Subject: RE: [eap] Issue 174: Mandatory to Implement

From: "Walker, Jesse" <[email-masked]>
Date: Sun, 14 Sep 2003 02:18:19 -0700

Ill advised. EAP methods are outside the scope of the 802.11i PAR.

> -----Original Message-----
> From: Glen Zorn [mailto:[email-masked]]
> Sent: Friday, September 12, 2003 10:24 AM
> To: 'Bernard Aboba'
> Cc: [email-masked]
> Subject: RE: [eap] Issue 174: Mandatory to Implement
> 
> 
> Bernard Aboba <mailto:[email-masked]> writes:
> 
> >> The obvious problem is that this leaves EAP as essentially an empty
> >> framework, removing the basis for any but purely formal
> >> interoperability.  In addition, since AFAIK 802.11i doesn't specify
> >> any EAP method as mandatory (relying instead upon RFC 2284), it
> >> leaves them in the same boat.  Is this really desirable?
> > 
> > Since EAP MD5-Challenge is already illegal for use with 
> IEEE 802.11i,
> > they are already in this predicament, no? 
> 
> Is the use of EAP MD5-Challenge actually illegal or just ill-advised?
> 
> ~gwz
> 
> "They that can give up essential liberty to obtain a little temporary
> safety deserve neither..." 
> -- Benjamin Franklin, 1759
> 
> "It is forbidden to kill; therefore all murderers are punished unless
> they kill in large numbers and to the sound of trumpets." 
> -- Voltaire
> 
> 
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
> 
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "Walker, Jesse" <[email-masked]>
Date: Sun, 14 Sep 2003 02:20:22 -0700

Bernard,

The 802.11i drafts says that it assumes mutual authentication, but it can't require that people respect this assumption. People won't, and they will reap the consequences.

-- Jesse

> From: Bernard Aboba [mailto:[email-masked]]
> Sent: Friday, September 12, 2003 10:29 AM
> To: Glen Zorn
> Cc: [email-masked]
> I believe that it's illegal -- mutual authentication is required.

---

From: "Walker, Jesse" <[email-masked]>
Date: Sun, 14 Sep 2003 19:52:01 -0700

The right thing to do is to replace MD5 challenge as the mandatory-to-implement method. This will cause problems--it always does--but that's just how it is. To serve the future EAP must cut ties that are holding it in the past.

> > It seems wasteful to require an EAP peer to implement the
> > EAP MD5-Challenge method, even in situations (such as
> > IEEE 802.11i) where mutual authentication is required. Can
> > we relax this requirement?
> 
> interoperability.  In addition, since AFAIK 802.11i doesn't 
> specify any
> EAP method as mandatory (relying instead upon RFC 2284), it 
> leaves them
> in the same boat.  Is this really desirable?