[TLS] EAP-in-TLS and channel bindings

[Simon Josefsson <[e-mail]>]

Hi,

I want to explain again what I (unsuccessfully) tried to raise during
the presentation.  First it helps to recall the protocol flow with
TLS-in-EAP, from the document:

         Client                                               Server
         ------                                               ------

         ClientHello(*)             -------->
                                                      ServerHello(*)
                                                       (Certificate)
                                                   ServerKeyExchange
                                            EapMsg(Identity-Request)
                                     <--------       ServerHelloDone
         ClientKeyExchange
         (CertificateVerify)
         ChangeCipherSpec
         InterimAuth
         EapMsg(Identity-Reply)     -------->
                                                    ChangeCipherSpec
                                                         InterimAuth
                                                EapMsg(GPSK-Request)
                                    <--------
         EapMsg(GPSK-Reply)         -------->
                                                EapMsg(GPSK-Request)
                                    <--------
         EapMsg(GPSK-Reply)         -------->
                                                     EapMsg(Success)
                                    <--------               Finished
         Finished                   -------->

Note that the "Finished" messages are not sent until AFTER the EAP
exchange.  This means that the "tls-unique" channel binding (which
refers to the Finished messages) is not available to the EAP mechanism.
That means that the EAP mechanism is not able to channel bind to TLS
using "tls-unique", which results in weaker than necessary
authentication as far as I can see.

Do you see the problem now?

I see a few solutions:

1) Specify that when EAP-in-TLS is used, the "tls-unique" channel
binding should use the "InterimAuth" message instead of the "Finished"
message.

2) Specify a channel binding for TLS that doesn't use the "Finished"
message.

3) Specify that you always need to complete a full TLS handshake first,
and then re-handshake and do the EAP handshake during that phase.

There may be other solutions.  At this point I don't have an opinion on
what is a good way to resolve this.

/Simon