Re: [saag] EAP-NOOB

[Benjamin Kaduk <[e-mail]>]

On Thu, 7 Apr 2016, Henry B (Hank) Hotz, CISSP wrote:

>
> > On Apr 7, 2016, at 11:24 AM, Bernard Aboba <[e-mail]> wrote:
> >
> > Hannes said:
> >
> > "For example, Kerberos would
> > do such a bootstrapping between a client and a server based on already
> > existing keys established between the client and the KDC and the server
> > and the KDC."
> >
> > [BA] As far as I know, there is no deployed usage of Kerberos-based EAP authentication.  The major issue is that a host typically does not have Internet access prior to completing EAP authentication, so that Kerberos would need to be integrated with EAP in order for Kerberos tickets to be obtained.
>
> I would love to hear that statement proved wrong. There is (was) a GSS-EAP draft. AFAIK (I haven’t read it) it primarily provided for tunneling the Kerberos messages via EAP.
>
> Is there still insufficient interest in creating such a thing?

draft-ietf-abfab-gss-eap became RFC 7055, and my understanding is that the
authors do have it deployed in production, though probably (mostly?) with
a non-kerberos GSS mechanism.

The IAKERB GSS mechanism (draft-ietf-kitten-iakerb) provides a way to have
the GSS acceptor proxy kerberos messages between the GSS initiator and the
KDC, which would permit an EAP client to obtain initial kerberos
credentials during the process of authenticating to EAP.  IAKERB is
implemented in MIT krb5, though I do not actually know of anyone deploying
it with GSS-EAP.

-Ben