[TLS] Fwd: I-D Action:draft-nir-tls-eap-02.txt

[Yoav Nir <[e-mail]>]

Hi all.

We've published the -02 iteration of the TEE draft. The aim is to  
leverage EAP-using infrastructure such as RADIUS and DIAMETER servers  
for the authentication of TLS sessions.

Following comments expressed about version -01, we've added some text  
that explains why the EAP exchange needs to be integrated into the  
TLS handshake rather than be part of the application.

Comments are welcome.


Begin forwarded message:

> From: [e-mail]
> Date: October 14, 2007 4:00:02 PM IST
> To: [e-mail]
> Subject: I-D Action:draft-nir-tls-eap-02.txt
> Reply-To: [e-mail]
>
> A New Internet-Draft is available from the on-line Internet-Drafts  
> directories.
>
> 	Title           : TLS using EAP Authentication
> 	Author(s)       : Y. Nir, et al.
> 	Filename        : draft-nir-tls-eap-02.txt
> 	Pages           : 19
> 	Date            : 2007-10-14
>
> This document describes an extension to the TLS protocol to allow TLS
> clients to authenticate with legacy credentials using the Extensible
> Authentication Protocol (EAP).
>
> This work follows the example of IKEv2, where EAP has been added to
> the IKEv2 protocol to allow clients to use different credentials such
> as passwords, token cards, and shared secrets.
>
> When TLS is used with EAP, additional records are sent after the
> ChangeCipherSpec protocol message and before the Finished message,
> effectively creating an extended handshake before the application
> layer data can be sent.  Each EapMsg handshake record contains
> exactly one EAP message.  Using EAP for client authentication allows
> TLS to be used with various AAA back-end servers, such as RADIUS or
> Diameter.
>
> TLS with EAP may be used for securing a data connection such as HTTP
> or POP3.  We believe it has three main benefits:
> o  The ability of EAP to work with backend servers can remove that
>
> burden from the application layer.
> o  Moving the user authentication into the TLS handshake protects the
>
> presumably less secure application layer from attacks by
>
> unauthenticated parties.
> o  Using mutual authentication methods within EAP can help thwart
>
> certain classes of phishing attacks.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-nir-tls-eap-02.txt
>
> To remove yourself from the I-D Announcement list, send a message to
> [e-mail] with the word unsubscribe in the body of
> the message.
> You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
> to change your subscription settings.
>
> Internet-Drafts are also available by anonymous FTP. Login with the
> username "anonymous" and a password of your e-mail address. After
> logging in, type "cd internet-drafts" and then
> 	"get draft-nir-tls-eap-02.txt".
>
> A list of Internet-Drafts directories can be found in
> http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
> Internet-Drafts can also be obtained by e-mail.
>
> Send a message to:
> 	[e-mail].
> In the body type:
> 	"FILE /internet-drafts/draft-nir-tls-eap-02.txt".
>
> NOTE:   The mail server at ietf.org can return the document in
> 	MIME-encoded form by using the "mpack" utility.  To use this
> 	feature, insert the command "ENCODING mime" before the "FILE"
> 	command.  To decode the response(s), you will need "munpack" or
> 	a MIME-compliant mail reader.  Different MIME-compliant mail readers
> 	exhibit different behavior, especially when dealing with
> 	"multipart" MIME messages (i.e. documents which have been split
> 	up into multiple messages), so check your local documentation on
> 	how to manipulate these messages.
>
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.
> Content-Type: text/plain
> Content-ID: <2007-10-14095758.I-D\@ietf.org>
>
> _______________________________________________
> I-D-Announce mailing list
> [e-mail]
> https://www1.ietf.org/mailman/listinfo/i-d-announce

_______________________________________________
TLS mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tls