EAP-TTLS draft-funk-eap-ttls-v0-01.txt

1
EAP-TTLSdraft-funk-eap-ttls-v0-01.txt

• Given by Steve Hanna for Paul Funk
• emu wg, IETF 69

2
Overview of EAP-TTLS

• TLS-based tunneled EAP method
• Phase 1 like EAP-TLS
• Phase 2 AVP exchange
• Supports
• Tunneled authentication via many methods
• Multiple forms of authentication
• Endpoint integrity checks
• Other extensions
• Documented in Internet-Drafts since 2001
• Widely implemented and deployed (eduroam, etc.)
• Cited by SDOs like WiMAX
• Plan to submit for RFC status

3
EAP-TTLS AVPs

• Diameter AVP format
• 32-bit type, 24-bit length
• Easy to tunnel existing EAP methods
• Not just password-based methods
• Easy to tunnel non-EAP authentication
• Easy to integrate with RADIUS servers
• Can translate AVPs into RADIUS packets

4
Proposed New EAP-TTLS AVPs

• Option AVPs
• Client indicates acceptable options
• Server indicates which option will be used
• MSKCalculation
• Options Outer, Inner, Mixed
• KeyConfirmation (intermediate and final)
• Options Enabled, Disabled
• SecureCompletion
• Options Disabled, Enabled
• TTLS-Success, TTLS-Failure
• Sent by Client and Server at end

5
Evaluation Against Requirements

• Transport of encrypted password for support of
  legacy password databases OK
• 2. Mutual authentication (specifically
  authentication of the server) OK
• 3. Resistance to offline dictionary attacks,
  man-in-the-middle attacks OK
• 4. Compliance with RFC 3748, RFC 4017 and EAP
  keying (including EMSK and MSK generation) OK
• 5. Peer identity confidentiality OK

6
Evaluation Against Requirements

• 6. Crypto agility and ciphersuite negotiation OK
  w TLS 1.2 new AVPs
• 7. Session resumption OK
• 8. Fragmentation and reassembly OK
• 9. Cryptographic binding OK w new AVPs
• 10. Password/PIN change OK when authentication
  method supports

7
Evaluation Against Requirements

• 11. Transport Channel binding data OK w new TBD
  AVPs
• 12. Protected result indication OK w new AVPs
• 13. Support for certificate validation protocols
  OK w TLS CertStatus extn
• 14. Extension mechanism OK

8
Summary

• EAP-TTLS
• Well-established EAP method
• Specified in Internet-Drafts since 2001
• Widely implemented
• Referred to by other standards bodies
• No known substantial IPR problems
• With forthcoming extensions, meets all Design
  Team requirements (required and desired)
• Offers many other features
• Tunneled authentication via many methods
• Multiple forms of authentication
• Endpoint integrity checks (for NEA)
• Why start over?