RFC 7029 on Extensible Authentication Protocol (EAP) Mutual Cryptographic Binding

A new Request for Comments is now available in online RFC libraries.

        RFC 7029

        Title:      Extensible Authentication Protocol (EAP) Mutual 
                    Cryptographic Binding 
        Author:     S. Hartman,
                    M. Wasserman,
                    D. Zhang
        Status:     Informational
        Stream:     IETF
        Date:       October 2013
        Mailbox:    hartmans-ietf@mit.edu, 
                    mrw@painless-security.com, 
                    zhangdacheng@huawei.com
        Pages:      19
        Characters: 45360
        Updates/Obsoletes/SeeAlso:   None

        I-D Tag:    draft-ietf-emu-crypto-bind-04.txt

        URL:        http://www.rfc-editor.org/rfc/rfc7029.txt

As the Extensible Authentication Protocol (EAP) evolves, EAP peers
rely increasingly on information received from the EAP server.  EAP
extensions such as channel binding or network posture information are
often carried in tunnel methods; peers are likely to rely on this
information.  Cryptographic binding is a facility described in RFC
3748 that protects tunnel methods against man-in-the-middle attacks.
However, cryptographic binding focuses on protecting the server
rather than the peer.  This memo explores attacks possible when the
peer is not protected from man-in-the-middle attacks and recommends
cryptographic binding based on an Extended Master Session Key, a new
form of cryptographic binding that protects both peer and server
along with other mitigations.

This document is a product of the EAP Method Update Working Group of the IETF.

INFORMATIONAL: This memo provides information for the Internet community.
It does not specify an Internet standard of any kind. Distribution of
this memo is unlimited.

This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
  http://www.ietf.org/mailman/listinfo/ietf-announce
  http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

For searching the RFC series, see http://www.rfc-editor.org/search/rfc_search.php
For downloading RFCs, see http://www.rfc-editor.org/rfc.html

Requests for special distribution should be addressed to either the
author of the RFC in question, or to rfc-editor@rfc-editor.org.  Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.

The RFC Editor Team
Association Management Solutions, LLC