Re: [abfab] Gen-ART review of draft-ietf-abfab-eapapplicability-03

[Sam Hartman <[e-mail]>]

>>>>> "Black," == Black, David <[e-mail]> writes:

    Black,> The next to last paragraph on p.3 begins with this sentence:

    Black,>    For these reasons, channel binding MUST be implemented by
    Black,> peers, EAP servers and AAA servers in environments where EAP
    Black,> authentication is used to access application layer services.

    Black,> It appear that this "MUST" requirement applies to all uses
    Black,> of EAP, including network access authentication, not just
    Black,> application layer access authentication.  If so, that's not
    Black,> immediately obvious from the text, and an additional
    Black,> sentence should be added to make this clearer.  If not, the
    Black,> above sentence needs to exclude network access
    Black,> authentication from that requirement.


I know you're correct that AAA servers and EAP servers need to implement
channel binding for network access in such environments.
I'm not sure whether peers only doing network access SHOULD implement
channel binding or MUST implement channel binding.

Practically speaking, it will be a while before peers implement channel
binding for network access.
The sorts of attacks that result without channel binding are attacks
where a peer thinks it is doing network access authentication but what
it's really doing is helping an attacker access an application.
If all the application access peers support channel binding, then you
could potentially require the eap-lower-layer attribute or similar for
application authentication and work securely in environments where peers
for network access have not been updated yet.
It's also kind of tempting to stick our head in the sand and just add
the clarification that "yes, we mean network access too."

--Sam