RFC 3748
Extensible Authentication Protocol (EAP)
RFC 3748: Extensible Authentication Protocol (EAP) 🎀
Part 1 of 15 💖
Okay so bestie, this is RFC 3748, which defines the Extensible Authentication Protocol (EAP) 🦋 It's a Standards Track doc, dated June 2004. The authors are B. Aboba (Microsoft), L. Blunk (Merit Network, Inc), J. Vollbrecht (Vollbrecht Consulting LLC), J. Carlson (Sun), and H. Levkowetz, Ed. (ipUnplugged) 🫶 It obsoletes RFC 2284, and the title block doesn't list any Updates entry. It's giving "the new version everyone should use" ✨
Status of this Memo 📜
This doc is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 💬 If you want to know where this protocol stands in the standardization process, check the current edition of the "Internet Official Protocol Standards" (STD 1) 🧐 Distribution of this memo is unlimited, so share away 💅
Copyright Notice 🌸
Copyright (C) The Internet Society (2004).
Abstract 🔥
Okay so this doc defines the Extensible Authentication Protocol (EAP), an authentication framework that supports multiple authentication methods 🌈 EAP usually runs directly over data link layers like Point-to-Point Protocol (PPP) or IEEE 802, and it doesn't need IP for that 🙌 It has its own duplicate elimination and retransmission support, but it relies on lower layer ordering guarantees, so that's a dependency to know about 👀 Fragmentation isn't supported inside EAP itself, but individual EAP methods may support it, so that's the methods' job 🧚
This doc obsoletes RFC 2284, and you can find a summary of the changes from RFC 2284 in Appendix A 💜
Table of Contents 🗂️
1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Specification of Requirements . . . . . . . . . . . . . 4
1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . 4
1.3. Applicability . . . . . . . . . . . . . . . . . . . . . 6
2. Extensible Authentication Protocol (EAP). . . . . . . . . . . 7
2.1. Support for Sequences . . . . . . . . . . . . . . . . . 9
2.2. EAP Multiplexing Model. . . . . . . . . . . . . . . . . 10
2.3. Pass-Through Behavior . . . . . . . . . . . . . . . . . 12
2.4. Peer-to-Peer Operation. . . . . . . . . . . . . . . . . 14
3. Lower Layer Behavior. . . . . . . . . . . . . . . . . . . . . 15
3.1. Lower Layer Requirements. . . . . . . . . . . . . . . . 15
3.2. EAP Usage Within PPP. . . . . . . . . . . . . . . . . . 18
3.2.1. PPP Configuration Option Format. . . . . . . . . 18
3.3. EAP Usage Within IEEE 802 . . . . . . . . . . . . . . . 19
3.4. Lower Layer Indications . . . . . . . . . . . . . . . . 19
4. EAP Packet Format . . . . . . . . . . . . . . . . . . . . . . 20
4.1. Request and Response. . . . . . . . . . . . . . . . . . 21
4.2. Success and Failure . . . . . . . . . . . . . . . . . . 23
4.3. Retransmission Behavior . . . . . . . . . . . . . . . . 26
5. Initial EAP Request/Response Types. . . . . . . . . . . . . . 27
5.1. Identity. . . . . . . . . . . . . . . . . . . . . . . . 28
5.2. Notification. . . . . . . . . . . . . . . . . . . . . . 29
5.3. Nak . . . . . . . . . . . . . . . . . . . . . . . . . . 31
5.3.1. Legacy Nak . . . . . . . . . . . . . . . . . . . 31
5.3.2. Expanded Nak . . . . . . . . . . . . . . . . . . 32
5.4. MD5-Challenge . . . . . . . . . . . . . . . . . . . . . 35
5.5. One-Time Password (OTP) . . . . . . . . . . . . . . . . 36
5.6. Generic Token Card (GTC). . . . . . . . . . . . . . . . 37
5.7. Expanded Types. . . . . . . . . . . . . . . . . . . . . 38
5.8. Experimental. . . . . . . . . . . . . . . . . . . . . . 40
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 40
6.1. Packet Codes. . . . . . . . . . . . . . . . . . . . . . 41
6.2. Method Types. . . . . . . . . . . . . . . . . . . . . . 41
7. Security Considerations . . . . . . . . . . . . . . . . . . . 42
7.1. Threat Model. . . . . . . . . . . . . . . . . . . . . . 42
7.2. Security Claims . . . . . . . . . . . . . . . . . . . . 43
7.2.1. Security Claims Terminology for EAP Methods. . . 44
7.3. Identity Protection . . . . . . . . . . . . . . . . . . 46
7.4. Man-in-the-Middle Attacks . . . . . . . . . . . . . . . 47
7.5. Packet Modification Attacks . . . . . . . . . . . . . . 48
7.6. Dictionary Attacks. . . . . . . . . . . . . . . . . . . 49
7.7. Connection to an Untrusted Network. . . . . . . . . . . 49
7.8. Negotiation Attacks . . . . . . . . . . . . . . . . . . 50
7.9. Implementation Idiosyncrasies . . . . . . . . . . . . . 50
7.10. Key Derivation. . . . . . . . . . . . . . . . . . . . . 51
7.11. Weak Ciphersuites . . . . . . . . . . . . . . . . . . . 53
7.12. Link Layer. . . . . . . . . . . . . . . . . . . . . . . 53
7.13. Separation of Authenticator and Backend Authentication
Server. . . . . . . . . . . . . . . . . . . . . . . . . 54
7.14. Cleartext Passwords . . . . . . . . . . . . . . . . . . 55
7.15. Channel Binding . . . . . . . . . . . . . . . . . . . . 55
7.16. Protected Result Indications. . . . . . . . . . . . . . 56
8. Acknowledgements. . . . . . . . . . . . . . . . . . . . . . . 58
9. References. . . . . . . . . . . . . . . . . . . . . . . . . . 59
9.1. Normative References. . . . . . . . . . . . . . . . . . 59
9.2. Informative References. . . . . . . . . . . . . . . . . 60
Appendix A. Changes from RFC 2284. . . . . . . . . . . . . . . . . 64
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 66
Full Copyright Statement . . . . . . . . . . . . . . . . . . . . . 671. Introduction 🧚
Bestie, the intro basically restates the abstract: this doc defines EAP, an authentication framework with support for multiple authentication methods 💖 It typically runs straight over data link layers like Point-to-Point Protocol (PPP) or IEEE 802, no IP needed 🫶 It handles duplicate elimination and retransmission itself, but it leans on lower layer ordering guarantees, and fragmentation is left to individual EAP methods 🦋
EAP can be used on dedicated links, switched circuits, wired links, and wireless links 🌈 So far it's been implemented with hosts and routers that connect over switched circuits or dial-up lines using PPP [RFC1661] ✨ It's also been implemented with switches and access points using IEEE 802 [IEEE-802] 💜 EAP encapsulation on IEEE 802 wired media is described in [IEEE-802.1X], and encapsulation on IEEE wireless LANs is in [IEEE-802.11i] 🎀
The best part of the EAP architecture is how flexible it is 🔥 EAP is used to pick a specific authentication mechanism, and that usually happens after the authenticator asks for more information so it can figure out which method to use 🧐 Instead of making the authenticator updated for every new authentication method, EAP lets you use a backend authentication server. That server may implement some or all of the methods, and the authenticator acts as a pass-through for some or all methods and peers 🙌 Iconic design, honestly 👑
Within this doc, the authenticator requirements apply whether the authenticator is operating as a pass-through or not 💅 When a requirement is meant to apply to either the authenticator or the backend authentication server, depending on where EAP authentication is terminated, the doc uses the term "EAP server" 🍓
1.1. Specification of Requirements 📜
Okay so this section explains how the requirement words work 🌸 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💜 Those are the words that carry the actual weight, so read them carefully, bestie 🫶
1.2. Terminology ✨
okay bestie, this is the glossary section 📖 the doc uses these terms constantly, so let's get them locked in 🔒
authenticator The end of the link that starts EAP authentication 🚀 [IEEE-802.1X] uses this word too, and it means the same thing here 💜
peer The end of the link that replies to the authenticator 🫶 In [IEEE-802.1X], this one gets called the Supplicant.
Supplicant This is the [IEEE-802.1X] name for the end of the link that answers the authenticator. In this doc we just call it the peer, so no mix-ups 🎀
backend authentication server An entity that gives an authentication service to an authenticator. When it's involved, it's usually the one running the EAP methods on the authenticator's behalf 👑 [IEEE-802.1X] uses this term as well.
AAA Authentication, Authorization, and Accounting 🧚 AAA protocols that support EAP include RADIUS [RFC3579] and Diameter [DIAM-EAP]. In this document, "AAA server" and "backend authentication server" mean the same thing, so you can use either one 🦋
Displayable Message This basically means a human-readable string of characters 💬 The message encoding MUST follow the UTF-8 transformation format [RFC2279]. No skipping that, periodt 💅
EAP server The entity that ends the EAP authentication method with the peer 🌸 If there's no backend authentication server, the EAP server lives inside the authenticator. If the authenticator is running in pass-through mode, the EAP server is on the backend authentication server instead.
Silently Discard The implementation throws the packet away without doing anything else with it 🙈 It SHOULD be able to log the event, including the contents of the silently discarded packet, and it SHOULD record the event in a statistics counter. Very organised of it, honestly 🍓
Successful Authentication In this doc, "successful authentication" means an exchange of EAP messages where the authenticator decides to let the peer in, and the peer decides to actually use that access ✨ The authenticator's call usually covers both authentication and authorization. So the peer can totally authenticate and still get denied because of policy reasons. Not fair, but that's how it goes 😭
Message Integrity Check (MIC) A keyed hash function used for authentication and for protecting data integrity 🔐 People usually call this a Message Authentication Code (MAC), but IEEE 802 specs (and this doc) say MIC so it doesn't get confused with Medium Access Control 🙄
Cryptographic Separation Two keys, x and y, are "cryptographically separate" if an adversary who knows every message exchanged in the protocol still can't work out x from y, or y from x, without "breaking" some cryptographic assumption 🔥 This explicitly allows the adversary to know every nonce sent in cleartext, plus all the predictable counter values used in the protocol. Breaking the assumption would normally mean inverting a one-way function, or predicting the output of a cryptographic pseudo-random number generator without knowing its secret state. So: if the keys are cryptographically separate, there's no shortcut to get x from y or y from x. The attacker's work ends up equal to doing an exhaustive search for the secret state value 💀
Master Session Key (MSK) Keying material derived between the EAP peer and server, and exported by the EAP method 🗝️ The MSK is at least 64 octets long. In existing implementations, an AAA server acting as an EAP server passes the MSK along to the authenticator 💌
Extended Master Session Key (EMSK) Extra keying material derived between the EAP client and server, also exported by the EAP method 🌈 The EMSK is at least 64 octets long. It is not shared with the authenticator or any other third party, and it's saved for future uses that haven't been defined yet 🧸
Result indications A method provides result indications if, after the method's last message is sent and received:
- The peer knows whether it has authenticated the server, and whether the server has authenticated it 🫶
- The server knows whether it has authenticated the peer, and whether the peer has authenticated it 🫶
If successful authentication is enough to authorize access, then the peer and the authenticator will also know whether the other party is willing to provide or accept access 🎟️ That's not always the case, though. An authenticated peer can still be denied access because of lack of authorization (like a session limit) or other reasons 🙃 Since the EAP exchange happens between the peer and the server, other nodes (like AAA proxies) can also affect the authorization decision. There's more on this in Section 7.16 👀
1.3. Applicability
okay so EAP was built for network access authentication, where IP layer connectivity might not even be around 🛜 Using EAP for other stuff, like bulk data transport, is NOT RECOMMENDED 🙅♀️
Since EAP doesn't need IP connectivity, it gives you just enough support to reliably carry authentication protocols, and nothing extra 🎀
EAP is a lock-step protocol that only allows a single packet in flight 🐢 Because of that, EAP can't efficiently move bulk data, unlike transport protocols such as TCP [RFC793] or SCTP [RFC2960] 💅
EAP does support retransmission, but it assumes the lower layer already gives it ordering guarantees. That means out-of-order reception isn't supported 🙈
EAP doesn't support fragmentation and reassembly, so EAP authentication methods that generate payloads larger than the minimum EAP MTU need to provide fragmentation support themselves 🧩
Methods like EAP-TLS [RFC2716] do provide fragmentation and reassembly, but the EAP methods defined in this document don't. So if the EAP packet size goes over the EAP MTU of the link, these methods are going to have a rough time 😭
EAP authentication is started by the server (authenticator), whereas lots of authentication protocols are started by the client (peer) 🔄 Because of that, an authentication algorithm might need to add one or two extra messages (at most one roundtrip) to run over EAP 🔁
When certificate-based authentication is supported, the number of extra roundtrips can get way bigger because of certificate chain fragmentation 📜 In general, a fragmented EAP packet needs as many round-trips to send as it has fragments. For example, a certificate chain that's 14960 octets would take ten round-trips to send with a 1496 octet EAP MTU 🌊
If EAP runs over a lower layer that loses a lot of packets, or if the connection between the authenticator and the authentication server loses a lot of packets, EAP methods that need many round-trips can really struggle 🥺 In those situations, it's a good idea to use EAP methods with fewer roundtrips.
2. Extensible Authentication Protocol (EAP) 🦋
okay here's how the EAP authentication exchange goes, step by step 👣
[1] The authenticator sends a Request to authenticate the peer 📣 The Request has a Type field that says what's being asked for. Examples of Request Types are Identity, MD5-challenge, and so on. The MD5-challenge Type is pretty close to the CHAP authentication protocol [RFC1994] 💜 Usually the authenticator starts by sending an initial Identity Request, but an initial Identity Request is not required, and it MAY be bypassed 🙌 For example, the identity might not be needed if it's already determined by the port the peer connected to (leased lines, dedicated switch or dial-up ports), or if it's obtained some other way (through calling station identity or MAC address, or in the Name field of the MD5-Challenge Response, etc.) ✨
[2] The peer sends a Response packet in reply to a valid Request 💌 Just like the Request, the Response packet has a Type field, and it matches the Type field of the Request 🎀
[3] The authenticator sends another Request packet, and the peer replies with a Response 🔁 This keeps going for as long as it needs to. EAP is a 'lock step' protocol, so apart from the initial Request, a new Request can't be sent until a valid Response comes back 🐢 The authenticator is in charge of retransmitting requests, as described in Section 4.1 📮 After a suitable number of retransmissions, the authenticator SHOULD end the EAP conversation. The authenticator MUST NOT send a Success or Failure packet when it's retransmitting, or when it fails to get a response from the peer 🙅♀️
[4] The conversation keeps going until the authenticator can't authenticate the peer (because of unacceptable Responses to one or more Requests). In that case, the authenticator implementation MUST transmit an EAP Failure (Code 4) 💀 Otherwise, the authentication conversation can continue until the authenticator decides that successful authentication has happened. When that happens, the authenticator MUST transmit an EAP Success (Code 3) 🎉
Advantages:
- EAP can support multiple authentication mechanisms without having to pre-negotiate a specific one 🧠
- Network Access Server (NAS) devices (like a switch or access point) don't have to understand every authentication method, and they MAY act as a pass-through agent for a backend authentication server 🚪 Support for pass-through is optional. An authenticator MAY authenticate local peers, and at the same time act as a pass-through for non-local peers and for authentication methods it doesn't implement locally 🌟
- Separating the authenticator from the backend authentication server makes credentials management and policy decisions simpler 👑
Disadvantages:
- For use in PPP, EAP needs a new authentication Type added to PPP LCP, so PPP implementations will need to be modified to use it 🛠️ It also strays from the old PPP authentication model, where a specific authentication mechanism gets negotiated during LCP. Similarly, switch or access point implementations need to support [IEEE-802.1X] in order to use EAP 😩
- When the authenticator is separate from the backend authentication server, the security analysis gets more complicated and, if needed, so does key distribution 🥀
2.1. Support for Sequences ✨
okay so an EAP conversation MAY utilize a sequence of methods 💅 A super common combo is an Identity request followed by one single EAP authentication method, like MD5-Challenge 🎀 But here's the tea: the peer and authenticator MUST utilize only one authentication method (Type 4 or greater) within an EAP conversation, and then the authenticator MUST send a Success or Failure packet 🔥
Once a peer has sent a Response with the same Type as the first Request, the authenticator MUST NOT send a Request of a different Type before the final round of that method is complete (the only exception is a Notification-Request ✨). It also MUST NOT send a Request for any extra method of any Type after the first method is done. A peer that gets these Requests MUST treat them as invalid and silently discard them. So, no, Identity Requery is not supported 💀
A peer MUST NOT send a Nak (legacy or expanded) in reply to a Request after an initial non-Nak Response has been sent. Since spoofed EAP Request packets may be sent by an attacker, an authenticator that gets an unexpected Nak SHOULD discard it and log the event 👀
Multiple authentication methods in one EAP conversation are not supported, because they're vulnerable to man-in-the-middle attacks (see Section 7.4) and they don't play nicely with existing implementations 😬
Now, if a single EAP authentication method is used but other methods run inside it (a "tunneled" method), the ban on multiple authentication methods doesn't apply 🙌 Those "tunneled" methods look like a single authentication method to EAP. Backward compatibility can be provided, since a peer that doesn't support a "tunneled" method can reply to the initial EAP-Request with a Nak (legacy or expanded) 🦋 To address security vulnerabilities, "tunneled" methods MUST support protection against man-in-the-middle attacks 🔐
2.2. EAP Multiplexing Model 🦋
okay so picture an EAP implementation as being made of these components:
- [a] Lower layer. The lower layer is responsible for transmitting and receiving EAP frames between the peer and authenticator. EAP has run over a bunch of lower layers, including PPP, wired IEEE 802 LANs [IEEE-802.1X], IEEE 802.11 wireless LANs [IEEE-802.11], UDP (L2TP [RFC2661] and IKEv2 [IKEv2]), and TCP [PIC]. Lower layer behavior is discussed in Section 3.
- [b] EAP layer. The EAP layer receives and transmits EAP packets via the lower layer, implements duplicate detection and retransmission, and delivers and receives EAP messages to and from the EAP peer and authenticator layers.
- [c] EAP peer and authenticator layers. Based on the Code field, the EAP layer demultiplexes incoming EAP packets to the EAP peer and authenticator layers. Typically, an EAP implementation on a given host supports either peer or authenticator functionality, but a host can act as both an EAP peer and an authenticator. In that case both the EAP peer and authenticator layers are present.
- [d] EAP method layers. EAP methods implement the authentication algorithms and receive and transmit EAP messages via the EAP peer and authenticator layers. Since EAP itself doesn't provide fragmentation support, that job belongs to the EAP methods, which are discussed in Section 5.
The EAP multiplexing model is illustrated in Figure 1 below. Note that there is no requirement that an implementation conform to this model, as long as the on-the-wire behavior is consistent with it.
+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+
| | | | | |
| EAP method| EAP method| | EAP method| EAP method|
| Type = X | Type = Y | | Type = X | Type = Y |
| V | | | ^ | |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
| ! | | ! |
| EAP ! Peer layer | | EAP ! Auth. layer |
| ! | | ! |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
| ! | | ! |
| EAP ! layer | | EAP ! layer |
| ! | | ! |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
| ! | | ! |
| Lower ! layer | | Lower ! layer |
| ! | | ! |
+-+-+-+-!-+-+-+-+-+-+-+-+ +-+-+-+-!-+-+-+-+-+-+-+-+
! !
! Peer ! Authenticator
+------------>-------------+
Figure 1: EAP Multiplexing ModelWithin EAP, the Code field works a lot like a protocol number in IP 🧚 It's assumed that the EAP layer demultiplexes incoming EAP packets according to the Code field. Received EAP packets with Code=1 (Request), 3 (Success), and 4 (Failure) are delivered by the EAP layer to the EAP peer layer, if implemented. EAP packets with Code=2 (Response) are delivered to the EAP authenticator layer, if implemented.
Within EAP, the Type field works a lot like a port number in UDP or TCP 🌸 It's assumed that the EAP peer and authenticator layers demultiplex incoming EAP packets according to their Type, and deliver them only to the EAP method that matches that Type. An EAP method implementation on a host can register to receive packets from the peer or authenticator layers, or both, depending on which role(s) it supports.
Since EAP authentication methods may want to access the Identity, implementations SHOULD make the Identity Request and Response accessible to authentication methods (Types 4 or greater), in addition to the Identity method. The Identity Type is discussed in Section 5.1.
A Notification Response is only used as confirmation that the peer received the Notification Request. It does NOT mean the peer has processed it or shown the message to the user 🙈 It cannot be assumed that the contents of the Notification Request or Response are available to another method. The Notification Type is discussed in Section 5.2.
Nak (Type 3) or Expanded Nak (Type 254) are used for method negotiation. Peers respond to an initial EAP Request for an unacceptable Type with a Nak Response (Type 3) or Expanded Nak Response (Type 254). It cannot be assumed that the contents of the Nak Response(s) are available to another method. The Nak Type(s) are discussed in Section 5.3.
EAP packets with Codes of Success or Failure don't have a Type field, so they're never delivered to an EAP method. Success and Failure are discussed in Section 4.2.
Given all of this, the Success, Failure, Nak Response(s), and Notification Request/Response messages MUST NOT be used to carry data destined for delivery to other EAP methods 🚫
2.3. Pass-Through Behavior ✨
When operating as a "pass-through authenticator", an authenticator performs checks on the Code, Identifier, and Length fields as described in Section 4.1 💖 It forwards EAP packets received from the peer and destined to its authenticator layer to the backend authentication server. Packets received from the backend authentication server that are destined to the peer get forwarded to it.
A host receiving an EAP packet may only do one of three things with it: act on it, drop it, or forward it. The forwarding decision is typically based only on examining the Code, Identifier, and Length fields. A pass-through authenticator implementation MUST be capable of forwarding EAP packets received from the peer with Code=2 (Response) to the backend authentication server. It also MUST be capable of receiving EAP packets from the backend authentication server and forwarding EAP packets of Code=1 (Request), Code=3 (Success), and Code=4 (Failure) to the peer 🎀
Unless the authenticator implements one or more authentication methods locally that support the authenticator role, the EAP method layer header fields (Type, Type-Data) are not examined as part of the forwarding decision. Where the authenticator supports local authentication methods, it MAY examine the Type field to decide whether to act on the packet itself or forward it. Compliant pass-through authenticator implementations MUST by default forward EAP packets of any Type 💅
EAP packets received with Code=1 (Request), Code=3 (Success), and Code=4 (Failure) are demultiplexed by the EAP layer and delivered to the peer layer. So, unless a host implements an EAP peer layer, these packets will be silently discarded. Similarly, EAP packets received with Code=2 (Response) are demultiplexed by the EAP layer and delivered to the authenticator layer. So, unless a host implements an EAP authenticator layer, these packets will be silently discarded. The behavior of a "pass-through peer" is undefined within this specification, and it's unsupported by AAA protocols like RADIUS [RFC3579] and Diameter [DIAM-EAP] 🙃
The forwarding model is illustrated in Figure 2.
Peer Pass-through Authenticator Authentication
Server
+-+-+-+-+-+-+ +-+-+-+-+-+-+
| | | |
|EAP method | |EAP method |
| V | | ^ |
+-+-+-!-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-!-+-+-+
| ! | |EAP | EAP | | | ! |
| ! | |Peer | Auth.| EAP Auth. | | ! |
|EAP ! peer| | | +-----------+ | |EAP !Auth.|
| ! | | | ! | ! | | ! |
+-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
| ! | | ! | ! | | ! |
|EAP !layer| | EAP !layer| EAP !layer | |EAP !layer|
| ! | | ! | ! | | ! |
+-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
| ! | | ! | ! | | ! |
|Lower!layer| | Lower!layer| AAA ! /IP | | AAA ! /IP |
| ! | | ! | ! | | ! |
+-+-+-!-+-+-+ +-+-+-+-!-+-+-+-+-+-!-+-+-+-+ +-+-+-!-+-+-+
! ! ! !
! ! ! !
+-------->--------+ +--------->-------+
Figure 2: Pass-through AuthenticatorFor sessions where the authenticator acts as a pass-through, it MUST determine the outcome of the authentication solely based on the Accept/Reject indication sent by the backend authentication server. The outcome MUST NOT be determined by the contents of an EAP packet sent along with the Accept/Reject indication, or by the absence of such an encapsulated EAP packet 🌈
2.4. Peer-to-Peer Operation ✨
okay so EAP is a peer-to-peer protocol, which means an independent and simultaneous authentication can happen in the reverse direction too 🔄 (it depends on what the lower layer can do). Both ends of the link can be authenticators and peers at the same time 👯 In that case, both ends have to implement EAP authenticator and peer layers, and the EAP method implementations on both peers must support both authenticator and peer functionality. It's giving symmetry, bestie 💅
Now, EAP supports peer-to-peer operation, but some EAP implementations, methods, AAA protocols, and link layers may not support it 🙈 Some EAP methods do asymmetric authentication, where one type of credential is needed for the peer and a different type for the authenticator. Hosts doing peer-to-peer with a method like that would need to be provisioned with both types of credentials. Not the vibe, but it's real 😭
For example, EAP-TLS [RFC2716] is a client-server protocol where distinct certificate profiles are usually used for the client and the server. So a host doing peer-to-peer authentication with EAP-TLS would need to implement both the EAP peer and authenticator layers, support both peer and authenticator roles in the EAP-TLS implementation, and provision certificates for each role. That's a lot of main character energy 👑
AAA protocols like RADIUS/EAP [RFC3579] and Diameter EAP [DIAM-EAP] only support "pass-through authenticator" operation 🧚 As noted in [RFC3579] Section 2.6.2, a RADIUS server responds to an Access-Request encapsulating an EAP-Request, Success, or Failure packet with an Access-Reject. So there is no support for "pass-through peer" operation. Sad, but that's the tea 🫶
Even where a method supports mutual authentication and result indications, several considerations may mean that two EAP authentications (one in each direction) are required. These include:
[1] Support for bi-directional session key derivation in the lower layer. Lower layers like IEEE 802.11 may only support uni-directional derivation and transport of transient session keys. For example, the group-key handshake defined in [IEEE-802.11i] is uni-directional, since in IEEE 802.11 infrastructure mode, only the Access Point (AP) sends multicast/broadcast traffic. In IEEE 802.11 ad hoc mode, where either peer may send multicast/broadcast traffic, two uni-directional group-key exchanges are required. Due to limitations of the design, this also implies the need for unicast key derivations and EAP method exchanges to occur in each direction. Okay, that's a whole plot twist 🌀
[2] Support for tie-breaking in the lower layer. Lower layers like IEEE 802.11 ad hoc don't support "tie breaking," where two hosts initiating authentication with each other will only go forward with a single authentication. This implies that even if 802.11 supported a bi-directional group-key handshake, two authentications, one in each direction, might still happen. ngl this one is so relatable 🙃
[3] Peer policy satisfaction. EAP methods may support result indications, letting the peer tell the EAP server within the method that it successfully authenticated the EAP server, and letting the server tell the peer that it has authenticated the peer. However, a pass-through authenticator won't know that the peer accepted the credentials offered by the EAP server, unless that information is given to the authenticator via the AAA protocol. The authenticator SHOULD interpret the receipt of a key attribute within an Accept packet as an indication that the peer has successfully authenticated the server. 🔑
However, it's possible that the EAP peer's access policy wasn't satisfied during the initial EAP exchange, even though mutual authentication happened. For example, the EAP authenticator may not have shown it was authorized to act in both peer and authenticator roles. So the peer may need an additional authentication in the reverse direction, even if it indicated that the EAP server had successfully authenticated to it. Rude, but also fair 💀
3. Lower Layer Behavior 🌸
3.1. Lower Layer Requirements
okay so EAP makes these assumptions about lower layers 🧐
[1] Unreliable transport. In EAP, the authenticator retransmits Requests that haven't received Responses yet, so EAP doesn't assume lower layers are reliable. Since EAP defines its own retransmission behavior, it's possible (though undesirable) for retransmission to happen both in the lower layer and the EAP layer when EAP runs over a reliable lower layer. Double-texting energy 📱
Note that EAP Success and Failure packets are not retransmitted. Without a reliable lower layer and with a non-negligible error rate, these packets can get lost, which leads to timeouts. So it's desirable for implementations to get more resilient to loss of EAP Success or Failure packets, as described in Section 4.2. Protect your Success and Failure packets, bestie 🛡️
[2] Lower layer error detection. EAP doesn't assume the lower layer is reliable, but it does rely on lower layer error detection (like CRC, Checksum, MIC, etc.). EAP methods may not include a MIC, or if they do, it may not be computed over all the fields in the EAP packet, such as the Code, Identifier, Length, or Type fields. So without lower layer error detection, undetected errors could creep into the EAP layer or EAP method layer header fields and cause authentication failures 😬
For example, EAP TLS [RFC2716] computes its MIC over the Type-Data field only, and it treats MIC validation failures as a fatal error. Without lower layer error detection, this method (and others like it) won't perform reliably. Big yikes 💔
[3] Lower layer security. EAP doesn't require lower layers to provide security services like per-packet confidentiality, authentication, integrity, and replay protection. However, where those security services are available, EAP methods that support Key Derivation (see Section 7.2.1) can be used to provide dynamic keying material. This makes it possible to bind the EAP authentication to subsequent data and protect against data modification, spoofing, or replay. See Section 7.1 for details 🔐
[4] Minimum MTU. EAP can function on lower layers that provide an EAP MTU size of 1020 octets or greater 📏
EAP doesn't support path MTU discovery, and fragmentation and reassembly isn't supported by EAP, nor by the methods defined in this specification: Identity (1), Notification (2), Nak Response (3), MD5-Challenge (4), One Time Password (5), Generic Token Card (6), and expanded Nak Response (254) Types.
Typically, the EAP peer gets information on the EAP MTU from the lower layers and sets the EAP frame size to an appropriate value. Where the authenticator operates in pass-through mode, the authentication server doesn't have a direct way of figuring out the EAP MTU, so it relies on the authenticator to provide that information, such as via the Framed-MTU attribute, as described in [RFC3579], Section 2.4.
While methods like EAP-TLS [RFC2716] support fragmentation and reassembly, EAP methods originally designed for PPP (where a 1500 octet MTU is guaranteed for control frames, see [RFC1661], Section 6.1) may lack fragmentation and reassembly features. Vintage vibes 📼
EAP methods can assume a minimum EAP MTU of 1020 octets in the absence of other information. EAP methods SHOULD include support for fragmentation and reassembly if their payloads can be larger than this minimum EAP MTU. 🧩
EAP is a lock-step protocol, which means a certain inefficiency when handling fragmentation and reassembly. So if the lower layer supports fragmentation and reassembly (like when EAP is carried over IP), it may be preferable for that to happen in the lower layer rather than in EAP. This can be done by giving EAP an artificially large EAP MTU, so fragmentation and reassembly are handled within the lower layer. Delegate, don't do it all yourself 🫶
[5] Possible duplication. Where the lower layer is reliable, it will give the EAP layer a non-duplicated stream of packets. However, while it's desirable that lower layers provide non-duplication, it's not a requirement. The Identifier field lets both the peer and authenticator detect duplicates 🔍
[6] Ordering guarantees. EAP doesn't require the Identifier to be monotonically increasing, so it relies on lower layer ordering guarantees for correct operation. EAP was originally defined to run on PPP, and [RFC1661] Section 1 has an ordering requirement:
"The Point-to-Point Protocol is designed for simple links which transport packets between two peers. These links provide full-duplex simultaneous bi-directional operation, and are assumed to deliver packets in order."
Lower layer transports for EAP MUST preserve ordering between a source and destination at a given priority level (the ordering guarantee provided by [IEEE-802]). 📬
Reordering, if it happens, will typically cause an EAP authentication failure, which means EAP authentication gets re-run. In an environment where reordering is likely, it's therefore expected that EAP authentication failures will be common. It is RECOMMENDED that EAP only be run over lower layers that provide ordering guarantees; running EAP over raw IP or UDP transport is NOT RECOMMENDED. Encapsulation of EAP within RADIUS [RFC3579] satisfies ordering requirements, since RADIUS is a "lockstep" protocol that delivers packets in order. Lockstep = no drama 🌈
3.2. EAP Usage Within PPP ✨
In order to establish communications over a point-to-point link, each end of the PPP link first sends LCP packets to configure the data link during the Link Establishment phase. After the link is established, PPP provides an optional Authentication phase before moving on to the Network-Layer Protocol phase 🔗
By default, authentication isn't mandatory. If authentication of the link is wanted, an implementation MUST specify the Authentication Protocol Configuration Option during the Link Establishment phase. No skipping this step, bestie 🙅♀️
If the peer's identity has been established in the Authentication phase, the server can use that identity when selecting options for the following network layer negotiations. Identity unlocks the good stuff 🎀
When implemented within PPP, EAP doesn't select a specific authentication mechanism at the PPP Link Control Phase. Instead it postpones that until the Authentication Phase. This lets the authenticator request more information before deciding on the specific authentication mechanism. It also allows the use of a "backend" server that actually implements the various mechanisms, while the PPP authenticator just passes through the authentication exchange. The PPP Link Establishment and Authentication phases, and the Authentication Protocol Configuration Option, are defined in The Point-to-Point Protocol (PPP) [RFC1661]. Lowkey iconic, honestly 🦋
3.2.1. PPP Configuration Option Format 🎀
okay so here's the summary of the PPP Authentication Protocol Configuration Option format used to negotiate EAP 💅 fields go left to right, bestie.
Exactly one EAP packet gets wrapped in the Information field of a PPP Data Link Layer frame whenever the protocol field says C227 (PPP EAP) 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Authentication Protocol |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Type:
3🍓 - Length:
4🍓 - Authentication Protocol:
C227(Hex) for Extensible Authentication Protocol (EAP) ✨
3.3. EAP Usage Within IEEE 802 🌸
the way EAP gets carried over IEEE 802 is defined in [IEEE-802.1X] 🫶 and here's the tea: that encapsulation doesn't involve PPP at all, and IEEE 802.1X doesn't do link or network layer negotiations. so within IEEE 802.1X you literally can't negotiate non-EAP stuff like PAP or CHAP [RFC1994] 🙈
3.4. Lower Layer Indications 🔥
the reliability and security of lower layer indications depends on the lower layer itself 💀 and since EAP is media independent, whether lower layer security is there or not doesn't get factored into how EAP messages are processed.
to level up reliability 📈, if a peer gets a lower layer success indication as defined in Section 7.2, it MAY conclude that a Success packet has been lost, and behave as if it had actually received a Success packet. this includes choosing to ignore the Success in some circumstances, as described in Section 4.2 ✨
there's a whole discussion of reliability and security issues with lower layer indications in PPP, IEEE 802 wired networks, and IEEE 802.11 wireless LANs in the Security Considerations, Section 7.12 🔐
after EAP authentication is done, the peer will typically send and receive data through the authenticator 💌 it's desirable to make sure the entities sending data are the same ones that successfully finished EAP authentication. to pull that off, the lower layer needs to provide per-packet integrity, authentication and replay protection, and it has to bind these per-packet services to the keys derived during EAP authentication. otherwise subsequent data traffic could be modified, spoofed, or replayed 😭
when the keying material for the lower layer ciphersuite is itself provided by EAP, ciphersuite negotiation and key activation are controlled by the lower layer. in PPP, ciphersuites get negotiated within ECP, so you can't use keys derived from EAP authentication until ECP is complete 🧚 which means an initial EAP exchange can't be protected by a PPP ciphersuite, although EAP re-authentication can be protected 💜
in IEEE 802 media, initial key activation also typically happens after EAP authentication is complete 🌈 so an initial EAP exchange typically can't be protected by the lower layer ciphersuite, although an EAP re-authentication or pre-authentication exchange can be protected ✨
4. EAP Packet Format 💖
okay the EAP packet format is next, and it's giving very structured 🎀 fields go left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code | Identifier | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data ...
+-+-+-+-+Code 🦋 is one octet and tells you what Type of EAP packet you're looking at. the Codes are assigned like this:
1Request2Response3Success4Failure
since EAP only defines Codes 1-4, EAP packets with other codes MUST be silently discarded by both authenticators and peers 🙅♀️
Identifier 🍓 is one octet, and it helps match Responses up with Requests.
Length 📏 is two octets and says how long the EAP packet is in octets, counting the Code, Identifier, Length, and Data fields. octets outside the range of the Length field should be treated as Data Link Layer padding, and they MUST be ignored upon reception. a message whose Length field is set to a value bigger than the number of octets received MUST be silently discarded 💀
Data 💜 is zero or more octets. its format is determined by the Code field.
4.1. Request and Response 🎀
Description 💅
the Request packet (Code field set to 1) is sent by the authenticator to the peer. every Request has a Type field that shows what's being asked for. additional Request packets MUST be sent until a valid Response packet arrives, an optional retry counter expires, or a lower layer failure indication comes in 🔥
retransmitted Requests MUST be sent with the same Identifier value so they can be told apart from new Requests. the content of the data field depends on the Request Type. the peer MUST send a Response packet in reply to a valid Request packet. Responses MUST only be sent in reply to a valid Request, and they're never retransmitted on a timer 🙌
if a peer gets a valid duplicate Request it has already answered with a Response, it MUST resend its original Response without reprocessing the Request 🔁 Requests MUST be processed in the order they're received, and MUST be processed to completion before the next Request gets inspected 👑
a summary of the Request and Response packet format is below, fields go left to right 🌸
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code | Identifier | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Type-Data ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-Code 🫶
1for Request2for Response
Identifier 🧚 is one octet. the Identifier MUST stay the same if a Request gets retransmitted because of a timeout while waiting for a Response. any new (non-retransmission) Requests MUST modify the Identifier field 🔄
the Identifier of the Response MUST match the currently outstanding Request. an authenticator that receives a Response whose Identifier doesn't match the currently outstanding Request MUST silently discard that Response 🚫
to avoid mixing up new Requests with retransmissions, the Identifier chosen for each new Request only needs to be different from the previous Request. it doesn't need to be unique within the conversation 🦋 one way to do it is to start the Identifier at an initial value and increment it for each new Request. initializing the first Identifier with a random number instead of starting from zero is recommended, since it makes sequence attacks somewhat harder 🎲
since the Identifier space is unique to each session, authenticators aren't limited to just 256 simultaneous authentication conversations 🙌 similarly, with re-authentication, an EAP conversation might keep going for a long time, and it isn't limited to 256 roundtrips 🌈
Implementation Note: the authenticator is responsible for retransmitting Request messages. if the Request message comes from somewhere else (like a backend authentication server), then the authenticator will need to save a copy of the Request so it can do that 💾 the peer is responsible for detecting and handling duplicate Request messages before processing them in any way, including passing them on to an outside party 🕵️♀️ the authenticator is also responsible for discarding Response messages with a non-matching Identifier value before acting on them in any way, including passing them on to the backend authentication server for verification 🚫 since the authenticator can retransmit before getting a Response from the peer, it can receive multiple Responses, each with a matching Identifier. until a new Request is received by the authenticator, the Identifier value isn't updated, so the authenticator forwards Responses to the backend authentication server one at a time 🫶
Length 📏 is two octets and indicates the length of the EAP packet including the Code, Identifier, Length, Type, and Type-Data fields. octets outside the range of the Length field should be treated as Data Link Layer padding, and they MUST be ignored upon reception. a message with the Length field set to a value larger than the number of received octets MUST be silently discarded 💀
Type 🍓 is one octet. it shows the Type of Request or Response. a single Type MUST be specified for each EAP Request or Response. an initial specification of Types follows in Section 5 of this document 📖
the Type field of a Response MUST either match that of the Request, or correspond to a legacy or Expanded Nak (see Section 5.3) showing that a Request Type is unacceptable to the peer 🙅♀️ a peer MUST NOT send a Nak (legacy or expanded) in response to a Request after an initial non-Nak Response has been sent. an EAP server that receives a Response not meeting these requirements MUST silently discard it 🚫
Type-Data 💖 varies with the Type of Request and the associated Response ✨
4.2. Success and Failure ✨
okay so the Success packet is how the authenticator tells the peer "you're in, bestie!" 🎉 after an EAP authentication method (Type 4 or greater) finishes. It means the peer has authenticated successfully to the authenticator. The authenticator MUST transmit an EAP packet with the Code field set to 3 (Success). If the authenticator can't authenticate the peer (because of unacceptable Responses to one or more Requests), then after the EAP method in progress has unsuccessfully completed, the implementation MUST transmit an EAP packet with the Code field set to 4 (Failure). An authenticator MAY wish to issue multiple Requests before sending a Failure, so people get a chance to fix their human typing mistakes 🙈. Success and Failure packets MUST NOT contain additional data. no extras, just the vibe 💅
Success and Failure packets MUST NOT be sent by an EAP authenticator if the specification of the given method doesn't explicitly permit the method to finish at that point. A peer EAP implementation that receives a Success or Failure packet where sending one isn't explicitly permitted MUST silently discard it. By default, an EAP peer MUST silently discard a "canned" Success packet (a Success packet sent immediately upon connection) 🚫. This is the anti-cheat move 😤: it makes sure a rogue authenticator can't skip mutual authentication by sending a Success before the EAP method conversation is actually over.
Implementation Note: Success and Failure packets aren't acknowledged, so the authenticator doesn't retransmit them, and they can potentially get lost 📭. A peer MUST allow for this circumstance as described in this note. See also Section 3.4 for guidance on processing lower layer success and failure indications.
As described in Section 2.1, only a single EAP authentication method is allowed within an EAP conversation, one method per convo, no drama 👑. EAP methods may implement result indications. After the authenticator sends a failure result indication to the peer, regardless of the peer's response, it MUST subsequently send a Failure packet. After the authenticator sends a success result indication to the peer and receives a success result indication from the peer, it MUST subsequently send a Success packet.
On the peer side, once the method completes unsuccessfully (meaning either the authenticator sends a failure result indication, or the peer decides it doesn't want to keep going, possibly after sending a failure result indication), the peer MUST terminate the conversation and indicate failure to the lower layer 🥀. The peer MUST silently discard Success packets and MAY silently discard Failure packets. So losing a Failure packet doesn't need to cause a timeout, which is lowkey a relief 🌸.
On the peer side, after success result indications have been exchanged by both sides, a Failure packet MUST be silently discarded. The peer MAY, if an EAP Success isn't received, conclude that the EAP Success packet got lost and that authentication concluded successfully 🤞.
If the authenticator hasn't sent a result indication, and the peer is willing to continue the conversation, the peer waits for a Success or Failure packet once the method completes, and MUST NOT silently discard either of them 👀. If neither a Success nor a Failure packet is received, the peer SHOULD terminate the conversation to avoid lengthy timeouts, just in case the lost packet was an EAP Failure.
If the peer tries to authenticate to the authenticator and fails, the authenticator MUST send a Failure packet and MUST NOT grant access by sending a Success packet. Real talk though: an authenticator MAY skip having the peer authenticate to it in situations where limited access is offered (e.g., guest access) 🧁. In that case, the authenticator MUST send a Success packet.
Where the peer authenticates successfully to the authenticator, but the authenticator doesn't send a result indication, the authenticator MAY deny access by sending a Failure packet where the peer isn't currently authorized for network access 🚪.
A summary of the Success and Failure packet format is shown below. The fields are transmitted from left to right 📦.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code | Identifier | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Code
3for Success ✅4for Failure ❌
Identifier
The Identifier field is one octet and helps match replies to Responses 🔗. The Identifier field MUST match the Identifier field of the Response packet that it is sent in response to.
Length
4
4.3. Retransmission Behavior
Because authentication often involves user input, you gotta be careful when picking retransmission strategies and authentication timeouts ⏳. By default, where EAP runs over an unreliable lower layer, the EAP retransmission timer SHOULD be dynamically estimated. A maximum of 3-5 retransmissions is suggested.
When EAP runs over a reliable lower layer (e.g., EAP over ISAKMP/TCP, as within [PIC]), the authenticator retransmission timer SHOULD be set to an infinite value, so retransmissions don't happen at the EAP layer. The peer may still keep a timeout value so it doesn't wait forever for a Request 🕰️.
When the authentication process needs user input, the measured round trip times may come from how fast the user responds rather than network characteristics 🙋. So dynamic RTO estimation may not be helpful. Instead, the retransmission timer SHOULD be set to give the user enough time to respond, with longer timeouts needed in certain cases, like when Token Cards (see Section 5.6) are involved 🎫.
To give the EAP authenticator a hint about a good timeout value, the backend authentication server can communicate one (such as via the RADIUS Session-Timeout attribute) 💌.
To dynamically estimate the EAP retransmission timer, the algorithms for estimating SRTT, RTTVAR, and RTO described in [RFC2988] are RECOMMENDED, including Karn's algorithm, with the following potential modifications:
[a] To avoid synchronization behaviors that can happen with fixed timers across distributed systems, the retransmission timer is calculated with jitter. You take the RTO value and randomly add a value drawn between -RTOmin/2 and RTOmin/2 🎲. Alternative calculations to create jitter MAY be used. These MUST be pseudo-random. For a discussion of pseudo-random number generation, see [RFC1750].
[b] When EAP is transported over a single link (as opposed to over the Internet), smaller values of RTOinitial, RTOmin, and RTOmax MAY be used. Recommended values are RTOinitial=1 second, RTOmin=200ms, and RTOmax=20 seconds ⚡.
[c] When EAP is transported over a single link (as opposed to over the Internet), estimates MAY be done on a per-authenticator basis, rather than a per-session basis. This lets the retransmission estimate make the most of information about link-layer behavior 🧠.
[d] An EAP implementation MAY clear SRTT and RTTVAR after backing off the timer multiple times, since the current SRTT and RTTVAR are likely bogus in that situation 🙃. Once SRTT and RTTVAR are cleared, they should be initialized with the next RTT sample taken as described in [RFC2988] equation 2.2.
5. Initial EAP Request/Response Types 👑
This section defines the initial set of EAP Types used in Request/Response exchanges. More Types may be defined in future documents 🔮. The Type field is one octet and identifies the structure of an EAP Request or Response packet. The first 3 Types are considered special case Types.
The remaining Types define authentication exchanges. Nak (Type 3) or Expanded Nak (Type 254) are valid only for Response packets, they MUST NOT be sent in a Request 🙅♀️.
All EAP implementations MUST support Types 1-4, which are defined in this document, and SHOULD support Type 254. Implementations MAY support other Types defined here or in future RFCs 💖.
1 Identity
2 Notification
3 Nak (Response only)
4 MD5-Challenge
5 One Time Password (OTP)
6 Generic Token Card (GTC)
254 Expanded Types
255 Experimental useEAP methods MAY support authentication based on shared secrets 🔐. If the shared secret is a passphrase the user types in, implementations MAY support entering passphrases with non-ASCII characters 🌍. In that case, the input should be processed using an appropriate stringprep [RFC3454] profile, and encoded in octets using UTF-8 encoding [RFC2279]. A preliminary version of a possible stringprep profile is described in [SASLPREP] ✨.
5.1. Identity 🪪✨
Description
okay so the Identity Type is how the authenticator asks the peer "bestie, who even are you?" 💅 Usually it's the very first Request. An optional displayable message MAY be included to prompt the peer when a real human is expected to interact with it 🫶. A Response of Type 1 (Identity) SHOULD be sent in Response to a Request with a Type of 1 (Identity).
Some EAP implementations piggy-back various options into the Identity Request after a NUL-character 🙈. By default, an EAP implementation SHOULD NOT assume that an Identity Request or Response can be larger than 1020 octets.
It is RECOMMENDED that the Identity Response be used primarily for routing purposes and for selecting which EAP method to use. EAP Methods SHOULD include a method-specific mechanism for obtaining the identity, so they don't have to rely on the Identity Response. Identity Requests and Responses are sent in cleartext, so an attacker may snoop on the identity, or even modify or spoof identity exchanges 💀. To handle these threats, it is preferable for an EAP method to include an identity exchange that supports per-packet authentication, integrity and replay protection, and confidentiality. The Identity Response may not be the right identity for the method. It may have been truncated or obfuscated for privacy, or decorated for routing purposes 🎀. Where the peer is configured to only accept authentication methods that support protected identity exchanges, the peer MAY provide an abbreviated Identity Response (such as omitting the peer-name portion of the NAI [RFC2486]). For more on identity protection, see Section 7.3 🔐.
Implementation Note: The peer MAY obtain the Identity via user input. It is suggested that the authenticator retry the Identity Request in the case of an invalid Identity or authentication failure, to allow for potential typos on the part of the user 🙃. It is suggested that the Identity Request be retried a minimum of 3 times before terminating the authentication. The Notification Request MAY be used to indicate an invalid authentication attempt prior to transmitting a new Identity Request (optionally, the failure MAY be indicated within the message of the new Identity Request itself) ✨.
Type
1
Type-Data
This field MAY contain a displayable message in the Request, containing UTF-8 encoded ISO 10646 characters [RFC2279]. Where the Request contains a null, only the portion of the field prior to the null is displayed. If the Identity is unknown, the Identity Response field should be zero bytes in length. The Identity Response field MUST NOT be null terminated. In all cases, the length of the Type-Data field is derived from the Length field of the Request/Response packet 🧚.
Security Claims (see Section 7.2):
Auth. mechanism: None
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: N/A
Fast reconnect: No
Crypt. binding: N/A
Session independence: N/A
Fragmentation: No
Channel binding: No5.2. Notification 📣🌸
Description
The Notification Type is optionally used to send a displayable message from the authenticator to the peer, like a little "heads up, bestie" 💌. An authenticator MAY send a Notification Request to the peer at any time when there is no outstanding Request, prior to completion of an EAP authentication method. The peer MUST respond to a Notification Request with a Notification Response unless the EAP authentication method specification prohibits the use of Notification messages. In any case, a Nak Response MUST NOT be sent in response to a Notification Request. Note that the default maximum length of a Notification Request is 1020 octets. By default, that leaves at most 1015 octets for the human-readable message 📏.
An EAP method MAY indicate within its specification that Notification messages must not be sent during that method. In this case, the peer MUST silently discard Notification Requests from the point where an initial Request for that Type is answered with a Response of the same Type 🤫.
The peer SHOULD display this message to the user or log it if it cannot be displayed. The Notification Type is meant to provide an acknowledged notification of some imperative nature, but it is not an error indication, so it does not change the state of the peer 🙅♀️. Examples include a password with an expiration time that's about to run out, an OTP sequence integer that's nearing 0, an authentication failure warning, etc. In most circumstances, Notification should not be required 🥹.
Type
2
Type-Data
The Type-Data field in the Request contains a displayable message greater than zero octets in length, containing UTF-8 encoded ISO 10646 characters [RFC2279]. The length of the message is determined by the Length field of the Request packet. The message MUST NOT be null terminated. A Response MUST be sent in reply to the Request with a Type field of 2 (Notification). The Type-Data field of the Response is zero octets in length. The Response should be sent immediately, independent of how the message is displayed or logged ⚡.
Security Claims (see Section 7.2):
Auth. mechanism: None
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: N/A
Fast reconnect: No
Crypt. binding: N/A
Session independence: N/A
Fragmentation: No
Channel binding: No5.3. Nak 🙅♀️💜
5.3.1. Legacy Nak
Description
The legacy Nak Type is valid only in Response messages. It's sent in reply to a Request where the desired authentication Type is unacceptable 🚫. Authentication Types are numbered 4 and above. The Response contains one or more authentication Types desired by the Peer. Type zero (0) is used to indicate that the sender has no viable alternatives, so the authenticator SHOULD NOT send another Request after receiving a Nak Response containing a zero value 🛑.
Since the legacy Nak Type is valid only in Responses and has very limited functionality, it MUST NOT be used as a general purpose error indication, such as for communicating error messages or negotiating parameters specific to a particular EAP method. It's giving "limited scope, don't overstep" energy 💅.
Code
2 for Response.
Identifier
The Identifier field is one octet and helps match Responses with Requests 🔗. The Identifier field of a legacy Nak Response MUST match the Identifier field of the Request packet that it is sent in response to.
Length
>=6
Type
3
Type-Data
Where a peer receives a Request for an unacceptable authentication Type (4-253,255), or a peer lacking support for Expanded Types receives a Request for Type 254, a Nak Response (Type 3) MUST be sent. The Type-Data field of the Nak Response (Type 3) MUST contain one or more octets indicating the desired authentication Type(s), one octet per Type, or the value zero (0) to indicate no proposed alternative 🍓. A peer supporting Expanded Types that receives a Request for an unacceptable authentication Type (4-253, 255) MAY include the value 254 in the Nak Response (Type 3) to indicate the desire for an Expanded authentication Type. If the authenticator can accommodate this preference, it will respond with an Expanded Type Request (Type 254) 🦋.
Security Claims (see Section 7.2):
Auth. mechanism: None
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: N/A
Fast reconnect: No
Crypt. binding: N/A
Session independence: N/A
Fragmentation: No
Channel binding: No5.3.2. Expanded Nak 💖
Description
Okay bestie, the Expanded Nak is the polite "nope, not that one" 💅 and it's only valid in Response messages. It MUST be sent only in reply to a Request of Type 254 (Expanded Type) where the authentication Type is unacceptable. It uses the Expanded Type format itself, and the Response lists one or more authentication Types the peer would like instead, all in Expanded Type format. Type zero (0) means the sender has no viable alternatives. The general format of the Expanded Type is in Section 5.7 🌈
Since the Expanded Nak is only valid in Responses and has very limited functionality, it MUST NOT be used as a general purpose error indication 🙅♀️ like for sending error messages or negotiating parameters that are specific to a particular EAP method. Not the vibe at all! 💀
Code
2 for Response.
Identifier
The Identifier field is one octet and helps match Responses with Requests 🔗 The Identifier field of an Expanded Nak Response MUST match the Identifier field of the Request packet that it is sent in response to.
Length
>=20
Type
254
Vendor-Id
0 (IETF)
Vendor-Type
3 (Nak)
Vendor-Data
The Expanded Nak is only sent when the Request contains an Expanded Type (254) as defined in Section 5.7 🧚 The Vendor-Data field of the Nak Response MUST contain one or more authentication Types (4 or greater), all in expanded format, 8 octets per Type, or the value zero (0), also in Expanded Type format, to show there's no proposed alternative. The desired authentication Types can be a mix of Vendor-Specific and IETF Types, which is so iconic 🦋 For example, an Expanded Nak Response that prefers OTP (Type 5) and an MIT (Vendor-Id=20) Expanded Type of 6 would look like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 2 | Identifier | Length=28 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 (Nak) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 5 (OTP) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 20 (MIT) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 6 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+And an Expanded Nak Response that has no desired alternative would look like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 2 | Identifier | Length=20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 (Nak) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=254 | 0 (IETF) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0 (No alternative) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Security Claims (see Section 7.2):
Auth. mechanism: None
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: N/A
Fast reconnect: No
Crypt. binding: N/A
Session independence: N/A
Fragmentation: No
Channel binding: No5.4. MD5-Challenge 🎀
Description
The MD5-Challenge Type is basically the vibe of the PPP CHAP protocol [RFC1994], with MD5 as the algorithm 🔐 The Request carries a "challenge" message for the peer. A Response MUST be sent in reply to the Request. The Response MAY be Type 4 (MD5-Challenge), Nak (Type 3), or Expanded Nak (Type 254). A Nak reply tells you the peer's desired authentication Type(s). EAP peer and EAP server implementations MUST support the MD5-Challenge mechanism. An authenticator that only does pass-through MUST allow communication with a backend authentication server that can support MD5-Challenge, although the EAP authenticator implementation need not support MD5-Challenge itself. However, if the EAP authenticator can be set up to authenticate peers locally (for example, not doing pass-through), then the requirement to support the MD5-Challenge mechanism applies 🫶
Note that the Identifier field in the MD5-Challenge Type works differently than it does in [RFC1994]. EAP allows MD5-Challenge Request packets to be retransmitted, while [RFC1994] says that both the Identifier and Challenge fields MUST change each time a Challenge (the CHAP version of the MD5-Challenge Request packet) is sent. Different rules, bestie 🙈
Note: [RFC1994] treats the shared secret as an octet string and doesn't say how it gets entered into the system (or if the user handles it at all). EAP MD5-Challenge implementations MAY support entering passphrases with non-ASCII characters. See Section 5 for how the input should be processed and encoded into octets.
Type
4
Type-Data
The Type-Data field is summarized below. For how these fields are used, see the PPP Challenge Handshake Authentication Protocol [RFC1994] 📖
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Value-Size | Value ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Name ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Security Claims (see Section 7.2):
Auth. mechanism: Password or pre-shared key.
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: No
Fast reconnect: No
Crypt. binding: N/A
Session independence: N/A
Fragmentation: No
Channel binding: No5.5. One-Time Password (OTP) 🌸
Description
The One-Time Password system is defined in "A One-Time Password System" [RFC2289] and "OTP Extended Responses" [RFC2243] ⏳ The Request contains an OTP challenge in the format described in [RFC2289]. A Response MUST be sent in reply to the Request. The Response MUST be Type 5 (OTP), Nak (Type 3), or Expanded Nak (Type 254). The Nak Response tells you the peer's desired authentication Type(s). The EAP OTP method is meant for the One-Time Password system only, and it MUST NOT be used to provide support for cleartext passwords. Strictly one-time vibes only 🔑
Type
5
Type-Data
The Type-Data field carries the OTP "challenge" as a displayable message in the Request. In the Response, this field holds the 6 words from the OTP dictionary [RFC2289]. The messages MUST NOT be null terminated. The length of the field comes from the Length field of the Request/Reply packet 📏
Note: [RFC2289] doesn't specify how the secret pass-phrase is entered by the user, or how it gets converted into octets. EAP OTP implementations MAY support entering passphrases with non-ASCII characters. See Section 5 for how the input should be processed and encoded into octets.
Security Claims (see Section 7.2):
Auth. mechanism: One-Time Password
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: Yes
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: No
Fast reconnect: No
Crypt. binding: N/A
Session independence: N/A
Fragmentation: No
Channel binding: No5.6. Generic Token Card (GTC) 🦋
Description
The Generic Token Card Type is for various Token Card implementations that need user input 🪙 The Request has a displayable message, and the Response has the Token Card information needed for authentication. Usually this is info a user reads off the Token Card device and types in as ASCII text 📱 A Response MUST be sent in reply to the Request. The Response MUST be Type 6 (GTC), Nak (Type 3), or Expanded Nak (Type 254). The Nak Response tells you the peer's desired authentication Type(s). The EAP GTC method is meant for Token Cards that support challenge/response authentication, and it MUST NOT be used to provide support for cleartext passwords unless there's a protected tunnel with server authentication. Protect that tunnel, babe 🔒
Type
6
Type-Data
The Type-Data field in the Request contains a displayable message that's more than zero octets long. The length of the message is set by the Length field of the Request packet. The message MUST NOT be null terminated. A Response MUST be sent in reply to the Request with a Type field of 6 (Generic Token Card). The Response has the data from the Token Card needed for authentication, and its length is set by the Length field of the Response packet 💌
EAP GTC implementations MAY support entering a response with non-ASCII characters. See Section 5 for how the input should be processed and encoded into octets. ✨
Security Claims (see Section 7.2):
Auth. mechanism: Hardware token.
Ciphersuite negotiation: No
Mutual authentication: No
Integrity protection: No
Replay protection: No
Confidentiality: No
Key derivation: No
Key strength: N/A
Dictionary attack prot.: No
Fast reconnect: No
Crypt. binding: N/A
Session independence: N/A
Fragmentation: No
Channel binding: No5.7. Expanded Types ✨
Description 💖
okay so, a lot of EAP stuff is vendor-specific, which is why the Expanded method Type exists. It lets vendors support their own Expanded Types that aren't suitable for general usage 🎀
It also expands the global Method Type space beyond the original 255 values. A Vendor-Id of 0 maps the original 255 possible Types onto a space of 2^32-1 possible Types. (Type 0 is only used in a Nak Response to indicate no acceptable alternative 🙈)
An implementation that supports the Expanded attribute MUST treat EAP Types that are less than 256 equivalently, whether they appear as a single octet or as the 32-bit Vendor-Type within an Expanded Type where Vendor-Id is 0. ✨ Peers that aren't equipped to interpret the Expanded Type MUST send a Nak as described in Section 5.3.1, and negotiate a more suitable authentication method 🫶
Here's a summary of the Expanded Type format. The fields are transmitted from left to right 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Vendor-Id |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Vendor-Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Vendor data...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Type 🌈
254 for Expanded Type
Vendor-Id 🍓
The Vendor-Id is 3 octets and represents the SMI Network Management Private Enterprise Code of the Vendor in network byte order, as allocated by IANA. A Vendor-Id of zero is reserved for use by the IETF in providing an expanded global EAP Type space 👑
Vendor-Type 💜
The Vendor-Type field is four octets and represents the vendor-specific method Type.
If the Vendor-Id is zero, the Vendor-Type field is an extension and superset of the existing namespace for EAP Types. The first 256 Types are reserved for compatibility with single-octet EAP Types that have already been assigned or may be assigned in the future. Thus, EAP Types from 0 through 255 are semantically identical, whether they appear as single octet EAP Types or as Vendor-Types when Vendor-Id is zero. There is one exception to this rule: Expanded Nak and Legacy Nak packets share the same Type, but must be treated differently because they have a different format 💅
Vendor-Data 🧚
The Vendor-Data field is defined by the vendor. Where a Vendor-Id of zero is present, the Vendor-Data field will be used for transporting the contents of EAP methods of Types defined by the IETF.
5.8. Experimental 🧪
Description ✨
The Experimental Type has no fixed format or content. It's intended for use when experimenting with new EAP Types, and it's meant for experimental and testing purposes only. No guarantee is made for interoperability between peers using this Type, as outlined in [RFC3692] 🙈
Type 🌸
255
Type-Data 🫧
Undefined
6. IANA Considerations 🌸
This section gives guidance to the Internet Assigned Numbers Authority (IANA) about registering values related to the EAP protocol, in accordance with BCP 26, [RFC2434] 📋
There are two name spaces in EAP that need registration: Packet Codes and method Types 💖
EAP isn't meant to be a general-purpose protocol, so allocations SHOULD NOT be made for purposes unrelated to authentication 🙅♀️
The following terms are used here with the meanings defined in BCP 26: "name space", "assigned value", "registration". ✨
The following policies are used here with the meanings defined in BCP 26: "Private Use", "First Come First Served", "Expert Review", "Specification Required", "IETF Consensus", "Standards Action". 📜
For registration requests where a Designated Expert should be consulted, the responsible IESG area director should appoint the Designated Expert. The intention is that any allocation will be accompanied by a published RFC. But in order to allow for the allocation of values prior to the RFC being approved for publication, the Designated Expert can approve allocations once it seems clear that an RFC will be published. The Designated expert will post a request to the EAP WG mailing list (or a successor designated by the Area Director) for comment and review, including an Internet-Draft. Before a period of 30 days has passed, the Designated Expert will either approve or deny the registration request and publish a notice of the decision to the EAP WG mailing list or its successor, as well as informing IANA. A denial notice must be justified by an explanation, and in the cases where it is possible, concrete suggestions on how the request can be modified so as to become acceptable should be provided. 🫶
6.1. Packet Codes 🎀
Packet Codes have a range from 1 to 255, of which 1-4 have been allocated. Because a new Packet Code has considerable impact on interoperability, a new Packet Code requires Standards Action, and should be allocated starting at 5. 🔥
6.2. Method Types 🦋
The original EAP method Type space has a range from 1 to 255, and is the scarcest resource in EAP, so it must be allocated with care 💎 Method Types 1-45 have been allocated, with 20 available for re-use. Method Types 20 and 46-191 may be allocated on the advice of a Designated Expert, with Specification Required.
Allocation of blocks of method Types (more than one for a given purpose) should require IETF Consensus. EAP Type Values 192-253 are reserved, and allocation requires Standards Action. 🌈
Method Type 254 is allocated for the Expanded Type. Where the Vendor-Id field is non-zero, the Expanded Type is used for functions specific only to one vendor's implementation of EAP, where no interoperability is deemed useful. When used with a Vendor-Id of zero, method Type 254 can also be used to provide for an expanded IETF method Type space. Method Type values 256-4294967295 may be allocated after Type values 1-191 have been allocated, on the advice of a Designated Expert, with Specification Required. 👑
Method Type 255 is allocated for Experimental use, such as testing of new EAP methods before a permanent Type is allocated. 🧪
7. Security Considerations 🔥
This section defines a generic threat model as well as the EAP method security claims that mitigate those threats. 🛡️
It is expected that the generic threat model and corresponding security claims will used to define EAP method requirements for use in specific environments. An example of such a requirements analysis is provided in [IEEE-802.11i-req]. A security claims section is required in EAP method specifications, so that EAP methods can be evaluated against the requirements. 💅
7.1. Threat Model 😭
EAP was developed for use with PPP [RFC1661] and was later adapted for use in wired IEEE 802 networks [IEEE-802] in [IEEE-802.1X]. Subsequently, EAP has been proposed for use on wireless LAN networks and over the Internet. In all these situations, it's possible for an attacker to gain access to links over which EAP packets are transmitted. For example, attacks on telephone infrastructure are documented in [DECEPTION] 📞
An attacker with access to the link may carry out a number of attacks, including:
- [1] An attacker may try to discover user identities by snooping authentication traffic. 👀
- [2] An attacker may try to modify or spoof EAP packets. 🎭
- [3] An attacker may launch denial of service attacks by spoofing lower layer indications or Success/Failure packets, by replaying EAP packets, or by generating packets with overlapping Identifiers. 💀
- [4] An attacker may attempt to recover the pass-phrase by mounting an offline dictionary attack. 🔑
- [5] An attacker may attempt to convince the peer to connect to an untrusted network by mounting a man-in-the-middle attack. 🚨
- [6] An attacker may attempt to disrupt the EAP negotiation in order cause a weak authentication method to be selected. 😤
- [7] An attacker may attempt to recover keys by taking advantage of weak key derivation techniques used within EAP methods. 🗝️
- [8] An attacker may attempt to take advantage of weak ciphersuites subsequently used after the EAP conversation is complete. 🧨
- [9] An attacker may attempt to perform downgrading attacks on lower layer ciphersuite negotiation in order to ensure that a weaker ciphersuite is used subsequently to EAP authentication. ⬇️
- [10] An attacker acting as an authenticator may provide incorrect information to the EAP peer and/or server via out-of-band mechanisms (such as via a AAA or lower layer protocol). This includes impersonating another authenticator, or providing inconsistent information to the peer and EAP server. 👿
Depending on the lower layer, these attacks may be carried out without requiring physical proximity. Where EAP is used over wireless networks, EAP packets may be forwarded by authenticators (e.g., pre-authentication) so that the attacker need not be within the coverage area of an authenticator in order to carry out an attack on it or its peers. Where EAP is used over the Internet, attacks may be carried out at an even greater distance. 🌍
7.2. Security Claims 🔐✨
Okay bestie, so to make it crystal clear what security an EAP method is actually giving you, EAP method specs MUST include a Security Claims section 💅. It needs to cover these declarations:
- [a] Mechanism. This is the authentication tech the method uses: certificates, pre-shared keys, passwords, token cards, etc. 🔑
- [b] Security claims. This is where the method lists its claimed security properties, using the terms defined in Section 7.2.1: mutual authentication, integrity protection, replay protection, confidentiality, key derivation, dictionary attack resistance, fast reconnect, cryptographic binding. The Security Claims section SHOULD give justification for the claims made 🧠. You can do that with a proof in an Appendix, or by pointing to a reference that has one 📎.
- [c] Key strength. If the method derives keys, the effective key strength MUST be estimated 💪. This helps potential users figure out if the keys are strong enough for what they want to use them for.
The effective key strength SHOULD be stated as a number of bits, and the number means this: if the effective key strength is N bits, the best currently known methods to recover the key (with non-negligible probability) need, on average, an effort comparable to 2^(N-1) operations of a typical block cipher 🧮. The statement SHOULD come with a short rationale explaining how the number was derived 📝. That explanation SHOULD also include the parameters needed to reach the stated key strength, based on what we currently know about the algorithms.
Note: Honestly, it's hard to pin down exactly what "comparable effort" and "typical block cipher" mean 🤓, but reasonable approximations are good enough here. For example, check out [SILVERMAN] for more discussion.
The key strength depends on how the keys get derived 🗝️. For example, if keys are derived from a shared secret (like a password or a long-term secret), and possibly some public information such as nonces, then the effective key strength is limited by the strength of the long-term secret, assuming the derivation procedure is computationally simple. Another example: when using public key algorithms, the strength of the symmetric key depends on the strength of the public keys used.
- [d] Description of key hierarchy. EAP methods that derive keys MUST either provide a reference to a key hierarchy specification, or describe how Master Session Keys (MSKs) and Extended Master Session Keys (EMSKs) are to be derived 🌳.
- [e] Indication of vulnerabilities. Beyond the claims that are made, the specification MUST indicate which of the security claims detailed in Section 7.2.1 are not being made 🙅♀️.
7.2.1. Security Claims Terminology for EAP Methods 📚
These terms describe the security properties of EAP methods 🎀:
- Protected ciphersuite negotiation. This is the ability of an EAP method to negotiate the ciphersuite used to protect the EAP conversation, and to integrity protect that negotiation too. It does not mean negotiating the ciphersuite used to protect data.
- Mutual authentication. This means that, within an interlocked exchange, the authenticator authenticates the peer and the peer authenticates the authenticator. Two independent one-way methods running in opposite directions do not count as mutual authentication here.
- Integrity protection. This means providing data origin authentication and protection against unauthorized modification of information for EAP packets (including EAP Requests and Responses). When making this claim, a method specification MUST describe the EAP packets and the fields within the EAP packet that are protected 🛡️.
- Replay protection. This is protection against replay of an EAP method or its messages, including success and failure result indications 🔁.
- Confidentiality. This means encryption of EAP messages (including EAP Requests and Responses) and success and failure result indications 🤫. A method making this claim MUST support identity protection (see Section 7.3).
- Key derivation. This is the ability of the EAP method to derive exportable keying material, such as the Master Session Key (MSK) and the Extended Master Session Key (EMSK). The MSK is used only for further key derivation, not directly for protecting the EAP conversation or subsequent data. Use of the EMSK is reserved 🔑.
- Key strength. If the effective key strength is N bits, the best currently known methods to recover the key (with non-negligible probability) require, on average, an effort comparable to
2^(N-1)operations of a typical block cipher 💪. - Dictionary attack resistance. Passwords are commonly picked from a small set (compared to a set of N-bit keys), which raises concern about dictionary attacks 📖. A method may be said to provide protection against dictionary attacks if, when it uses a password as a secret, it does not allow an offline attack whose work factor is based on the number of passwords in an attacker's dictionary.
- Fast reconnect. When a security association has already been established, this is the ability to create a new or refreshed security association more efficiently, or in fewer round-trips ⚡.
- Cryptographic binding. This is the EAP peer demonstrating to the EAP server that a single entity has acted as the EAP peer for all methods executed within a tunnel method 🤝. Binding MAY also imply that the EAP server demonstrates to the peer that a single entity has acted as the EAP server for all methods executed within a tunnel method. If executed correctly, binding serves to mitigate man-in-the-middle vulnerabilities 🙅.
- Session independence. This is the demonstration that passive attacks (such as capturing the EAP conversation) or active attacks (including compromise of the MSK or EMSK) do not enable compromise of subsequent or prior MSKs or EMSKs 🦋.
- Fragmentation. This refers to whether an EAP method supports fragmentation and reassembly. As noted in Section 3.1, EAP methods should support fragmentation and reassembly if EAP packets can exceed the minimum MTU of 1020 octets 📦.
- Channel binding. This is the communication, within an EAP method, of integrity-protected channel properties such as endpoint identifiers, which can be compared to values communicated via out-of-band mechanisms (such as via a AAA or lower layer protocol) 🧩.
Note: This list of security claims is not exhaustive 🌈. Additional properties, such as additional denial-of-service protection, may be relevant as well.
7.3. Identity Protection 🙈
An Identity exchange is optional within the EAP conversation 🫶. So you can skip the Identity exchange entirely, or use a method-specific identity exchange once a protected channel has been set up.
That said, where roaming is supported as described in [RFC2607], it may be necessary to find the right backend authentication server before the authentication conversation can move forward 🗺️. The realm portion of the Network Access Identifier (NAI) [RFC2486] is typically included in the EAP-Response/Identity so the authentication exchange can be routed to the correct backend authentication server. So while the peer-name portion of the NAI may be left out of the EAP-Response/Identity where proxies or relays are present, the realm portion may be required 📬.
The identity in the identity response can be different from the identity authenticated by the EAP method. This may be intentional for identity privacy 🎭. An EAP method SHOULD use the authenticated identity when making access control decisions 🚪.
7.4. Man-in-the-Middle Attacks 👀
Where EAP is tunneled within another protocol that omits peer authentication, there's a potential vulnerability to a man-in-the-middle attack 😱. For details, see [BINDING] and [MITM].
As noted in Section 2.1, EAP does not permit untunneled sequences of authentication methods 🙅♀️. If a sequence of EAP authentication methods were permitted, the peer might not have proof that a single entity acted as the authenticator for all EAP methods in the sequence. For example, an authenticator might terminate one EAP method, then forward the next method in the sequence to another party without the peer's knowledge or consent. Similarly, the authenticator might not have proof that a single entity acted as the peer for all EAP methods in the sequence.
Tunneling EAP within another protocol enables an attack by a rogue EAP authenticator that tunnels EAP to a legitimate server 🚨. Where the tunneling protocol is used for key establishment but does not require peer authentication, an attacker who convinces a legitimate peer to connect to it can tunnel EAP packets to a legitimate server, successfully authenticate, and obtain the key 🕵️. This lets the attacker become a man-in-the-middle, gaining access to the network and the ability to decrypt data traffic between the legitimate peer and server. Not it. 💀
This attack may be mitigated by the following measures 🛡️:
- [a] Requiring mutual authentication within EAP tunneling mechanisms.
- [b] Requiring cryptographic binding between the EAP tunneling protocol and the tunneled EAP methods. Where cryptographic binding is supported, a mechanism is also needed to protect against downgrade attacks that would bypass it. For further details on cryptographic binding, see [BINDING].
- [c] Limiting the EAP methods authorized for use without protection, based on peer and authenticator policy.
- [d] Avoiding the use of tunnels when a single, strong method is available 💜.
7.5. Packet Modification Attacks ✨
Okay so, while EAP methods can support per-packet data origin authentication, integrity, and replay protection, EAP itself doesn't provide that support at the EAP layer. 🫶
Since the Identifier is only a single octet, it's super easy to guess, which means an attacker can inject or replay EAP packets. 🙈 An attacker can also modify EAP headers (Code, Identifier, Length, Type) wherever the header isn't protected. Bestie, that could get packets tossed out or misread. 😭
To protect EAP packets against modification, spoofing, or replay, methods that support protected ciphersuite negotiation, mutual authentication, and key derivation, plus integrity and replay protection, are recommended. See Section 7.2.1 for the definitions of these security claims. 💅
Method-specific MICs can give you that protection. If a per-packet MIC is used inside an EAP method, then peers, authentication servers, and authenticators that aren't operating in pass-through mode MUST validate the MIC. MIC validation failures SHOULD be logged. Whether a MIC validation failure counts as a fatal error is decided by the EAP method specification. 🔥
It is RECOMMENDED that methods providing integrity protection of EAP packets cover all the EAP header fields, including the Code, Identifier, Length, Type, and Type-Data fields. 💖
Since EAP messages of Types Identity, Notification, and Nak don't include their own MIC, it may be desirable for the EAP method MIC to cover the information in these messages, as well as the header of each EAP message. 🧚
To provide protection, EAP may also be encapsulated within a protected channel created by protocols such as ISAKMP [RFC2408], as is done in [IKEv2], or within TLS [RFC2246]. However, as noted in Section 7.4, EAP tunneling may result in a man-in-the-middle vulnerability. 💀
Existing EAP methods define message integrity checks (MICs) that cover more than one EAP packet. For example, EAP-TLS [RFC2716] defines a MIC over a TLS record that could be split into multiple fragments. Within the FINISHED message, the MIC is computed over previous messages. Where the MIC covers more than one EAP packet, a MIC validation failure is typically considered a fatal error. 🌸
Within EAP-TLS [RFC2716], a MIC validation failure is treated as a fatal error, since that's what TLS [RFC2246] specifies. However, it's also possible to develop EAP methods that support per-packet MICs and respond to verification failures by silently discarding the offending packet. 🦋
In this document, descriptions of EAP message handling assume that per-packet MIC validation, where it occurs, is effectively performed as though it occurs before sending any responses or changing the state of the host which received the packet. ✨
7.6. Dictionary Attacks 🔐
Password authentication algorithms such as EAP-MD5, MS-CHAPv1 [RFC2433], and Kerberos V [RFC1510] are known to be vulnerable to dictionary attacks. 😩 MS-CHAPv1 vulnerabilities are documented in [PPTPv1]. MS-CHAPv2 vulnerabilities are documented in [PPTPv2]. Kerberos vulnerabilities are described in [KRBATTACK], [KRBLIM], and [KERB4WEAK].
In order to protect against dictionary attacks, authentication methods resistant to dictionary attacks (as defined in Section 7.2.1) are recommended. 🛡️
If an authentication algorithm is used that is known to be vulnerable to dictionary attacks, then the conversation may be tunneled within a protected channel to add some extra protection. 🎀 However, as noted in Section 7.4, EAP tunneling may result in a man-in-the-middle vulnerability, and therefore dictionary attack resistant methods are preferred. 👑
7.7. Connection to an Untrusted Network 🕵️♀️
With EAP methods that support one-way authentication, such as EAP-MD5, the peer doesn't authenticate the authenticator. That makes the peer vulnerable to attack by a rogue authenticator. 😱 Methods supporting mutual authentication (as defined in Section 7.2.1) address this vulnerability. 🫶
In EAP there's no requirement that authentication be full duplex, or that the same protocol be used in both directions. It's perfectly acceptable for different protocols to be used in each direction. Of course, this depends on the specific protocols negotiated. 🌈 In general though, completing a single unitary mutual authentication is preferable to two one-way authentications, one in each direction. That's because separate authentications that aren't bound cryptographically, so as to demonstrate they're part of the same session, are subject to man-in-the-middle attacks, as discussed in Section 7.4. 💅
7.8. Negotiation Attacks 🙅♀️
In a negotiation attack, the attacker tries to convince the peer and authenticator to negotiate a less secure EAP method. 😤 EAP doesn't protect Nak Response packets, although a method can include coverage of Nak Responses within a method-specific MIC. ✨
Within or associated with each authenticator, a particular named peer isn't expected to support a choice of methods. If it did, the peer would be open to attacks that negotiate the least secure method from among a set. 🙈 Instead, for each named peer, there SHOULD be an indication of exactly one method used to authenticate that peer name. And if a peer needs different authentication methods under different circumstances, then distinct identities SHOULD be employed, each of which identifies exactly one authentication method. 🍓
7.9. Implementation Idiosyncrasies 🧩
The interaction of EAP with lower layers such as PPP and IEEE 802 is highly implementation dependent. Every implementation has its own quirks, honestly. 🙃
For example, after an authentication failure, some PPP implementations don't terminate the link. Instead, they limit traffic in Network-Layer Protocols to a filtered subset, which gives the peer a chance to update secrets or email the network administrator about the problem. 📧 Similarly, while an authentication failure results in denied access to the controlled port in [IEEE-802.1X], limited traffic may still be permitted on the uncontrolled port. 🌸
In EAP there's no provision for retrying failed authentication. However, in PPP the LCP state machine can renegotiate the authentication protocol at any time, which allows a new attempt. 🔄 Similarly, in IEEE 802.1X the Supplicant or Authenticator can re-authenticate at any time. It is recommended that any counters used for authentication failure not be reset until after successful authentication, or until the failed link is subsequently terminated. 🦋
7.10. Key Derivation 🔑
It's possible for the peer and EAP server to mutually authenticate and derive keys. 🥰 To provide keying material for use in a subsequently negotiated ciphersuite, an EAP method that supports key derivation MUST export a Master Session Key (MSK) of at least 64 octets, and an Extended Master Session Key (EMSK) of at least 64 octets. EAP Methods deriving keys MUST provide for mutual authentication between the EAP peer and the EAP Server. 👑
The MSK and EMSK MUST NOT be used directly to protect data. 🙅♀️ They are, however, big enough to derive an AAA-Key, which is then used to derive Transient Session Keys (TSKs) for the selected ciphersuite. Each ciphersuite is responsible for specifying how to derive the TSKs from the AAA-Key. 🧁
The AAA-Key is derived from the keying material exported by the EAP method (MSK and EMSK). This derivation happens on the AAA server. In many existing protocols that use EAP, the AAA-Key and MSK are equivalent, but more complicated mechanisms are possible (see [KEYFRAME] for details). 🧠
EAP methods SHOULD ensure the freshness of the MSK and EMSK, even in cases where one party may not have a high quality random number generator. 🎲 A RECOMMENDED method is for each party to provide a nonce of at least 128 bits, which is used in deriving the MSK and EMSK. 💜
EAP methods export the MSK and EMSK, but not Transient Session Keys, so that EAP methods stay ciphersuite and media independent. 🦋 Keying material exported by EAP methods MUST be independent of the ciphersuite negotiated to protect data. ✨
Depending on the lower layer, EAP methods may run before or after ciphersuite negotiation, so the selected ciphersuite may not be known to the EAP method. 🤷♀️ By providing keying material that's usable with any ciphersuite, EAP methods can be used with a wide range of ciphersuites and media. 🌈
To preserve algorithm independence, EAP methods deriving keys SHOULD support (and document) the protected negotiation of the ciphersuite used to protect the EAP conversation between the peer and server. 🔐 This is separate from the ciphersuite negotiated between the peer and authenticator, which is used to protect data. 💅
The strength of Transient Session Keys (TSKs) used to protect data ultimately depends on the strength of the keys generated by the EAP method. If an EAP method can't produce keying material of sufficient strength, then the TSKs may be subject to a brute force attack. 😬 To enable deployments that need strong keys, EAP methods supporting key derivation SHOULD be capable of generating an MSK and EMSK, each with an effective key strength of at least 128 bits. 💪
Methods supporting key derivation MUST demonstrate cryptographic separation between the MSK and EMSK branches of the EAP key hierarchy. Without violating a fundamental cryptographic assumption (such as the non-invertibility of a one-way function), an attacker who recovers the MSK or EMSK MUST NOT be able to recover the other quantity with less effort than brute force. 🔒
Non-overlapping substrings of the MSK MUST be cryptographically separate from each other, as defined in Section 7.2.1. That means knowing one substring MUST NOT help in recovering some other substring without breaking a hard cryptographic assumption. 🧩 This matters because some existing ciphersuites form TSKs by simply splitting the AAA-Key into pieces of the appropriate length. Likewise, non-overlapping substrings of the EMSK MUST be cryptographically separate from each other, and from substrings of the MSK. 🫶
The EMSK is reserved for future use. It MUST remain on the EAP peer and EAP server where it is derived. It MUST NOT be transported to, or shared with, additional parties, or used to derive any other keys. (This restriction will be relaxed in a future document that specifies how the EMSK can be used.) 🚫
Since EAP doesn't provide for explicit key lifetime negotiation, EAP peers, authenticators, and authentication servers MUST be prepared for situations in which one of the parties discards the key state, which remains valid on another party. 🫠
This specification doesn't give detailed guidance on how EAP methods derive the MSK and EMSK, how the AAA-Key is derived from the MSK and/or EMSK, or how the TSKs are derived from the AAA-Key. 📖
Developing and validating key derivation algorithms is difficult. As a result, EAP methods SHOULD re-use well established and analyzed mechanisms for key derivation (such as those specified in IKE [RFC2409] or TLS [RFC2246]), rather than inventing new ones. 🙌 EAP methods SHOULD also utilize well established and analyzed mechanisms for MSK and EMSK derivation. Further details on EAP Key Derivation are provided within [KEYFRAME]. 🎀
7.11. Weak Ciphersuites ✨
Okay bestie, so if data packets are sent after the initial EAP authentication WITHOUT per-packet authentication, integrity, and replay protection, an attacker who can get onto the media can inject packets, "flip bits" inside existing packets, replay packets, or even hijack the whole session 😭. And without per-packet confidentiality, they can snoop on your data packets 👀.
To protect against data modification, spoofing, or snooping, it is recommended that EAP methods supporting mutual authentication and key derivation (as defined by Section 7.2.1) be used, along with lower layers providing per-packet confidentiality, authentication, integrity, and replay protection 💖.
Also, if the lower layer does ciphersuite negotiation, it should be understood that EAP doesn't provide integrity protection for that negotiation by itself 🙃. So to avoid downgrading attacks that would push everyone onto weaker ciphersuites, clients implementing lower layer ciphersuite negotiation SHOULD protect against negotiation downgrading 🔒.
This can be done by letting users configure which ciphersuites are acceptable as a matter of security policy. Or, the ciphersuite negotiation MAY be authenticated using keying material derived from the EAP authentication and a MIC algorithm agreed upon in advance by lower-layer peers 🎀.
7.12. Link Layer 🔗
There are reliability and security issues with link layer indications in PPP, IEEE 802 LANs, and IEEE 802.11 wireless LANs, and they're giving chaos 🌪️:
- [a] PPP. In PPP, link layer indications such as
LCP-Terminate(a link failure indication) andNCP(a link success indication) are not authenticated or integrity protected. They can therefore be spoofed by an attacker with access to the link 🙈. - [b] IEEE 802. IEEE 802.1X
EAPOL-StartandEAPOL-Logoffframes are not authenticated or integrity protected. They can therefore be spoofed by an attacker with access to the link 💀. - [c] IEEE 802.11. In IEEE 802.11, link layer indications include
DisassociateandDeauthenticateframes (link failure indications), and the first message of the 4-way handshake (link success indication). These messages are not authenticated or integrity protected, and although they are not forwardable, they are spoofable by an attacker within range 📡.
In IEEE 802.11, IEEE 802.1X data frames may be sent as Class 3 unicast data frames, and are therefore forwardable 🦋. This implies that while EAPOL-Start and EAPOL-Logoff messages may be authenticated and integrity protected, they can be spoofed by an authenticated attacker far from the target when "pre-authentication" is enabled 😱.
In IEEE 802.11, a "link down" indication is an unreliable indication of link failure. Wireless signal strength can come and go, and it may be influenced by radio frequency interference generated by an attacker 📶. To avoid unnecessary resets, it is advisable to damp these indications rather than passing them directly to EAP 🧘♀️. Since EAP supports retransmission, it is robust against transient connectivity losses 💪✨.
7.13. Separation of Authenticator and Backend Authentication Server 🏰
It's possible for the EAP peer and EAP server to mutually authenticate and derive a AAA-Key for a ciphersuite used to protect subsequent data traffic. This doesn't present an issue on the peer, since the peer and EAP client live on the same machine. All that's required is for the client to derive the AAA-Key from the MSK and EMSK exported by the EAP method, and then pass a Transient Session Key (TSK) to the ciphersuite module 🧚.
However, when the authenticator and authentication server reside on different machines, there are some major security implications 👀:
- [a] Authentication will occur between the peer and the authentication server, not between the peer and the authenticator. This means it is not possible for the peer to validate the identity of the authenticator it is speaking to, using EAP alone 🫣.
- [b] As discussed in [RFC3579], the authenticator is dependent on the AAA protocol in order to know the outcome of an authentication conversation, and it does not look at the encapsulated EAP packet (if one is present) to determine the outcome. In practice, this implies that the AAA protocol spoken between the authenticator and authentication server MUST support per-packet authentication, integrity, and replay protection 🔐.
- [c] After completion of the EAP conversation, lower layer security services such as per-packet confidentiality, authentication, integrity, and replay protection will be enabled. At that point, a secure association protocol SHOULD be run between the peer and authenticator to provide mutual authentication between them, guarantee liveness of transient session keys, provide protected ciphersuite and capabilities negotiation for subsequent data, and synchronize key usage 🤝✨.
- [d] A
AAA-Keyderived from theMSKand/orEMSKnegotiated between the peer and authentication server MAY be transmitted to the authenticator. Therefore, a mechanism needs to be provided to transmit theAAA-Keyfrom the authentication server to the authenticator that needs it 🚚. The specification of the AAA-key derivation, transport, and wrapping mechanisms is outside the scope of this document. Further details on AAA-Key Derivation are provided within [KEYFRAME] 📚.
7.14. Cleartext Passwords 🙅♀️
This specification does not define a mechanism for cleartext password authentication, and the omission is intentional 🫶. Cleartext passwords would let the password be captured by an attacker with access to a link over which EAP packets are transmitted 😭.
Since protocols that encapsulate EAP, such as RADIUS [RFC3579], may not provide confidentiality, EAP packets may later be encapsulated for transport over the Internet, where they may be captured by an attacker 🌐.
So, cleartext passwords cannot be securely used within EAP, except where they're encapsulated within a protected tunnel with server authentication 🔒. Some of the same risks apply to EAP methods without dictionary attack resistance, as defined in Section 7.2.1. For details, see Section 7.6 🧁.
7.15. Channel Binding 🔗💅
It's possible for a compromised or poorly implemented EAP authenticator to communicate incorrect information to the EAP peer and/or server. This may enable an authenticator to impersonate another authenticator, or to communicate incorrect information via out-of-band mechanisms (such as via a AAA or lower layer protocol) 🎭.
Where EAP is used in pass-through mode, the EAP peer typically doesn't verify the identity of the pass-through authenticator. It only verifies that the pass-through authenticator is trusted by the EAP server. This creates a potential security vulnerability 🚨.
Section 4.3.7 of [RFC3579] describes how an EAP pass-through authenticator acting as a AAA client can be detected if it attempts to impersonate another authenticator (such by sending incorrect NAS-Identifier [RFC2865], NAS-IP-Address [RFC2865] or NAS-IPv6-Address [RFC3162] attributes via the AAA protocol) 🕵️♀️. However, a pass-through authenticator acting as a AAA client can provide correct information to the AAA server while communicating misleading information to the EAP peer via a lower layer protocol 😤.
For example, a compromised authenticator could use another authenticator's Called-Station-Id or NAS-Identifier in communicating with the EAP peer via a lower layer protocol. Or, a pass-through authenticator acting as a AAA client could provide an incorrect peer Calling-Station-Id [RFC2865][RFC3580] to the AAA server via the AAA protocol 🙈.
To address this vulnerability, EAP methods may support a protected exchange of channel properties such as endpoint identifiers, including (but not limited to): Called-Station-Id [RFC2865][RFC3580], Calling-Station-Id [RFC2865][RFC3580], NAS-Identifier [RFC2865], NAS-IP-Address [RFC2865], and NAS-IPv6-Address [RFC3162] 🧩.
Using such a protected exchange, it's possible to match the channel properties provided by the authenticator via out-of-band mechanisms against those exchanged within the EAP method. Where discrepancies are found, these SHOULD be logged, and additional actions MAY also be taken, such as denying access 📝🚫.
7.16. Protected Result Indications ✨
okay bestie, let's talk about result indications 🦋 Within EAP, Success and Failure packets are neither acknowledged nor integrity protected 💀 So result indications help when EAP runs over lower layers that don't support retransmission or synchronization of the authentication state 🫶 In media like IEEE 802.11, which does provide retransmission and syncs authentication state through the 4-way handshake defined in [IEEE-802.11i], the extra resilience is typically of marginal benefit 💅
Depending on the method and circumstances, result indications can be spoofable by an attacker 😭 A method counts as providing protected result indications if it supports result indications AND makes the "integrity protection" and "replay protection" claims 👑 A method that supports protected result indications MUST indicate which result indications are protected, and which are not 🎀
Protected result indications aren't required to protect against rogue authenticators 🌸 In a mutually authenticating method, if the server has to authenticate to the peer before the peer will accept a Success packet, an attacker can't just pretend to be a rogue authenticator 🙈
BUT, it's still possible for an attacker to forge a Success packet after the server has authenticated to the peer, and before the peer has authenticated to the server 😱 If the peer accepted that forged Success packet and tried to get on the network before it had authenticated the server, someone could mount a denial of service attack against the peer 💔 After an attack like that, if the lower layer supports failure indications, the authenticator can resync state with the peer by sending a lower layer failure indication. See Section 7.12 for details 🧚
Now, if a server authenticates the peer and sends a Success packet before it knows whether the peer has authenticated the authenticator, an idle timeout can happen when the peer never authenticates the authenticator 🥲 Where the lower layer supports it, an authenticator that senses the peer is absent can free up resources 🍓
In a method that supports result indications, a peer that has authenticated the server doesn't consider the authentication successful until it gets an indication that the server successfully authenticated it 💜 Same vibe the other way: a server that has successfully authenticated the peer doesn't consider it successful until it gets an indication that the peer has authenticated the server ✨
To avoid synchronization problems, it's desirable for the sender to check that sufficient authorization exists for granting access before sending a success result indication 🌈 Though, as we'll see below, that's not always possible 🙃
Result indications may enable synchronization of the authentication result between peer and server, but that does NOT guarantee the peer and authenticator will be synced on their authorization, or that timeouts won't happen 🙅♀️ For example, the EAP server might not know about an authorization decision made by a AAA proxy 👀 Or the AAA server might only check authorization after authentication has completed successfully, and then find out authorization can't be granted 😬 Or the AAA server grants access, but the authenticator can't provide it because of a temporary lack of resources 🔥 In these situations, synchronization may only be achieved via lower layer result indications 🫶
Success indications can be explicit or implicit ✨ For example, where a method supports error messages, an implicit success indication can be defined as receiving a specific message without a preceding error message 🦋 Failures are typically indicated explicitly 💅 As described in Section 4.2, a peer silently discards a Failure packet received at a point where the method doesn't explicitly permit one to be sent 🤫 For example, a method that provides its own error messages might require the peer to receive an error message before it accepts a Failure packet 🎀
Per-packet authentication, integrity, and replay protection of result indications protects against spoofing 🛡️ Since protected result indications need a key for per-packet authentication and integrity protection, methods that support protected result indications MUST also support the "key derivation", "mutual authentication", "integrity protection", and "replay protection" claims 🔑✨
Protected result indications address some denial-of-service vulnerabilities caused by spoofing of Success and Failure packets, though not all of them 🌸 EAP methods can typically provide protected result indications only in some circumstances 😮💨 For example, errors can happen before key derivation, so it may not be possible to protect every failure indication 💀 It's also possible that result indications aren't supported in both directions, or that synchronization can't be achieved in every mode of operation 🥺
For example, within EAP-TLS [RFC2716], in the client authentication handshake, the server authenticates the peer but doesn't receive a protected indication of whether the peer has authenticated it 😤 In contrast, the peer authenticates the server and knows whether the server has authenticated it 🙌 In the session resumption handshake, the peer authenticates the server but doesn't receive a protected indication of whether the server has authenticated it 😵 In this mode, the server authenticates the peer and knows whether the peer has authenticated it 💜
8. Acknowledgements 🫶
This protocol gets much of its inspiration from Dave Carrel's AHA document, as well as the PPP CHAP protocol [RFC1994] 🌷 Valuable feedback came from Yoshihiro Ohba of Toshiba America Research, Jari Arkko of Ericsson, Sachin Seth of Microsoft, Glen Zorn of Cisco Systems, Jesse Walker of Intel, Bill Arbaugh, Nick Petroni and Bryan Payne of the University of Maryland, Steve Bellovin of AT&T Research, Paul Funk of Funk Software, Pasi Eronen of Nokia, Joseph Salowey of Cisco, Paul Congdon of HP, and members of the EAP working group 👑
The use of Security Claims sections for EAP methods, as required by Section 7.2 and specified for each EAP method described in this document, was inspired by Glen Zorn through [EAP-EVAL] 🧚✨
9. References 📚
9.1. Normative References 💖
[RFC1661] Simpson, W., "The Point-to-Point Protocol (PPP)", STD 51, RFC 1661, July 1994.
[RFC1994] Simpson, W., "PPP Challenge Handshake Authentication Protocol (CHAP)", RFC 1994, August 1996.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2243] Metz, C., "OTP Extended Responses", RFC 2243, November 1997.
[RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO 10646", RFC 2279, January 1998.
[RFC2289] Haller, N., Metz, C., Nesser, P. and M. Straw, "A One-Time Password System", RFC 2289, February 1998.
[RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 2434, October 1998.
[RFC2988] Paxson, V. and M. Allman, "Computing TCP's Retransmission Timer", RFC 2988, November 2000.
[IEEE-802] Institute of Electrical and Electronics Engineers, "Local and Metropolitan Area Networks: Overview and Architecture", IEEE Standard 802, 1990.
[IEEE-802.1X] Institute of Electrical and Electronics Engineers, "Local and Metropolitan Area Networks: Port-Based Network Access Control", IEEE Standard 802.1X, September 2001.
9.2. Informative References ✨
okay so now we're in the informative references, which are basically the bibliography of everything EAP has learned from over the years 📚🦋 these aren't requirements, but they're the receipts behind the spec, and some of them are legendary (hi, Masters of Deception 💀)
[RFC793]Postel, J., "Transmission Control Protocol", STD 7, RFC 793, September 1981.[RFC1510]Kohl, J. and B. Neuman, "The Kerberos Network Authentication Service (V5)", RFC 1510, September 1993.[RFC1750]Eastlake, D., Crocker, S. and J. Schiller, "Randomness Recommendations for Security", RFC 1750, December 1994.[RFC2246]Dierks, T., Allen, C., Treese, W., Karlton, P., Freier, A. and P. Kocher, "The TLS Protocol Version 1.0", RFC 2246, January 1999.[RFC2284]Blunk, L. and J. Vollbrecht, "PPP Extensible Authentication Protocol (EAP)", RFC 2284, March 1998.[RFC2486]Aboba, B. and M. Beadles, "The Network Access Identifier", RFC 2486, January 1999.[RFC2408]Maughan, D., Schneider, M. and M. Schertler, "Internet Security Association and Key Management Protocol (ISAKMP)", RFC 2408, November 1998.[RFC2409]Harkins, D. and D. Carrel, "The Internet Key Exchange (IKE)", RFC 2409, November 1998.[RFC2433]Zorn, G. and S. Cobb, "Microsoft PPP CHAP Extensions", RFC 2433, October 1998.[RFC2607]Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy Implementation in Roaming", RFC 2607, June 1999.[RFC2661]Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, G. and B. Palter, "Layer Two Tunneling Protocol "L2TP"", RFC 2661, August 1999.[RFC2716]Aboba, B. and D. Simon, "PPP EAP TLS Authentication Protocol", RFC 2716, October 1999.[RFC2865]Rigney, C., Willens, S., Rubens, A. and W. Simpson, "Remote Authentication Dial In User Service (RADIUS)", RFC 2865, June 2000.[RFC2960]Stewart, R., Xie, Q., Morneault, K., Sharp, C., Schwarzbauer, H., Taylor, T., Rytina, I., Kalla, M., Zhang, L. and V. Paxson, "Stream Control Transmission Protocol", RFC 2960, October 2000.[RFC3162]Aboba, B., Zorn, G. and D. Mitton, "RADIUS and IPv6", RFC 3162, August 2001.[RFC3454]Hoffman, P. and M. Blanchet, "Preparation of Internationalized Strings ("stringprep")", RFC 3454, December 2002.[RFC3579]Aboba, B. and P. Calhoun, "RADIUS (Remote Authentication Dial In User Service) Support For Extensible Authentication Protocol (EAP)", RFC 3579, September 2003.[RFC3580]Congdon, P., Aboba, B., Smith, A., Zorn, G. and J. Roese, "IEEE 802.1X Remote Authentication Dial In User Service (RADIUS) Usage Guidelines", RFC 3580, September 2003.[RFC3692]Narten, T., "Assigning Experimental and Testing Numbers Considered Useful", BCP 82, RFC 3692, January 2004.[DECEPTION]Slatalla, M. and J. Quittner, "Masters of Deception", Harper-Collins, New York, 1995.[KRBATTACK]Wu, T., "A Real-World Analysis of Kerberos Password Security", Proceedings of the 1999 ISOC Network and Distributed System Security Symposium,http://www.isoc.org/isoc/conferences/ndss/99/proceedings/papers/wu.pdf.[KRBLIM]Bellovin, S. and M. Merrit, "Limitations of the Kerberos authentication system", Proceedings of the 1991 Winter USENIX Conference, pp. 253-267, 1991.[KERB4WEAK]Dole, B., Lodin, S. and E. Spafford, "Misplaced trust: Kerberos 4 session keys", Proceedings of the Internet Society Network and Distributed System Security Symposium, pp. 60-70, March 1997.[PIC]Aboba, B., Krawczyk, H. and Y. Sheffer, "PIC, A Pre-IKE Credential Provisioning Protocol", Work in Progress, October 2002.[IKEv2]Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", Work in Progress, January 2004.[PPTPv1]Schneier, B. and Mudge, "Cryptanalysis of Microsoft's Point-to- Point Tunneling Protocol", Proceedings of the 5th ACM Conference on Communications and Computer Security, ACM Press, November 1998.[IEEE-802.11]Institute of Electrical and Electronics Engineers, "Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications", IEEE Standard 802.11, 1999.[SILVERMAN]Silverman, Robert D., "A Cost-Based Security Analysis of Symmetric and Asymmetric Key Lengths", RSA Laboratories Bulletin 13, April 2000 (Revised November 2001),http://www.rsasecurity.com/rsalabs/bulletins/bulletin13.html.[KEYFRAME]Aboba, B., "EAP Key Management Framework", Work in Progress, October 2003.[SASLPREP]Zeilenga, K., "SASLprep: Stringprep profile for user names and passwords", Work in Progress, March 2004.[IEEE-802.11i]Institute of Electrical and Electronics Engineers, "Unapproved Draft Supplement to Standard for Telecommunications and Information Exchange Between Systems - LAN/MAN Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications: Specification for Enhanced Security", IEEE Draft 802.11i (work in progress), 2003.[DIAM-EAP]Eronen, P., Hiller, T. and G. Zorn, "Diameter Extensible Authentication Protocol (EAP) Application", Work in Progress, February 2004.[EAP-EVAL]Zorn, G., "Specifying Security Claims for EAP Authentication Types", Work in Progress, October 2002.[BINDING]Puthenkulam, J., "The Compound Authentication Binding Problem", Work in Progress, October 2003.[MITM]Asokan, N., Niemi, V. and K. Nyberg, "Man-in-the-Middle in Tunneled Authentication Protocols", IACR ePrint Archive Report 2002/163, October 2002,<http://eprint.iacr.org/2002/163>.[IEEE-802.11i-req]Stanley, D., "EAP Method Requirements for Wireless LANs", Work in Progress, February 2004.[PPTPv2]Schneier, B. and Mudge, "Cryptanalysis of Microsoft's PPTP Authentication Extensions (MS-CHAPv2)", CQRE 99, Springer-Verlag, 1999, pp. 192-203.
Appendix A. Changes from RFC 2284 🎀
okay this is the glow-up recap 💖 it lists the major changes between [RFC2284] and this document. minor stuff (style, grammar, spelling, editorial tweaks) isn't mentioned here, so don't panic if your favourite typo fix is missing 🙈
- The Terminology section (Section 1.2) has been expanded, defining more concepts and giving more exact definitions. ✨
- The concepts of Mutual Authentication, Key Derivation, and Result Indications are introduced and discussed throughout the document where appropriate.
- In Section 2, it is explicitly specified that more than one exchange of Request and Response packets may occur as part of the EAP authentication exchange. How this may be used and how it may not be used is specified in detail in Section 2.1. 🦋
- Also in Section 2, some requirements have been made explicit for the authenticator when acting in pass-through mode.
- An EAP multiplexing model (Section 2.2) has been added to illustrate a typical implementation of EAP. There is no requirement that an implementation conform to this model, as long as the on-the-wire behavior is consistent with it. 🌸
- As EAP is now in use with a variety of lower layers, not just PPP for which it was first designed, Section 3 on lower layer behavior has been added.
- In the description of the EAP Request and Response interaction (Section 4.1), both the behavior on receiving duplicate requests, and when packets should be silently discarded has been more exactly specified. The implementation notes in this section have been substantially expanded.
- In Section 4.2, it has been clarified that Success and Failure packets must not contain additional data, and the implementation note has been expanded. A subsection giving requirements on processing of success and failure packets has been added.
- Section 5 on EAP Request/Response Types lists two new Type values: the Expanded Type (Section 5.7), which is used to expand the Type value number space, and the Experimental Type. In the Expanded Type number space, the new Expanded Nak (Section 5.3.2) Type has been added. Clarifications have been made in the description of most of the existing Types. Security claims summaries have been added for authentication methods. 🔥
- In Sections 5, 5.1, and 5.2, a requirement has been added such that fields with displayable messages should contain UTF-8 encoded ISO 10646 characters.
- It is now required in Section 5.1 that if the Type-Data field of an Identity Request contains a NUL-character, only the part before the null is displayed. RFC 2284 prohibits the null termination of the Type-Data field of Identity messages. This rule has been relaxed for Identity Request messages and the Identity Request Type-Data field may now be null terminated. 👑
- In Section 5.5, support for OTP Extended Responses [RFC2243] has been added to EAP OTP.
- An IANA Considerations section (Section 6) has been added, giving registration policies for the numbering spaces defined for EAP. 🧚
- The Security Considerations (Section 7) have been greatly expanded, giving a much more comprehensive coverage of possible threats and other security considerations. 😭🫶
- In Section 7.5, text has been added on method-specific behavior, providing guidance on how EAP method-specific integrity checks should be processed. Where possible, it is desirable for a method-specific MIC to be computed over the entire EAP packet, including the EAP layer header (Code, Identifier, Length) and EAP method layer header (Type, Type-Data).
- In Section 7.14 the security risks involved in use of cleartext passwords with EAP are described. 🙈
- In Section 7.15 text has been added relating to detection of rogue NAS behavior. 💅
Authors' Addresses ✨
Okay, meet the crew 🫶 Here's who wrote this and how to reach them:
Bernard Aboba
Microsoft Corporation
One Microsoft Way
Redmond, WA 98052
USA
Phone: +1 425 706 6605
Fax: +1 425 936 6605
EMail: bernarda@microsoft.com
Larry J. Blunk
Merit Network, Inc
4251 Plymouth Rd., Suite 2000
Ann Arbor, MI 48105-2785
USA
Phone: +1 734-647-9563
Fax: +1 734-647-3185
EMail: ljb@merit.edu
John R. Vollbrecht
Vollbrecht Consulting LLC
9682 Alice Hill Drive
Dexter, MI 48130
USA
EMail: jrv@umich.edu
James Carlson
Sun Microsystems, Inc
1 Network Drive
Burlington, MA 01803-2757
USA
Phone: +1 781 442 2084
Fax: +1 781 442 1677
EMail: james.d.carlson@sun.com
Henrik Levkowetz
ipUnplugged AB
Arenavagen 33
Stockholm S-121 28
SWEDEN
Phone: +46 708 32 16 08
EMail: henrik@levkowetz.comFull Copyright Statement 🎀
Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions in BCP 78, and except as set out there, the authors keep all their rights. 💅
This document and the information in it are provided on an "AS IS" basis, and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED. That includes, but isn't limited to, any warranty that using the information here won't infringe any rights, and any implied warranties of merchantability or fitness for a particular purpose. 😭
Intellectual Property 🦋
Okay, IP stuff, but make it quick 🙈 The IETF doesn't take a position on whether any Intellectual Property Rights or other rights claimed to cover the technology in this document are valid or in scope, or on whether licenses under those rights are available. It also doesn't say it has searched for any such rights. If you want the procedures for rights in RFC documents, check BCP 78 and BCP 79. 🌸
Copies of IPR disclosures sent to the IETF Secretariat, along with any assurances of licenses that will be made available, or the results of an attempt to get a general license or permission to use those proprietary rights for implementers or users of this specification, can be found in the IETF online IPR repository at http://www.ietf.org/ipr. ✨
The IETF invites anyone interested to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that might cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org. 💜
Acknowledgement 💖
Funding for the RFC Editor function is currently provided by the Internet Society. 🌈
📦 where this page comes from
- ietf: rfc3748 2004-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms