RFC 4284
Identity Selection Hints for the Extensible Authentication Protocol (EAP)
RFC 4284: Identity Selection Hints for EAP 🎀
okay bestie, this is RFC 4284 💖 It's called Identity Selection Hints for the Extensible Authentication Protocol (EAP) and it came out in January 2006. It's an Informational doc from the Network Working Group (Request for Comments: 4284), so it shares info with the internet community but doesn't set a standard ✨
The authors are F. Adrangi (Intel), V. Lortz (Intel), F. Bari (Cingular Wireless) and P. Eronen (Nokia) 👑 The title block doesn't list anything this RFC obsoletes or updates, so it stands on its own 🦋
Status of This Memo 🌸
This memo gives information to the internet community. It does not set any kind of internet standard, and you can share it as much as you want 💅
Copyright Notice 🧚
Copyright (C) The Internet Society (2006) ✨
IESG Note 📝
EAP Identity Selection was built by 3GPP, and this doc is here so the internet community can read about it 💜 The EAP working group checked that this spec works with EAP as defined in RFC 3748 ✅ The client behaviour 3GPP needs is written up in 3GPP TS 24.234 🎀
Abstract 🦋
Okay so the Extensible Authentication Protocol (EAP) is defined in RFC 3748 💖 This doc sets up a way for an access network to give hints about identity selection to an EAP peer (the end of the link that talks back to the authenticator) 🫶 The goal is to help the peer pick a good Network Access Identifier (NAI) ✨ This comes in handy when the peer doesn't get a lower-layer hint about which network it's connecting to, or when the access network and the peer's home network don't have a direct roaming deal. In that second case, authentication usually goes through a middleman network like a roaming consortium or a broker 🌈
Real talk though: the mechanism here doesn't scale super well 😭 It's meant for access networks with a small to moderate number of direct roaming partners 🍓
Table of Contents 🗂️
1. Introduction ....................................................2
1.1. Relationship with Other Specifications .....................3
1.2. Applicability ..............................................3
1.3. Terminology ................................................4
2. Implementation Requirements .....................................4
2.1. Packet Format ..............................................5
3. Security Considerations .........................................6
4. Acknowledgements ................................................7
5. Appendix - Delivery Options .....................................8
6. References .....................................................12
6.1. Normative References ......................................12
6.2. Informative References ....................................121. Introduction 💖
Okay, so EAP is defined in [RFC3748] ✨ An EAP peer (we'll also just call it "the peer") can have several credentials 🎀 When the lower layer doesn't say which network it's connecting to, or when the peer's home network has roaming deals with several middleman networks, the peer might not know which Network Access Identifier (NAI) to put in its EAP-Response/Identity 😭
So this doc sets up a way for the access network to give an EAP peer identity selection hints, including info about its roaming relationships 🦋 That info gets sent in an EAP-Request/Identity message, tacked on after the displayable message and a NUL character 💅
This mechanism can help the peer pick a credential and its matching NAI, or format the NAI [RFC4282] so AAA messages get routed to the home AAA server 🧚 If there are several middleman networks around, the peer gets a say in which one gets used 👑
How the peer actually chooses is mostly up to its local policy and configuration, and that's outside this doc's scope 🌸 For example, the peer could decide to use one of its other identities, switch to a different access network, or try reformatting its NAI [RFC4282] to help AAA routing. The exact client behaviour is described by standard bodies that use this spec, like 3GPP [TS-24.234] 🍓
Section 2 describes the required behaviour of implementations, including the format for identity hints ✨
1.1. Relationship with Other Specifications 🔗
This doc describes how Remote Authentication Dial-In User Service (RADIUS) proxies behave when they handle EAP messages 💜 That includes what proxies do when they see an unknown realm in the User-Name(1) attribute of an Access-Request that has one or more EAP-Message attributes 🎀 If you use this doc in a setup that needs NAI "decoration" as described in [RFC4282], it assumes a source-routing model for working out the roaming relationship path. That means it changes how RADIUS proxies act in roaming situations 🌈
1.2. Applicability 🦋
Identity hints are handy when the peer can't figure out which credentials to use, or when an access network has several possible routes to a home network 💖 This can happen when access networks support multiple roaming consortiums but don't have a full list of the home networks reachable through them 😭
In these cases, identity hints (like a list of the access network's roaming partners) can help the EAP peer influence route selection, using the NAI [RFC4282] to specify the source route it wants 🧚 The main use right now is 3GPP systems working with WLANs [TS-23.234] and [TS-24.234] ✨
How many hints you can send is capped by the EAP MTU 🍓 For example, if each hint is 20 octets and the EAP MTU is 1096, you can advertise a maximum of 50 roaming partners 🫶 Scaling limits from the EAP MTU should be taken into account when you deploy this 💅
Since this mechanism relies on info sent in the EAP-Request/Identity packet, the peer has to pick a point of attachment before it can get identity hints 🌸 If there are several points of attachment, this mechanism doesn't let the peer use the hints to decide which one to pick 💀 So in roaming situations, the peer might have to try several points of attachment before it finds a compatible one, which can increase handoff latency 😭
This doc is related to the general network discovery and selection problem described in [netsel-problem] 👑 The mechanism here only solves part of that problem 💜 IEEE 802.11 is also working on more comprehensive, long-term solutions for network discovery and selection 🌈
1.3. Terminology 📖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] ✨
NAI Network Access Identifier [RFC4282].
Decorated NAI An NAI specifying a source route. See [RFC4282]
Section 2.7 for more information.
NAI Realm Realm portion of an NAI [RFC4282].2. Implementation Requirements 🎀
The EAP authenticator MAY send an identity hint to the peer in the initial EAP-Request/Identity 💖 If the identity hint isn't sent at the start (like when the authenticator doesn't support this spec), the EAP peer may pick the wrong NAI 😭 And if the local AAA proxy doesn't have a default route configured, it may find that the User-Name(1) attribute in the request has a realm with no matching route 💀
Here's what [RFC2607], Section 5.1 says about proxies (iykyk, it's about policy 👑):
"Proxies are frequently used to implement policy in roaming situations. Proxies implementing policy MAY reply directly to Access-Requests without forwarding the request. When replying directly to an Access-Request, the proxy MUST reply either with an Access-Reject or an Access-Challenge packet. A proxy MUST NOT reply directly with an Access-Accept."
When no route is found, existing AAA proxies usually send an Access-Reject 🌸 But if the request has an EAP-Message attribute, AAA proxies that follow this spec should send a challenge with an identity hint instead 🧚
For example, if a RADIUS proxy gets an Access-Request with an EAP-Message attribute and a User-Name(1) attribute holding an unknown realm, it SHOULD reply with an Access-Challenge that has an EAP-Message attribute carrying an EAP-Request/Identity packet with an identity hint, instead of an Access-Reject 🫶 Check out "Option 3" in the appendix for the message flow diagram 🦋
If the peer replies with an EAP-Response/Identity containing an unknown realm after the local AAA proxy sends an identity hint, then a local AAA proxy/server that follows this spec MUST eventually send an Access-Reject containing an EAP-Failure 😭 Before doing that, it MAY send an Access-Challenge containing an EAP-Notification to explain the failure 💅 To figure out whether an identity hint was sent earlier, you can use the State(24) attribute defined in [RFC2865] 🌈
Last thing, bestie: as noted in [RFC3748], Section 3.1, the minimum EAP MTU size is 1020 octets 🍓 EAP doesn't support fragmenting EAP-Request/Identity messages, so the identity hint info is capped by the link MTU 🔥
2.1. Packet Format ✨
okay so the identity hint info gets tucked right after a displayable string and a NUL character inside the EAP-Request/Identity 🎀 the ABNF from [RFC4234] defines a NAIRealms attribute for carrying that hint. its value is a list of realm names separated by a semicolon 💅
identity-request-data = [ displayable-string ] %x00 [ Network-Info ]
displayable-string = *CHAR
Network-Info = "NAIRealms=" realm-list
Network-Info =/ 1*OCTET ",NAIRealms=" realm-list
Network-Info =/ "NAIRealms=" realm-list "," 1*OCTET
Network-Info =/ 1*OCTET ",NAIRealms=" realm-list "," 1*OCTET
realm-list = realm /
( realm-list ";" realm )the "OCTET" and "CHAR" rules come from [RFC4234] and the "realm" rule comes from [RFC4282] 🦋
here's a sample hex dump of an EAP-Request/Identity packet, so you can see it all in action 🍓
01 ; Code: Request
00 ; Identifier: 0
00 3f ; Length: 63 octets
01 ; Type: Identity
48 65 6c 6c 6f 21 00 4e ; "Hello!\0NAIRealms=example.com;mnc014.
41 49 52 65 61 6c 6d 73 ; mcc310.3gppnetwork.org"
3d 65 78 61 6d 70 6c 65
2e 63 6f 6d 3b 6d 6e 63
30 31 34 2e 6d 63 63 33
31 30 2e 33 67 70 70 6e
65 74 77 6f 72 6b 2e 6f
72 67the Network-Info can hold a NAIRealms list plus proprietary info 🧚 the proprietary stuff can go before or after the NAIRealms list, no cap. to pull the NAIRealms list out, an implementation can either look for "NAIRealms=" right after the NUL, or seek forward for ",NAIRealms" somewhere in the string 👀 and the realms data ends at the first "," or at the end of the string, whichever shows up first 💜
3. Security Considerations ✨
bestie, this section is SERIOUS 😭 identity hint info is delivered inside an EAP-Request/Identity before the authentication conversation even starts, which means an attacker can totally modify it 💀 so the NAIRealms attribute MUST be treated as a hint by the peer. the peer must treat the hint as an unreliable indication
🚨 unauthenticated hints can make peers accidentally reveal extra identities, which compromises privacy. the EAP-Response/Identity is already sent in the clear, so this vulnerability already exists. it can be addressed via method-specific identity exchanges.
and similarly, if the peer has multiple identities to pick from, an attacker can use a forged hint to convince the peer to choose an identity tied to a weak EAP method 😤 requiring strong EAP methods can protect against this. a similar issue already exists with unprotected link-layer advertisements, like 802.11 SSIDs 🙈
if the identity hint is used to select a mediating network, existing EAP methods may not give the home AAA server a way to verify that the mediating network the peer picked was actually used 🫠
anything revealed from the network or client sides before authentication has happened can be seen as a security risk 🥺 for instance, revealing that a network using a weak authentication method exists can make it easier for attackers to find out that it's accessible. so, the consent of the network being advertised in the hints is required before such hints can be sent 🫶
4. Acknowledgements 🌸
the authors especially want to thank Jari Arkko, Bernard Aboba, and Glen Zorn for helping scope the problem, and for reviewing the draft and suggesting improvements 🎀 they also want to acknowledge and thank Adrian Buckley, Blair Bullock, Jose Puthenkulam, Johanna Wild, Joe Salowey, Marco Spini, Simone Ruffino, Mark Grayson, Mark Watson, and Avi Lior for their support, feedback, and guidance through the various stages of this work 💖
5. Appendix - Delivery Options 🎀
Okay so these delivery options are explained using IEEE 802.11 access networks, but they're honestly applicable to other access networks too, as long as those use EAP [RFC3748] for authentication and the NAI format [RFC4282] for identifying users 💖
The options assume that the AAA protocol is RADIUS [RFC2865]. Diameter [RFC3588] could also be used instead of RADIUS without introducing significant architectural differences ✨
The main difference between the options is which entity in the access network creates the EAP-Request/Identity. For example, the EAP server might be played by the EAP authenticator (where an initial EAP-Request/Identity is sent with an identity hint), or by a RADIUS proxy/server (where the NAIRealm is used for forwarding) 🦋
The RADIUS proxy/server only acts on the RADIUS User-Name(1) attribute and doesn't have to parse the EAP-Message attribute 💅
Option 1: Initial EAP-Request/Identity from the access point 📡
In typical IEEE 802.11 wireless LANs, the initial EAP-Request/Identity is sent by the access point (i.e., EAP authenticator). In the simplest case, the identity hint information is just included in this request, like so 🧚
EAP Access Point local RADIUS home RADIUS
Peer proxy/server server
| 1. EAP | | |
| Request/Identity | | |
| (NAIRealms) | | |
|<------------------| | |
| 2. EAP | | |
| Response/Identity| | |
|------------------>| | |
| | 3. Access-Request | |
| | (EAP | |
| | Response/Identity)| |
| |------------------->| |
| | | 4. Access-Request |
| | | (EAP |
| | | Response/Identity) |
| | |------------------->|
| | | |
|<-------------------EAP conversation ----------------------->|Current access points do not support this mechanism, so other options may be preferable 🙈 This option can also require configuring the identity hint information on a potentially large number of access points, which may be a problem if the information changes often 💀
Option 2: Initial EAP-Request/Identity from the local RADIUS proxy/server 🌸
This is similar to Option 1, but the initial EAP-Request/Identity is created by the local RADIUS proxy/server instead of the access point. Once a peer associates with an access network AP using IEEE 802.11 procedures, the AP sends an EAP-Start message [RFC3579] within a RADIUS Access-Request. The access network RADIUS server can then send the EAP-Request/Identity containing the identity hint information 🔥
EAP Access Point local RADIUS home RADIUS
Peer proxy/server server
| | 1. Access-Request | |
| | (EAP-Start) | |
| |------------------->| |
| | 2. Access-Challenge| |
| | (EAP | |
| | Request/Identity | |
| | with NAIRealms) | |
| |<-------------------| |
| 3. EAP | | |
| Request/Identity | | |
| (NAIRealms) | | |
|<------------------| | |
| 4. EAP | | |
| Response/Identity | | |
|------------------>| | |
| | 5. Access-Request | |
| | (EAP | |
| | Response/Identity) | |
| |------------------->| |
| | | 6. Access-Request |
| | | (EAP |
| | | Response/Identity) |
| | |------------------->|
| | | |
|<------------------- EAP conversation ---------------------->|This option can work with current access points if they support the EAP-Start message 👑
Option 3: Subsequent EAP-Request/Identity from local RADIUS proxy/server 🦋
In the third option, the access point sends the initial EAP-Request/Identity without any hint information. The peer then responds with an EAP-Response/Identity, which is forwarded to the local RADIUS proxy/server. If the RADIUS proxy/server cannot route the message based on the identity the peer provided, it sends a second EAP-Request/Identity containing the identity hint information 😭
EAP Access Point local RADIUS home RADIUS
Peer proxy/server server
| | | |
| 1. EAP | | |
| Request/Identity | | |
| (w/o NAIRealms) | | |
|<------------------| | |
| 2. EAP | | |
| Response/Identity | | |
|------------------>| | |
| | 3. Access-Request | |
| | (EAP | |
| | Response/Identity) | |
| |------------------->| |
| | 4. Access-Challenge| |
| | (EAP | |
| | Request/Identity | |
| | with NAIRealms) | |
| |<-------------------| |
| 5. EAP | | |
| Request/Identity | | |
| (NAIRealms) | | |
|<------------------| | |
| 6. EAP | | |
| Response/Identity | | |
|------------------>| | |
| | 7. Access-Request | |
| | (EAP | |
| | Response/Identity) | |
| |------------------->| |
| | | |
======================Failure due to unknown realm=============
| | | |
| | 7a. Access-Reject | |
| | (EAP-Failure) | |
| |<-------------------| |
| 7b. EAP | | |
| Failure | | |
|<------------------| | |
================================================================
| | | |
| | | 8. Access-Request |
| | | (EAP |
| | | Response/Identity) |
| | |------------------->|
| | | |
|<-------------------- EAP conversation --------------------->|This option does not require changes to existing NASes, so it may be preferable in many environments 🌈
6. References 📚
6.1. Normative References
[RFC4282] Aboba, B., Beadles, M., Arkko, J., and P. Eronen,
"The Network Access Identifier", RFC 4282, December
2005.
[RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J.,
and H. Levkowetz, "Extensible Authentication
Protocol (EAP)", RFC 3748, June 2004.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4234] Crocker, D. and P. Overell, "Augmented BNF for
Syntax Specifications: ABNF", RFC 4234, October
2005.
[RFC2607] Aboba, B. and J. Vollbrecht, "Proxy Chaining and
Policy Implementation in Roaming", RFC 2607, June
1999.6.2. Informative References
[RFC3579] Aboba, B. and P. Calhoun, "RADIUS (Remote
Authentication Dial In User Service) Support For
Extensible Authentication Protocol (EAP)", RFC 3579,
September 2003.
[netsel-problem] Arkko, J. and B. Aboba, "Network Discovery and
Selection Problem", Work in Progress, October 2005.
[TS-23.234] 3GPP TS 23.234 V6.6.0, "3GPP System to Wireless
Local Area Network (WLAN) interworking; System
description (Release 6)", September 2005.
[TS-24.234] 3GPP TS 24.234 V6.4.0, "3GPP System to Wireless
Local Area Network (WLAN) interworking; User
Equipment (UE) to network protocols; Stage 3
(Release 6)", September 2005.
[RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G.,
and J. Arkko, "Diameter Base Protocol", RFC 3588,
September 2003.
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service
(RADIUS)", RFC 2865, June 2000.Authors' Addresses 🫶
Farid Adrangi
Intel Corporation
2111 N.E. 25th Avenue
Hillsboro, OR 97124
USA
Phone: +1 503-712-1791
EMail: farid.adrangi@intel.com
Victor Lortz
Intel Corporation
2111 N.E. 25th Avenue
Hillsboro, OR 97124
USA
Phone: +1 503-264-3253
EMail: victor.lortz@intel.com
Farooq Bari
Cingular Wireless
7277 164th Avenue N.E.
Redmond, WA 98052
USA
Phone: +1 425-580-5526
EMail: farooq.bari@cingular.com
Pasi Eronen
Nokia Research Center
P.O. Box 407
FIN-00045 Nokia Group
Finland
EMail: pasi.eronen@nokia.comFull Copyright Statement 💖
Okay, bestie, time for the legal bit 🎀 Copyright is held by The Internet Society (2006). This document is subject to the rights, licenses and restrictions in BCP 78, and apart from what BCP 78 says, the authors keep all their rights. 📜
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Translation: no warranties, full stop 💀 Use it at your own risk, no cap.
Intellectual Property 🦋
The IETF doesn't take a side on whether any Intellectual Property Rights, or other rights that someone might claim over the technology in this document, are valid or how far they reach. It also doesn't say whether a license for those rights is or isn't available, and it hasn't independently searched for any such rights. If you want to know how rights work for RFC documents, check out BCP 78 and BCP 79 🌸
Copies of IPR disclosures sent to the IETF Secretariat are available, along with any assurances of licenses that have been promised. You can also get the results of any attempt to obtain a general license or permission to use proprietary rights, for implementers or users of this specification, from the IETF's online IPR repository at http://www.ietf.org/ipr ✨
If you know about any copyrights, patents, patent applications or other proprietary rights that might cover technology needed to implement this standard, please tell the IETF about them at ietf-ipr@ietf.org. The IETF really wants to hear from you 🫶
Acknowledgement 🌈
The RFC Editor function is funded by the IETF Administrative Support Activity (IASA). Thank you, IASA, for keeping the lights on 👑
📦 where this page comes from
- ietf: rfc4284 2006-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms