RFC 5421
Basic Password Exchange within the Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST)
📜 RFC 5421 Title Block, Bestie 🎀
Okay so RFC 5421 is an Informational doc 🧚, which means it's not an Internet standard. It's just info for the Internet community. It came out of the Network Working Group in March 2009, and the authors are N. Cam-Winget and H. Zhou from Cisco Systems. The title is Basic Password Exchange within the Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST). The title block doesn't list anything it obsoletes or updates, so it's standing on its own ✨.
Status of This Memo 💌
This memo gives info to the Internet community. It doesn't specify an Internet standard of any kind. Distribution of this memo is unlimited 💜.
Copyright Notice 🔒
Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved 🦋.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, as they stand on the publication date of this document (http://trustee.ietf.org/license-info). Please review these documents carefully, because they spell out your rights and restrictions for this document 📖.
This document may contain material from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008. The people controlling the copyright in some of that material may not have given the IETF Trust permission to allow changes to it outside the IETF Standards Process. Without an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process. The one exception is formatting it for publication as an RFC or translating it into languages other than English 🌈.
IESG Note 🧁
EAP-FAST has been implemented by many vendors and it is used in the Internet. Publishing this spec is meant to boost interoperability by documenting current use of existing EAP methods within EAP-FAST 🤝.
The EAP method EAP-FAST-GTC reuses the EAP type code assigned to EAP-GTC (6). Reusing previously assigned EAP Type Codes is incompatible with EAP method negotiation as defined in RFC 3748 💀.
Since EAP-GTC doesn't support method-specific version negotiation, EAP-FAST-GTC is implied whenever it's used inside the EAP-FAST tunnel during authentication. This behavior may cause problems in implementations where another vendor's EAP-GTC is required. Since that support needs special case execution of a method within a tunnel, it also complicates implementations that use the same method code both inside and outside of the tunnel method 🙈. If EAP-FAST were designed today, these difficulties could be avoided by using unique EAP Type codes. Given all of this, assigned method types must not be re-used with different meaning inside tunneled methods in the future 🫶.
Abstract 🍓
The Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST) method lets a peer and a server talk securely by using Transport Layer Security (TLS) to set up a mutually authenticated tunnel 🔐. Inside that tunnel, a basic password exchange based on the Generic Token Card method (EAP-GTC) may be run to authenticate the peer ✨.
Table of Contents 🗂️
1. Introduction ....................................................2
1.1. Specification Requirements .................................3
2. EAP-FAST GTC Authentication .....................................3
3. Security Considerations .........................................7
3.1. Security Claims ............................................7
4. IANA Considerations .............................................8
5. Acknowledgments .................................................9
6. References ......................................................9
6.1. Normative References .......................................9
6.2. Informative References .....................................91. Introduction 🌸
EAP-FAST [RFC4851] is an EAP method that can mutually authenticate a peer and a server 🤩. This document describes the EAP-FAST inner EAP method, EAP-FAST-GTC, which is used to authenticate the peer through a basic password exchange. EAP-FAST-GTC was built to support cleartext passwords for legacy user databases, to make password changes easier, and to support one-time password features like new pin mode 🔑.
Message exchanges, including user credentials, are cleartext strings sent inside the encrypted TLS tunnel, and so they're considered secure 🛡️. For historical reasons, EAP-FAST-GTC uses EAP Type 6, which was originally allocated to EAP-GTC [RFC3748]. Note that EAP-FAST-GTC payloads used in EAP-FAST need specific formatting, so they won't necessarily be compatible with EAP-GTC mechanisms used outside of EAP-FAST 👀.
To avoid interference between these two methods, EAP-FAST-GTC MUST NOT be used outside an EAP-FAST tunnel, and EAP-GTC MUST NOT be used inside an EAP-FAST tunnel. 🚫
All EAP-FAST-GTC packets sent within the TLS tunnel must be encapsulated in EAP Payload TLVs, described in [RFC4851] 📦.
It's assumed that you already know EAP-FAST [RFC4851] before reading this document 💅.
1.1. Specification Requirements 💖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🎀.
2. EAP-FAST GTC Authentication ✨
Okay so bestie, every EAP-FAST-GTC packet inside EAP-FAST (except the empty acknowledgment packet 🫶) MUST follow the "LABEL=Value" format. All Labels are ASCII text and they SHALL NOT contain the space character. Right now there are three Labels:
CHALLENGE: the server request packet MUST be in the formCHALLENGE=Value, where Value is the server challenge, like "please enter your password" 🎀RESPONSE: the peer response packet MUST be in the formRESPONSE=Value, where Value is the peer response 💅E: the server failure packet MUST be in the formE=Value, where Value is the error message the server generated 😭
If the peer or the server gets an EAP-FAST-GTC request or response that doesn't match the format above, it SHOULD fail the authentication by sending a Result TLV with a failure. Not the vibe 💀
Once the TLS encryption tunnel is set up and EAP-FAST Authentication phase 2 starts, the EAP server sends an EAP-FAST-GTC Request with a server challenge in it. The server challenge is a displayable message the peer can use to prompt the user, so it's literally the first "hey, who are you?" moment 🦋
A peer MAY prompt the user for their credentials, or it can use credentials it already got some other way without bugging the user 🌸 When it does send them back, the EAP-FAST-GTC Response looks like this:
"RESPONSE=user@example.com\0secret"Here "user@example.com" is the actual username and "secret" is the actual password. The NULL character "\0" is what separates the username from the password 🍓
The username and password go together in one message, in the first response packet. This is an optimization because it skips the inner method EAP-Identity exchange, so there's one less round trip. Efficient and iconic 👑
Once the EAP-FAST server gets the user credentials, it SHOULD first validate the user identity with the Initiator ID (I-ID) [RFC5422] in the PAC-Opaque (Protected Access Credential). If that matches, it keeps going and authenticates the user against internal or external user databases 🔥
Additional exchanges MAY happen between the EAP-FAST server and the peer to support various user authentications. The server might send more challenges to ask the peer for more info, like the next token or a new PIN in the one time password case, or it might send a server failure packet to show an error. The peer shows the prompt to the user again and sends the needed info back in an EAP-FAST-GTC Response. The exchange ends when a Result TLV is received ✨
When authentication fails, an EAP-FAST-GTC server implementation inside EAP-FAST uses this format to indicate the error:
"E=eeeeeeeeee R=r M=<msg>"Where:
The "eeeeeeeeee" is the ASCII representation of a decimal error code from the list below. Peer implementations SHOULD deal with codes that aren't on this list gracefully 🧚
The error code doesn't have to be 10 digits long. Just saying 🙈
Here's the complete list of predefined error codes:
646ERROR_RESTRICTED_LOGON_HOURS- Means access was attempted outside the allowed hours. Peer implementations SHOULD display the error message to the user and ask them to try again later ⏰
647ERROR_ACCT_DISABLED- Means the requested account is disabled. Peer implementations SHOULD display the error message to the user, which helps them sort it out with the administrator 🫠
648ERROR_PASSWD_EXPIRED- Means the password has expired and a password change is required. Peer implementations SHOULD prompt the user for a new password and send the new password back in the peer response packet 🔑
649ERROR_NO_DIALIN_PERMISSION- Means access was denied because there's no dial-in permission. Peer implementations SHOULD display the error message to the user, which helps them resolve it with the administrator 📞
691ERROR_AUTHENTICATION_FAILURE- Means authentication failed because the username or password was wrong. Based on the retry flag described below, peer implementations MAY prompt the user again for a new username and password, or they can just send back an empty acknowledgment packet to acknowledge the failure and move into the termination phase of the authentication session 🥲
709ERROR_CHANGING_PASSWORD- Means the password change failed, most likely because the new password doesn't meet the password complexity policy. Peer implementations SHOULD display the error message and prompt the user again for the new password 🔐
755ERROR_PAC_I-ID_NO_MATCH- Means the PAC used to set up the EAP-FAST session can't be used to authenticate to this user account. Based on the retry flag described below, peer implementations MAY prompt the user again for a new username and password, or they can just send back an empty acknowledgment packet and go into the termination phase of the authentication session 🦋
The "r" is a single ASCII character flag. It's set to '1' if a retry is allowed and '0' if not. When the server sets this flag to '1', it turns off short timeouts, because it's expecting the peer to prompt the user for new credentials and resubmit the response. When the server sets this flag to '0', the peer SHOULD NOT prompt the user for new credentials to try again without restarting the EAP-FAST authentication from the very beginning 🚫
The <msg> is human-readable ASCII text. Current implementations only support ASCII text 💜
The server failure packet can be split into Label/Value pairs using the space character as the separator. The only value that may contain a space character is the <msg> value, and it's always the last pair in the failure packet. The peer SHOULD ignore any unknown label/value pair in the failure packet 🌈
The error format above is similar to what's defined in the Microsoft Challenge Handshake Authentication Protocol version 2 (MSCHAPv2) [RFC2759], except it leaves out the server challenge. So if the EAP-FAST server is passing MSCHAPv2 exchanges to the backend inner method server, it can just return whatever the backend returns, minus the server challenge. If it's connecting to a one time password or Lightweight Directory Access Protocol (LDAP) [RFC4511] server, the EAP-FAST server can translate the error message into this format. With the retry count added, the peer can maybe prompt the user for new credentials and try again without restarting EAP-FAST authentication from the beginning. The peer responds to the error code with another EAP-FAST-GTC Response packet that has both the new username and password. For other unrecoverable failures, it sends back an empty EAP-FAST-GTC packet as the acknowledgment. The peer uses an empty EAP-FAST-GTC payload as its acknowledgment of the unrecoverable failure 🫶
If the EAP-FAST server finishes authentication for the EAP-FAST-GTC inner method, it moves on to Protected Termination as described in [RFC4851]. If there's an unrecoverable EAP-FAST-GTC authentication failure, the EAP server can send an EAP-FAST-GTC error code like the ones above, along with the Result TLV for protected termination. That way no extra round trips happen. The peer can acknowledge both the EAP-FAST-GTC failure and the Result TLV in the same EAP-FAST packet. Once the server gets the acknowledgment, the TLS tunnel is torn down and a clear text EAP-Failure is sent 🎬
The username and password, as well as server challenges, MAY support non-ASCII characters. In that case, international usernames, passwords, and messages are based on Unicode characters, encoded as UTF-8 [RFC3629] and processed with a certain algorithm to make sure they have a canonical representation 🌍 The username and password input SHOULD be processed according to Section 2.4 of [RFC4282], and the server challenges SHOULD be processed according to [RFC5198].
Since EAP-FAST-GTC doesn't generate session keys, the MSKi (Master Session Key) used for crypto-binding in EAP-FAST gets filled with all zeros 0️⃣
3. Security Considerations 🔒
Okay this part is SERIOUS bestie 😭 The EAP-FAST-GTC method sends password information in the clear, so it MUST NOT be used outside of a protected tunnel that provides strong protection, like the one EAP-FAST gives. Weak encryption, like 40-bit encryption or a NULL cipher, MUST NOT be used.
The peer MUST authenticate the server before it discloses its credentials. Nope, no exceptions!
Since EAP-FAST Server-Unauthenticated Provisioning Mode doesn't authenticate the server, EAP-FAST-GTC MUST NOT be used as the inner method in that mode. EAP-FAST-GTC MAY be used in EAP-FAST authentication and in Server-Authenticated Provisioning Mode [RFC5422], where the server is authenticated 🛡️
Since EAP-FAST-GTC requires the server to have access to the actual authentication secret, it is RECOMMENDED to vary the stored authentication validation data by domain. That way, if a server at one location gets compromised, the others don't go down with it 💔
3.1. Security Claims 🔐✨
okay so this part is the EAP security claims checklist 💅 it's basically the spec saying what EAP-FAST-GTC does and doesn't bring to the table for EAP [RFC3748], one property at a time. "No" means it doesn't do it on its own, and the "however" bits are where it gets some help (usually from EAP-FAST). the table is in a code block so every line stays exactly as written 🎀
Auth. mechanism: Password based.
Ciphersuite negotiation: No. However, such negotiation is provided
by EAP-FAST for the outer authentication.
Mutual authentication: No. However, EAP-FAST provides server-side
authentication.
Integrity protection: No. However, any method executed within the
EAP-FAST tunnel is protected.
Replay protection: See above.
Confidentiality: See above.
Key derivation: Keys are not generated, see Section 2.
However, when used inside EAP-FAST, the
outer method will provide keys. See
[RFC4851] for the properties of those keys.
Key strength: See above.
Dictionary attack prot.: No. However, when used inside the EAP-FAST
tunnel, the protection provided by the TLS
tunnel prevents an off-line dictionary
attack.
Fast reconnect: No. However, EAP-FAST provides a fast
reconnect capability that allows the reuse
of an earlier session authenticated by EAP-
FAST-GTC.
Cryptographic binding: No. Given that no keys are generated, EAP-
FAST-GTC or its use within EAP-FAST cannot
provide a cryptographic assurance that no
binding attack has occurred. EAP-FAST-GTC
is required only to run within a protected
tunnel, but even the use of the same
credentials in some other, unprotected
context might lead to a vulnerability. As a
result, credentials used in EAP-FAST-GTC
SHOULD NOT be used in other unprotected
authentication mechanisms.
Session independence: No. However, EAP-FAST provides session
independence.
Fragmentation: No. However, EAP-FAST provides support for
this.
Key Hierarchy: Not applicable.
Channel binding: No, though EAP-FAST can be extended for
this.⚠️ the big one is cryptographic binding 😭 no keys get generated here, so EAP-FAST-GTC can't prove that a binding attack didn't happen. and even if you only ever run it inside the protected tunnel, reusing the same credentials somewhere unprotected could still open a vulnerability. so the spec says credentials used in EAP-FAST-GTC SHOULD NOT be used in other unprotected authentication mechanisms. don't be that girl who reuses her passwords everywhere 🙈
4. IANA Considerations 📋🌸
okay IANA stuff, bestie: EAP-FAST-GTC uses the value 6 (EAP-GTC) for the EAP Type in [RFC3748] 🦋
this doc also sets up a registry for EAP-FAST-GTC error codes (when it's running inside EAP-FAST), called "EAP-FAST GTC Error Codes". new codes can get assigned through Specification Required, as defined in [RFC5226]. here's the summary of the codes defined so far:
646 ERROR_RESTRICTED_LOGON_HOURS647 ERROR_ACCT_DISABLED648 ERROR_PASSWD_EXPIRED649 ERROR_NO_DIALIN_PERMISSION691 ERROR_AUTHENTICATION_FAILURE709 ERROR_CHANGING_PASSWORD755 ERROR_PAC_I-ID_NO_MATCH
no IANA registry is getting made for Labels 🏷️ current implementations only support the Labels in this document and new ones aren't expected. if they ever are needed, they can be defined in documents that update this one ✨
5. Acknowledgments 🫶
the authors wanna thank Joe Salowey and Amir Naftali for their input on the problem space 💜 and Jouni Malinen, Pasi Eronen, Jari Arkko, and Chris Newman for reviewing the doc 👑
6. References 📚
6.1. Normative References 💖
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.
- [RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H. Levkowetz, "Extensible Authentication Protocol (EAP)", RFC 3748, June 2004.
- [RFC4282] Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The Network Access Identifier", RFC 4282, December 2005.
- [RFC4851] Cam-Winget, N., McGrew, D., Salowey, J., and H. Zhou, "The Flexible Authentication via Secure Tunneling Extensible Authentication Protocol Method (EAP-FAST)", RFC 4851, May 2007.
- [RFC5198] Klensin, J. and M. Padlipsky, "Unicode Format for Network Interchange", RFC 5198, March 2008.
- [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008.
6.2. Informative References 🧚
- [RFC2759] Zorn, G., "Microsoft PPP CHAP Extensions, Version 2", RFC 2759, January 2000.
- [RFC4511] Sermersheim, J., "Lightweight Directory Access Protocol (LDAP): The Protocol", RFC 4511, June 2006.
- [RFC5422] Cam-Winget, N., McGrew, D., Salowey, J., and H. Zhou, "Dynamic Provisioning Using Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST)", RFC 5422, March 2009.
Authors' Addresses 💌
Nancy Cam-Winget
Cisco Systems
3625 Cisco Way
San Jose, CA 95134
US
EMail: ncamwing@cisco.com
Hao Zhou
Cisco Systems
4125 Highlander Parkway
Richfield, OH 44286
US
EMail: hzhou@cisco.com📦 where this page comes from
- ietf: rfc5421 2009-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms