master Session Key (MSK), and
      Extended Master Session Key (EMSK).  The MSK is used only for
      further key derivation, not directly for protection of the EAP
      conversation or subsequent data.  Use of the EMSK is reserved.

   Key strength
      If the effective key strength is N bits, the best currently known
      methods to recover the key (with non-negligible probability)
      require, on average, an effort comparable to 2^(N-1) operations of
      a typical block cipher.

   Dictionary attack resistance
      Where password authentication is used, passwords are commonly
      selected from a small set (as compared to a set of N-bit keys),
      which raises a concern about dictionary attacks.  A method may be
      said to provide protection against dictionary attacks if, when it
      uses a password as a secret, the method does not allow an offline
      attack that has a work factor based on the number of passwords in
      an attacker's dictionary.

Aboba, et al.               Standards Track                    [Page 45]
RFC 3748                          EAP                          June 2004

   Fast reconnect
      The ability, in the case where a security association has been
      previously established, to create a new or refreshed security
      association more efficiently or in a smaller number of round-

   Cryptographic binding
      The demonstration of the EAP peer to the EAP server that a single
      entity has acted as the EAP peer for all methods executed within a
      tunnel method.  Binding MAY also imply that the EAP server
      demonstrates to the peer that a single entity has acted as the EAP
      server for all methods executed within a tunnel method.  If
      executed correctly, binding serves to mitigate man-in-the-middle

   Session independence
      The demonstration that passive attacks (such as capture of the EAP
      conversation) or active attacks (including compromise of the MSK
      or EMSK) does not enable compromise of subsequent or prior MSKs or

      This refers to whether an EAP method supports fragmentation and
      reassembly.  As noted in Section 3.1, EAP methods should support
      fragmentation and reassembly if EAP packets can exceed the minimum
      MTU of 1020 octets.

   Channel binding
      The communication within an EAP method of integrity-protected
      channel properties such as endpoint identifiers which can be
      compared to values communicated via out of band mechanisms (such
      as via a AAA or lower layer protocol).

   Note: This list of security claims is not exhaustive.  Additional
   properties, such as additional denial-of-service protection, may be
   relevant as well.

7.3.  Identity Protection

   An Identity exchange is optional within the EAP conversation.
   Therefore, it is possible to omit the Identity exchange entirely, or
   to use a method-specific identity exchange once a protected channel
   has been established.

   However, where roaming is supported as described in [RFC2607], it may
   be necessary to locate the appropriate backend authentication server
   before the authentication conversation can proceed.  The realm
   portion of the Network Access Identifier (NAI) [RFC2486] is typically

Aboba, et al.               Standards Track                    [Page 46]
RFC 3748                          EAP                          June 2004

   included within the EAP-Response/Identity in order to enable the
   authentication exchange to be routed to the appropriate backend
   authentication server.  Therefore, while the peer-name portion of the
   NAI may be omitted in the EAP-Response/Identity where proxies or
   relays are present, the realm portion may be required.

   It is possible for the identity in the identity response to be
   different from the identity authenticated by the EAP method.  This
   may be intentional in the case of identity privacy.  An EAP method
   SHOULD use the authenticated identity when making access control

7.4.  Man-in-the-Middle Attacks

   Where EAP is tunneled within another protocol that omits peer
   authentication, there exists a potential vulnerability to a man-in-
   the-middle attack.  For details, see [BINDING] and [MITM].

   As noted in Section 2.1, EAP does not permit untunneled sequences of
   authentication methods.  Were a sequence of EAP authentication
   methods to be permitted, the peer might not have proof that a single
   entity has acted as the authenticator for all EAP methods within the
   sequence.  For example, an authenticator might terminate one EAP
   method, then forward the next method in the sequence to another party
   without the peer's knowledge or consent.  Similarly, the
   authenticator might not have proof that a single entity has acted as
   the peer for all EAP methods within the sequence.

   Tunneling EAP within another protocol enables an attack by a rogue
   EAP authenticator tunneling EAP to a legitimate server.  Where the
   tunneling protocol is used for key establishment but does not require
   peer authentication, an attacker convincing a legitimate peer to
   connect to it will be able to tunnel EAP packets to a legitimate
   server, successfully authenticating and obtaining the key.  This
   allows the attacker to successfully establish itself as a man-in-
   the-middle, gaining access to the network, as well as the ability to
   decrypt data traffic between the legitimate peer and server.

   This attack may be mitigated by the following measures:

   [a] Requiring mutual authentication within EAP tunneling mechanisms.

   [b] Requiring cryptographic binding between the EAP tunneling
       protocol and the tunneled EAP methods.  Where cryptographic
       binding is supported, a mechanism is also needed to protect
       against downgrade attacks that would bypass it.  For further
       details on cryptographic binding, see [BINDING].

Aboba, et al.               Standards Track                    [Page 47]
RFC 3748                          EAP                          June 2004

   [c] Limiting the EAP methods authorized for use without protection,
       based on peer and authenticator policy.

   [d] Avoiding the use of tunnels when a single, strong method is

7.5.  Packet Modification Attacks

   While EAP methods may support per-packet data origin authentication,
   integrity, and replay protection, support is not provided within the
   EAP layer.

   Since the Identifier is only a single octet, it is easy to guess,
   allowing an attacker to successfully inject or replay EAP packets.
   An attacker may also modify EAP headers (Code, Identifier, Length,
   Type) within EAP packets where the header is unprotected.  This could
   cause packets to be inappropriately discarded or misinterpreted.

   To protect EAP packets against modification, spoofing, or replay,
   methods supporting protected ciphersuite negotiation, mutual
   authentication, and key derivation, as well as integrity and replay
   protection, are recommended.  See Section 7.2.1 for definitions of
   these security claims.

   Method-specific MICs may be used to provide protection.  If a per-
   packet MIC is employed within an EAP method, then peers,
   authentication servers, and authenticators not operating in pass-
   through mode MUST validate the MIC.  MIC validation failures SHOULD
   be logged.  Whether a MIC validation failure is considered a fatal
   error or not is determined by the EAP method specification.

   It is RECOMMENDED that methods providing integrity protection of EAP
   packets include coverage of all the EAP header fields, including the
   Code, Identifier, Length, Type, and Type-Data fields.

   Since EAP messages of Types Identity, Notification, and Nak do not
   include their own MIC, it may be desirable for the EAP method MIC to
   cover information contained within these messages, as well as the
   header of each EAP message.

   To provide protection, EAP also may be encapsulated within a
   protected channel created by protocols such as ISAKMP [RFC2408], as
   is done in [IKEv2] or within TLS [RFC2246].  However, as noted in
   Section 7.4, EAP tunneling may result in a man-in-the-middle

Aboba, et al.               Standards Track                    [Page 48]
RFC 3748                          EAP                          June 2004

   Existing EAP methods define message integrity checks (MICs) that
   cover more than one EAP packet.  For example, EAP-TLS [RFC2716]
   defines a MIC over a TLS record that could be split into multiple
   fragments; within the FINISHED message, the MIC is computed over
   previous messages.  Where the MIC covers more than one EAP packet, a
   MIC validation failure is typically considered a fatal error.

   Within EAP-TLS [RFC2716], a MIC validation failure is treated as a
   fatal error, since that is what is specified in TLS [RFC2246].
   However, it is also possible to develop EAP methods that support
   per-packet MICs, and respond to verification failures by silently
   discarding the offending packet.

   In this document, descriptions of EAP message handling assume that
   per-packet MIC validation, where it occurs, is effectively performed
   as though it occurs before sending any responses or changing the
   state of the host which received the packet.

7.6.  Dictionary Attacks

   Password authentication algorithms such as EAP-MD5, MS-CHAPv1
   [RFC2433], and Kerberos V [RFC1510] are known to be vulnerable to
   dictionary attacks.  MS-CHAPv1 vulnerabilities are documented in
   [PPTPv1]; MS-CHAPv2 vulnerabilities are documented in [PPTPv2];
   Kerberos vulnerabilities are described in [KRBATTACK], [KRBLIM], and

   In order to protect against dictionary attacks, authentication
   methods resistant to dictionary attacks (as defined in Section 7.2.1)
   are recommended.

   If an authentication algorithm is used that is known to be vulnerable
   to dictionary attacks, then the conversation may be tunneled within a
   protected channel in order to provide additional protection.
   However, as noted in Section 7.4, EAP tunneling may result in a man-
   in-the-middle vulnerability, and therefore dictionary attack
   resistant methods are preferred.

7.7.  Connection to an Untrusted Network

   With EAP methods supporting one-way authentication, such as EAP-MD5,
   the peer does not authenticate the authenticator, making the peer
   vulnerable to attack by a rogue authenticator.  Methods supporting
   mutual authentication (as defined in Section 7.2.1) address this

   In EAP there is no requirement that authentication be full duplex or
   that the same protocol be used in both directions.  It is perfectly

Aboba, et al.               Standards Track                    [Page 49]
RFC 3748                          EAP                          June 2004

   acceptable for different protocols to be used in each direction.
   This will, of course, depend on the specific protocols negotiated.
   However, in general, completing a single unitary mutual
   authentication is preferable to two one-way authentications, one in
   each direction.  This is because separate authentications that are
   not bound cryptographically so as to demonstrate they are part of the
   same session are subject to man-in-the-middle attacks, as discussed
   in Section 7.4.

7.8.  Negotiation Attacks

   In a negotiation attack, the attacker attempts to convince the peer
   and authenticator to negotiate a less secure EAP method.  EAP does
   not provide protection for Nak Response packets, although it is
   possible for a method to include coverage of Nak Responses within a
   method-specific MIC.

   Within or associated with each authenticator, it is not anticipated
   that a particular named peer will support a choice of methods.  This
   would make the peer vulnerable to attacks that negotiate the least
   secure method from among a set.  Instead, for each named peer, there
   SHOULD be an indication of exactly one method used to authenticate
   that peer name.  If a peer needs to make use of different
   authentication methods under different circumstances, then distinct
   identities SHOULD be employed, each of which identifies exactly one
   authentication method.

7.9.  Implementation Idiosyncrasies

   The interaction of EAP with lower layers such as PPP and IEEE 802 are
   highly implementation dependent.

   For example, upon failure of authentication, some PPP implementations
   do not terminate the link, instead limiting traffic in Network-Layer
   Protocols to a filtered subset, which in turn allows the peer the
   opportunity to update secrets or send mail to the network
   administrator indicating a problem.  Similarly, while an
   authentication failure will result in denied access to the controlled
   port in [IEEE-802.1X], limited traffic may be permitted on the
   uncontrolled port.

   In EAP there is no provision for retries of failed authentication.
   However, in PPP the LCP state machine can renegotiate the
   authentication protocol at any time, thus allowing a new attempt.
   Similarly, in IEEE 802.1X the Supplicant or Authenticator can re-
   authenticate at any time.  It is recommended that any counters used
   for authentication failure not be reset until after successful
   authentication, or subsequent termination of the failed link.

Aboba, et al.               Standards Track                    [Page 50]
RFC 3748                          EAP                          June 2004

7.10.  Key Derivation

   It is possible for the peer and EAP server to mutually authenticate
   and derive keys.  In order to provide keying material for use in a
   subsequently negotiated ciphersuite, an EAP method supporting key
   derivation MUST export a Master Session Key (MSK) of at least 64
   octets, and an Extended Master Session Key (EMSK) of at least 64
   octets.  EAP Methods deriving keys MUST provide for mutual
   authentication between the EAP peer and the EAP Server.

   The MSK and EMSK MUST NOT be used directly to protect data; however,
   they are of sufficient size to enable derivation of a AAA-Key
   subsequently used to derive Transient Session Keys (TSKs) for use
   with the selected ciphersuite.  Each ciphersuite is responsible for
   specifying how to derive the TSKs from the AAA-Key.

   The AAA-Key is derived from the keying material exported by the EAP
   method (MSK and EMSK).  This derivation occurs on the AAA server.  In
   many existing protocols that use EAP, the AAA-Key and MSK are
   equivalent, but more complicated mechanisms are possible (see
   [KEYFRAME] for details).

   EAP methods SHOULD ensure the freshness of the MSK and EMSK, even in
   cases where one party may not have a high quality random number
   generator.  A RECOMMENDED method is for each party to provide a nonce
   of at least 128 bits, used in the derivation of the MSK and EMSK.

   EAP methods export the MSK and EMSK, but not Transient Session Keys
   so as to allow EAP methods to be ciphersuite and media independent.
   Keying material exported by EAP methods MUST be independent of the
   ciphersuite negotiated to protect data.

   Depending on the lower layer, EAP methods may run before or after
   ciphersuite negotiation, so that the selected ciphersuite may not be
   known to the EAP method.  By providing keying material usable with
   any ciphersuite, EAP methods can used with a wide range of
   ciphersuites and media.

   In order to preserve algorithm independence, EAP methods deriving
   keys SHOULD support (and document) the protected negotiation of the
   ciphersuite used to protect the EAP conversation between the peer and
   server.  This is distinct from the ciphersuite negotiated between the
   peer and authenticator, used to protect data.

   The strength of Transient Session Keys (TSKs) used to protect data is
   ultimately dependent on the strength of keys generated by the EAP
   method.  If an EAP method cannot produce keying material of
   sufficient strength, then the TSKs may be subject to a brute force

Aboba, et al.               Standards Track                    [Page 51]
RFC 3748                          EAP                          June 2004

   attack.  In order to enable deployments requiring strong keys, EAP
   methods supporting key derivation SHOULD be capable of generating an
   MSK and EMSK, each with an effective key strength of at least 128

   Methods supporting key derivation MUST demonstrate cryptographic
   separation between the MSK and EMSK branches of the EAP key
   hierarchy.  Without violating a fundamental cryptographic assumption
   (such as the non-invertibility of a one-way function), an attacker
   recovering the MSK or EMSK MUST NOT be able to recover the other
   quantity with a level of effort less than brute force.

   Non-overlapping substrings of the MSK MUST be cryptographically
   separate from each other, as defined in Section 7.2.1.  That is,
   knowledge of one substring MUST NOT help in recovering some other
   substring without breaking some hard cryptographic assumption.  This
   is required because some existing ciphersuites form TSKs by simply
   splitting the AAA-Key to pieces of appropriate length.  Likewise,
   non-overlapping substrings of the EMSK MUST be cryptographically
   separate from each other, and from substrings of the MSK.

   The EMSK is reserved for future use and MUST remain on the EAP peer
   and EAP server where it is derived; it MUST NOT be transported to, or
   shared with, additional parties, or used to derive any other keys.
   (This restriction will be relaxed in a future document that specifies
   how the EMSK can be used.)

   Since EAP does not provide for explicit key lifetime negotiation, EAP
   peers, authenticators, and authentication servers MUST be prepared
   for situations in which one of the parties discards the key state,
   which remains valid on another party.

   This specification does not provide detailed guidance on how EAP
   methods derive the MSK and EMSK, how the AAA-Key is derived from the
   MSK and/or EMSK, or how the TSKs are derived from the AAA-Key.

   The development and validation of key derivation algorithms is
   difficult, and as a result, EAP methods SHOULD re-use well
   established and analyzed mechanisms for key derivation (such as those
   specified in IKE [RFC2409] or TLS [RFC2246]), rather than inventing
   new ones. EAP methods SHOULD also utilize well established and
   analyzed mechanisms for MSK and EMSK derivation.  Further details on
   EAP Key Derivation are provided within [KEYFRAME].

Aboba, et al.               Standards Track                    [Page 52]
RFC 3748                          EAP                          June 2004

7.11.  Weak Ciphersuites

   If after the initial EAP authentication, data packets are sent
   without per-packet authentication, integrity, and replay protection,
   an attacker with access to the media can inject packets, "flip bits"
   within existing packets, replay packets, or even hijack the session
   completely.  Without per-packet confidentiality, it is possible to
   snoop data packets.

   To protect against data modification, spoofing, or snooping, it is
   recommended that EAP methods supporting mutual authentication and key
   derivation (as defined by Section 7.2.1) be used, along with lower
   layers providing per-packet confidentiality, authentication,
   integrity, and replay protection.

   Additionally, if the lower layer performs ciphersuite negotiation, it
   should be understood that EAP does not provide by itself integrity
   protection of that negotiation.  Therefore, in order to avoid
   downgrading attacks which would lead to weaker ciphersuites being
   used, clients implementing lower layer ciphersuite negotiation SHOULD
   protect against negotiation downgrading.

   This can be done by enabling users to configure which ciphersuites
   are acceptable as a matter of security policy, or the ciphersuite
   negotiation MAY be authenticated using keying material derived from
   the EAP authentication and a MIC algorithm agreed upon in advance by
   lower-layer peers.

7.12.  Link Layer

   There are reliability and security issues with link layer indications
   in PPP, IEEE 802 LANs, and IEEE 802.11 wireless LANs:

   [a] PPP.  In PPP, link layer indications such as LCP-Terminate (a
       link failure indication) and NCP (a link success indication) are
       not authenticated or integrity protected.  They can therefore be
       spoofed by an attacker with access to the link.

   [b] IEEE 802.  IEEE 802.1X EAPOL-Start and EAPOL-Logoff frames are
       not authenticated or integrity protected.  They can therefore be
       spoofed by an attacker with access to the link.

   [c] IEEE 802.11.  In IEEE 802.11, link layer indications include
       Disassociate and Deauthenticate frames (link failure
       indications), and the first message of the 4-way handshake (link
       success indication).  These messages are not authenticated or
       integrity protected, and although they are not forwardable, they
       are spoofable by an attacker within range.

Aboba, et al.               Standards Track                    [Page 53]
RFC 3748                          EAP                          June 2004

   In IEEE 802.11, IEEE 802.1X data frames may be sent as Class 3
   unicast data frames, and are therefore forwardable.  This implies
   that while EAPOL-Start and EAPOL-Logoff messages may be authenticated
   and integrity protected, they can be spoofed by an authenticated
   attacker far from the target when "pre-authentication" is enabled.

   In IEEE 802.11, a "link down" indication is an unreliable indication
   of link failure, since wireless signal strength can come and go and
   may be influenced by radio frequency interference generated by an
   attacker.  To avoid unnecessary resets, it is advisable to damp these
   indications, rather than passing them directly to the EAP.  Since EAP
   supports retransmission, it is robust against transient connectivity

7.13.  Separation of Authenticator and Backend Authentication Server

   It is possible for the EAP peer and EAP server to mutually
   authenticate and derive a AAA-Key for a ciphersuite used to protect
   subsequent data traffic.  This does not present an issue on the peer,
   since the peer and EAP client reside on the same machine; all that is
   required is for the client to derive the AAA-Key from the MSK and
   EMSK exported by the EAP method, and to subsequently pass a Transient
   Session Key (TSK) to the ciphersuite module.

   However, in the case where the authenticator and authentication
   server reside on different machines, there are several implications
   for security.

   [a] Authentication will occur between the peer and the authentication
       server, not between the peer and the authenticator.  This means
       that it is not possible for the peer to validate the identity of
       the authenticator that it is speaking to, using EAP alone.

   [b] As discussed in [RFC3579], the authenticator is dependent on the
       AAA protocol in order to know the outcome of an authentication
       conversation, and does not look at the encapsulated EAP packet
       (if one is present) to determine the outcome.  In practice, this
       implies that the AAA protocol spoken between the authenticator
       and authentication server MUST support per-packet authentication,
       integrity, and replay protection.

   [c] After completion of the EAP conversation, where lower layer
       security services such as per-packet confidentiality,
       authentication, integrity, and replay protection will be enabled,
       a secure association protocol SHOULD be run between the peer and
       authenticator in order to provide mutual authentication between

Aboba, et al.               Standards Track                    [Page 54]
RFC 3748                          EAP                          June 2004

       the peer and authenticator, guarantee liveness of transient
       session keys, provide protected ciphersuite and capabilities
       negotiation for subsequent data, and synchronize key usage.

   [d] A AAA-Key derived from the MSK and/or EMSK negotiated between the
       peer and authentication server MAY be transmitted to the
       authenticator.  Therefore, a mechanism needs to be provided to
       transmit the AAA-Key from the authentication server to the
       authenticator that needs it.  The specification of the AAA-key
       derivation, transport, and wrapping mechanisms is outside the
       scope of this document.  Further details on AAA-Key Derivation
       are provided within [KEYFRAME].

7.14.  Cleartext Passwords

   This specification does not define a mechanism for cleartext password
   authentication.  The omission is intentional.  Use of cleartext
   passwords would allow the password to be captured by an attacker with
   access to a link over which EAP packets are transmitted.

   Since protocols encapsulating EAP, such as RADIUS [RFC3579], may not
   provide confidentiality, EAP packets may be subsequently encapsulated
   for transport over the Internet where they may be captured by an

   As a result, cleartext passwords cannot be securely used within EAP,
   except where encapsulated within a protected tunnel with server
   authentication.  Some of the same risks apply to EAP methods without
   dictionary attack resistance, as defined in Section 7.2.1.  For
   details, see Section 7.6.

7.15.  Channel Binding

   It is possible for a compromised or poorly implemented EAP
   authenticator to communicate incorrect information to the EAP peer
   and/or server.  This may enable an authenticator to impersonate
   another authenticator or communicate incorrect information via out-
   of-band mechanisms (such as via a AAA or lower layer protocol).

   Where EAP is used in pass-through mode, the EAP peer typically does
   not verify the identity of the pass-through authenticator, it only
   verifies that the pass-through authenticator is trusted by the EAP
   server.  This creates a potential security vulnerability.

   Section 4.3.7 of [RFC3579] describes how an EAP pass-through
   authenticator acting as a AAA client can be detected if it attempts
   to impersonate another authenticator (such by sending incorrect NAS-
   Identifier [RFC2865], NAS-IP-Address [RFC2865] or NAS-IPv6-Address

Aboba, et al.               Standards Track                    [Page 55]
RFC 3748                          EAP                          June 2004

   [RFC3162] attributes via the AAA protocol).  However, it is possible
   for a pass-through authenticator acting as a AAA client to provide
   correct information to the AAA server while communicating misleading
   information to the EAP peer via a lower layer protocol.

   For example, it is possible for a compromised authenticator to
   utilize another authenticator's Called-Station-Id or NAS-Identifier
   in communicating with the EAP peer via a lower layer protocol, or for
   a pass-through authenticator acting as a AAA client to provide an
   incorrect peer Calling-Station-Id [RFC2865][RFC3580] to the AAA
   server via the AAA protocol.

   In order to address this vulnerability, EAP methods may support a
   protected exchange of channel properties such as endpoint
   identifiers, including (but not limited to): Called-Station-Id
   [RFC2865][RFC3580], Calling-Station-Id [RFC2865][RFC3580], NAS-
   Identifier [RFC2865], NAS-IP-Address [RFC2865], and NAS-IPv6-Address

   Using such a protected exchange, it is possible to match the channel
   properties provided by the authenticator via out-of-band mechanisms
   against those exchanged within the EAP method.  Where discrepancies
   are found, these SHOULD be logged; additional actions MAY also be
   taken, such as denying access.

7.16.  Protected Result Indications

   Within EAP, Success and Failure packets are neither acknowledged nor
   integrity protected.  Result indications improve resilience to loss
   of Success and Failure packets when EAP is run over lower layers
   which do not support retransmission or synchronization of the
   authentication state.  In media such as IEEE 802.11, which provides
   for retransmission, as well as synchronization of authentication
   state via the 4-way handshake defined in [IEEE-802.11i], additional
   resilience is typically of marginal benefit.

   Depending on the method and circumstances, result indications can be
   spoofable by an attacker.  A method is said to provide protected
   result indications if it supports result indications, as well as the
   "integrity protection" and "replay protection" claims.  A method
   supporting protected result indications MUST indicate which result
   indications are protected, and which are not.

   Protected result indications are not required to protect against
   rogue authenticators.  Within a mutually authenticating method,
   requiring that the server authenticate to the peer before the peer
   will accept a Success packet prevents an attacker from acting as a
   rogue authenticator.

Aboba, et al.               Standards Track                    [Page 56]
RFC 3748                          EAP                          June 2004

   However, it is possible for an attacker to forge a Success packet
   after the server has authenticated to the peer, but before the peer
   has authenticated to the server.  If the peer were to accept the
   forged Success packet and attempt to access the network when it had
   not yet successfully authenticated to the server, a denial of service
   attack could be mounted against the peer.  After such an attack, if
   the lower layer supports failure indications, the authenticator can
   synchronize state with the peer by providing a lower layer failure
   indication.  See Section 7.12 for details.

   If a server were to authenticate the peer and send a Success packet
   prior to determining whether the peer has authenticated the
   authenticator, an idle timeout can occur if the authenticator is not
   authenticated by the peer.  Where supported by the lower layer, an
   authenticator sensing the absence of the peer can free resources.

   In a method supporting result indications, a peer that has
   authenticated the server does not consider the authentication
   successful until it receives an indication that the server
   successfully authenticated it.  Similarly, a server that has
   successfully authenticated the peer does not consider the
   authentication successful until it receives an indication that the
   peer has authenticated the server.

   In order to avoid synchronization problems, prior to sending a
   success result indication, it is desirable for the sender to verify
   that sufficient authorization exists for granting access, though, as
   discussed below, this is not always possible.

   While result indications may enable synchronization of the
   authentication result between the peer and server, this does not
   guarantee that the peer and authenticator will be synchronized in
   terms of their authorization or that timeouts will not occur.  For
   example, the EAP server may not be aware of an authorization decision
   made by a AAA proxy; the AAA server may check authorization only
   after authentication has completed successfully, to discover that
   authorization cannot be granted, or the AAA server may grant access
   but the authenticator may be unable to provide it due to a temporary
   lack of resources.  In these situations, synchronization may only be
   achieved via lower layer result indications.

   Success indications may be explicit or implicit.  For example, where
   a method supports error messages, an implicit success indication may
   be defined as the reception of a specific message without a preceding
   error message.  Failures are typically indicated explicitly.  As
   described in Section 4.2, a peer silently discards a Failure packet
   received at a point where the method does not explicitly permit this

Aboba, et al.               Standards Track                    [Page 57]
RFC 3748                          EAP                          June 2004

   to be sent.  For example, a method providing its own error messages
   might require the peer to receive an error message prior to accepting
   a Failure packet.

   Per-packet authentication, integrity, and replay protection of result
   indications protects against spoofing.  Since protected result
   indications require use of a key for per-packet authentication and
   integrity protection, methods supporting protected result indications
   MUST also support the "key derivation", "mutual authentication",
   "integrity protection", and "replay protection" claims.

   Protected result indications address some denial-of-service
   vulnerabilities due to spoofing of Success and Failure packets,
   though not all.  EAP methods can typically provide protected result
   indications only in some circumstances.  For example, errors can
   occur prior to key derivation, and so it may not be possible to
   protect all failure indications.  It is also possible that result
   indications may not be supported in both directions or that
   synchronization may not be achieved in all modes of operation.

   For example, within EAP-TLS [RFC2716], in the client authentication
   handshake, the server authenticates the peer, but does not receive a
   protected indication of whether the peer has authenticated it.  In
   contrast, the peer authenticates the server and is aware of whether
   the server has authenticated it.  In the session resumption
   handshake, the peer authenticates the server, but does not receive a
   protected indication of whether the server has authenticated it.  In
   this mode, the server authenticates the peer and is aware of whether
   the peer has authenticated it.

8.  Acknowledgements

   This protocol derives much of its inspiration from Dave Carrel's AHA
   document, as well as the PPP CHAP protocol [RFC1994].  Valuable
   feedback was provided by Yoshihiro Ohba of Toshiba America Research,
   Jari Arkko of Ericsson, Sachin Seth of Microsoft, Glen Zorn of Cisco
   Systems, Jesse Walker of Intel, Bill Arbaugh, Nick Petroni and Bryan
   Payne of the University of Maryland, Steve Bellovin of AT&T Research,
   Paul Funk of Funk Software, Pasi Eronen of Nokia, Joseph Salowey of
   Cisco, Paul Congdon of HP, and members of the EAP working group.

   The use of Security Claims sections for EAP methods, as required by
   Section 7.2 and specified for each EAP method described in this
   document, was inspired by Glen Zorn through [EAP-EVAL].

Aboba, et al.               Standards Track                    [Page 58]
RFC 3748                          EAP                          June 2004

9.  References

9.1.  Normative References

   [RFC1661]          Simpson, W., "The Point-to-Point Protocol (PPP)",
                      STD 51, RFC 1661, July 1994.

   [RFC1994]          Simpson, W., "PPP Challenge Handshake
                      Authentication Protocol (CHAP)", RFC 1994, August

   [RFC2119]          Bradner, S., "Key words for use in RFCs to
                      Indicate Requirement Levels", BCP 14, RFC 2119,
                      March 1997.

   [RFC2243]          Metz, C., "OTP Extended Responses", RFC 2243,
                      November 1997.

   [RFC2279]          Yergeau, F., "UTF-8, a transformation format of
                      ISO 10646", RFC 2279, January 1998.

   [RFC2289]          Haller, N., Metz, C., Nesser, P. and M. Straw, "A
                      One-Time Password System", RFC 2289, February

   [RFC2434]          Narten, T. and H. Alvestrand, "Guidelines for
                      Writing an IANA Considerations Section in RFCs",
                      BCP 26, RFC 2434, October 1998.

   [RFC2988]          Paxson, V. and M. Allman, "Computing TCP's
                      Retransmission Timer", RFC 2988, November 2000.

   [IEEE-802]         Institute of Electrical and Electronics Engineers,
                      "Local and Metropolitan Area Networks: Overview
                      and Architecture", IEEE Standard 802, 1990.

   [IEEE-802.1X]      Institute of Electrical and Electronics Engineers,
                      "Local and Metropolitan Area Networks: Port-Based
                      Network Access Control", IEEE Standard 802.1X,
                      September 2001.

Aboba, et al.               Standards Track                    [Page 59]
RFC 3748                          EAP                          June 2004

9.2.  Informative References

   [RFC793]           Postel, J., "Transmission Control Protocol", STD
                      7, RFC 793, September 1981.

   [RFC1510]          Kohl, J. and B. Neuman, "The Kerberos Network
                      Authentication Service (V5)", RFC 1510, September

   [RFC1750]          Eastlake, D., Crocker, S. and J. Schiller,
                      "Randomness Recommendations for Security", RFC
                      1750, December 1994.

   [RFC2246]          Dierks, T., Allen, C., Treese, W., Karlton, P.,
                      Freier, A. and P. Kocher, "The TLS Protocol
                      Version 1.0", RFC 2246, January 1999.

   [RFC2284]          Blunk, L. and J. Vollbrecht, "PPP Extensible
                      Authentication Protocol (EAP)", RFC 2284, March

   [RFC2486]          Aboba, B. and M. Beadles, "The Network Access
                      Identifier", RFC 2486, January 1999.

   [RFC2408]          Maughan, D., Schneider, M. and M. Schertler,
                      "Internet Security Association and Key Management
                      Protocol (ISAKMP)", RFC 2408, November 1998.

   [RFC2409]          Harkins, D. and D. Carrel, "The Internet Key
                      Exchange (IKE)", RFC 2409, November 1998.

   [RFC2433]          Zorn, G. and S. Cobb, "Microsoft PPP CHAP
                      Extensions", RFC 2433, October 1998.

   [RFC2607]          Aboba, B. and J. Vollbrecht, "Proxy Chaining and
                      Policy Implementation in Roaming", RFC 2607, June

   [RFC2661]          Townsley, W., Valencia, A., Rubens, A., Pall, G.,
                      Zorn, G. and B. Palter, "Layer Two Tunneling
                      Protocol "L2TP"", RFC 2661, August 1999.

   [RFC2716]          Aboba, B. and D. Simon, "PPP EAP TLS
                      Authentication Protocol", RFC 2716, October 1999.

   [RFC2865]          Rigney, C., Willens, S., Rubens, A. and W.
                      Simpson, "Remote Authentication Dial In User
                      Service (RADIUS)", RFC 2865, June 2000.

Aboba, et al.               Standards Track                    [Page 60]
RFC 3748                          EAP                          June 2004

   [RFC2960]          Stewart, R., Xie, Q., Morneault, K., Sharp, C.,
                      Schwarzbauer, H., Taylor, T., Rytina, I., Kalla,
                      M., Zhang, L. and V. Paxson, "Stream Control
                      Transmission Protocol", RFC 2960, October 2000.

   [RFC3162]          Aboba, B., Zorn, G. and D. Mitton, "RADIUS and
                      IPv6", RFC 3162, August 2001.

   [RFC3454]          Hoffman, P. and M. Blanchet, "Preparation of
                      Internationalized Strings ("stringprep")", RFC
                      3454, December 2002.

   [RFC3579]          Aboba, B. and P. Calhoun, "RADIUS (Remote
                      Authentication Dial In User Service) Support For
                      Extensible Authentication Protocol (EAP)", RFC
                      3579, September 2003.

   [RFC3580]          Congdon, P., Aboba, B., Smith, A., Zorn, G. and J.
                      Roese, "IEEE 802.1X Remote Authentication Dial In
                      User Service (RADIUS) Usage Guidelines", RFC 3580,
                      September 2003.

   [RFC3692]          Narten, T., "Assigning Experimental and Testing
                      Numbers Considered Useful", BCP 82, RFC 3692,
                      January 2004.

   [DECEPTION]        Slatalla, M. and J. Quittner, "Masters of
                      Deception", Harper-Collins, New York, 1995.

   [KRBATTACK]        Wu, T., "A Real-World Analysis of Kerberos
                      Password Security", Proceedings of the 1999 ISOC
                      Network and Distributed System Security Symposium,

   [KRBLIM]           Bellovin, S. and M. Merrit, "Limitations of the
                      Kerberos authentication system", Proceedings of
                      the 1991 Winter USENIX Conference, pp. 253-267,

   [KERB4WEAK]        Dole, B., Lodin, S. and E. Spafford, "Misplaced
                      trust:  Kerberos 4 session keys", Proceedings of
                      the Internet Society Network and Distributed
                      System Security Symposium, pp. 60-70, March 1997.

Aboba, et al.               Standards Track                    [Page 61]
RFC 3748                          EAP                          June 2004

   [PIC]              Aboba, B., Krawczyk, H. and Y. Sheffer, "PIC, A
                      Pre-IKE Credential Provisioning Protocol", Work in
                      Progress, October 2002.

   [IKEv2]            Kaufman, C., "Internet Key Exchange (IKEv2)
                      Protocol", Work in Progress, January 2004.

   [PPTPv1]           Schneier, B. and Mudge, "Cryptanalysis of
                      Microsoft's Point-to- Point Tunneling Protocol",
                      Proceedings of the 5th ACM Conference on
                      Communications and Computer Security, ACM Press,
                      November 1998.

   [IEEE-802.11]      Institute of Electrical and Electronics Engineers,
                      "Wireless LAN Medium Access Control (MAC) and
                      Physical Layer (PHY) Specifications", IEEE
                      Standard 802.11, 1999.

   [SILVERMAN]        Silverman, Robert D., "A Cost-Based Security
                      Analysis of Symmetric and Asymmetric Key Lengths",
                      RSA Laboratories Bulletin 13, April 2000 (Revised
                      November 2001),

   [KEYFRAME]         Aboba, B., "EAP Key Management Framework", Work in
                      Progress, October 2003.

   [SASLPREP]         Zeilenga, K., "SASLprep: Stringprep profile for
                      user names and passwords", Work in Progress, March

   [IEEE-802.11i]     Institute of Electrical and Electronics Engineers,
                      "Unapproved Draft Supplement to Standard for
                      Telecommunications and Information Exchange
                      Between Systems - LAN/MAN Specific Requirements -
                      Part 11: Wireless LAN Medium Access Control (MAC)
                      and Physical Layer (PHY) Specifications:
                      Specification for Enhanced Security", IEEE Draft
                      802.11i (work in progress), 2003.

   [DIAM-EAP]         Eronen, P., Hiller, T. and G. Zorn, "Diameter
                      Extensible Authentication Protocol (EAP)
                      Application", Work in Progress, February 2004.

   [EAP-EVAL]         Zorn, G., "Specifying Security Claims for EAP
                      Authentication Types", Work in Progress, October

Aboba, et al.               Standards Track                    [Page 62]
RFC 3748                          EAP                          June 2004

   [BINDING]          Puthenkulam, J., "The Compound Authentication
                      Binding Problem", Work in Progress, October 2003.

   [MITM]             Asokan, N., Niemi, V. and K. Nyberg, "Man-in-the-
                      Middle in Tunneled Authentication Protocols", IACR
                      ePrint Archive Report 2002/163, October 2002,

   [IEEE-802.11i-req] Stanley, D., "EAP Method Requirements for Wireless
                      LANs", Work in Progress, February 2004.

   [PPTPv2]           Schneier, B. and Mudge, "Cryptanalysis of
                      Microsoft's PPTP Authentication Extensions (MS-
                      CHAPv2)", CQRE 99, Springer-Verlag, 1999, pp.

Aboba, et al.               Standards Track                    [Page 63]
RFC 3748                          EAP                          June 2004

Appendix A. Changes from RFC 2284

   This section lists the major changes between [RFC2284] and this
   document.  Minor changes, including style, grammar, spelling, and
   editorial changes are not mentioned here.

   o  The Terminology section (Section 1.2) has been expanded, defining
      more concepts and giving more exact definitions.

   o  The concepts of Mutual Authentication, Key Derivation, and Result
      Indications are introduced and discussed throughout the document
      where appropriate.

   o In Section 2, it is explicitly specified that more than one
      exchange of Request and Response packets may occur as part of the
      EAP authentication exchange.  How this may be used and how it may
      not be used is specified in detail in Section 2.1.

   o  Also in Section 2, some requirements have been made explicit for
      the authenticator when acting in pass-through mode.

   o  An EAP multiplexing model (Section 2.2) has been added to
      illustrate a typical implementation of EAP.  There is no
      requirement that an implementation conform to this model, as long
      as the on-the-wire behavior is consistent with it.

   o  As EAP is now in use with a variety of lower layers, not just PPP
      for which it was first designed, Section 3 on lower layer behavior
      has been added.

   o  In the description of the EAP Request and Response interaction
      (Section 4.1), both the behavior on receiving duplicate requests,
      and when packets should be silently discarded has been more
      exactly specified.  The implementation notes in this section have
      been substantially expanded.

   o  In Section 4.2, it has been clarified that Success and Failure
      packets must not contain additional data, and the implementation
      note has been expanded.  A subsection giving requirements on
      processing of success and failure packets has been added.

   o  Section 5 on EAP Request/Response Types lists two new Type values:
      the Expanded Type (Section 5.7), which is used to expand the Type
      value number space, and the Experimental Type.  In the Expanded
      Type number space, the new Expanded Nak (Section 5.3.2) Type has
      been added.  Clarifications have been made in the description of
      most of the existing Types.  Security claims summaries have been
      added for authentication methods.

Aboba, et al.               Standards Track                    [Page 64]
RFC 3748                          EAP                          June 2004

   o  In Sections 5, 5.1, and 5.2, a requirement has been added such
      that fields with displayable messages should contain UTF-8 encoded
      ISO 10646 characters.

   o  It is now required in Section 5.1 that if the Type-Data field of
      an Identity Request contains a NUL-character, only the part before
      the null is displayed.  RFC 2284 prohibits the null termination of
      the Type-Data field of Identity messages.  This rule has been
      relaxed for Identity Request messages and the Identity Request
      Type-Data field may now be null terminated.

   o  In Section 5.5, support for OTP Extended Responses [RFC2243] has
      been added to EAP OTP.

   o  An IANA Considerations section (Section 6) has been added, giving
      registration policies for the numbering spaces defined for EAP.

   o  The Security Considerations (Section 7) have been greatly
      expanded, giving a much more comprehensive coverage of possible
      threats and other security considerations.

   o  In Section 7.5, text has been added on method-specific behavior,
      providing guidance on how EAP method-specific integrity checks
      should be processed.  Where possible, it is desirable for a
      method-specific MIC to be computed over the entire EAP packet,
      including the EAP layer header (Code, Identifier, Length) and EAP
      method layer header (Type, Type-Data).

   o  In Section 7.14 the security risks involved in use of cleartext
      passwords with EAP are described.

   o  In Section 7.15 text has been added relating to detection of rogue
      NAS behavior.

Aboba, et al.               Standards Track                    [Page 65]
RFC 3748                          EAP                          June 2004

Authors' Addresses

   Bernard Aboba
   Microsoft Corporation
   One Microsoft Way
   Redmond, WA  98052

   Phone: +1 425 706 6605
   Fax:   +1 425 936 6605
   EMail: bernarda@microsoft.com

   Larry J. Blunk
   Merit Network, Inc
   4251 Plymouth Rd., Suite 2000
   Ann Arbor, MI  48105-2785

   Phone: +1 734-647-9563
   Fax:   +1 734-647-3185
   EMail: ljb@merit.edu

   John R. Vollbrecht
   Vollbrecht Consulting LLC
   9682 Alice Hill Drive
   Dexter, MI  48130

   EMail: jrv@umich.edu

   James Carlson
   Sun Microsystems, Inc
   1 Network Drive
   Burlington, MA  01803-2757

   Phone: +1 781 442 2084
   Fax:   +1 781 442 1677
   EMail: james.d.carlson@sun.com

   Henrik Levkowetz
   ipUnplugged AB
   Arenavagen 33
   Stockholm  S-121 28

   Phone: +46 708 32 16 08
   EMail: henrik@levkowetz.com

Aboba, et al.               Standards Track                    [Page 66]
RFC 3748                          EAP                          June 2004

Full Copyright Statement

   Copyright (C) The Internet Society (2004).  This document is subject
   to the rights, licenses and restrictions contained in BCP 78, and
   except as set forth therein, the authors retain all their rights.

   This document and the information contained herein are provided on an

Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at ietf-


   Funding for the RFC Editor function is currently provided by the
   Internet Society.

Aboba, et al.               Standards Track                    [Page 67]