1 Introduction .......................................................................................................... 5
1.1 Glossary ............................................................................................................ 5
1.2 References ......................................................................................................... 6
1.2.1 Normative References ..................................................................................... 6
1.2.2 Informative References ................................................................................... 7
1.3 Protocol Overview (Synopsis) ................................................................................ 7
1.4 Relationship to Other Protocols .............................................................................. 9
1.5 Prerequisites/Preconditions ................................................................................... 10
1.6 Applicability Statement ........................................................................................ 10
1.7 Versioning and Capability Negotiation ..................................................................... 10
1.8 Vendor-Extensible Fields....................................................................................... 10
1.9 Standards Assignments ........................................................................................ 10
2 Messages............................................................................................................... 11
2.1 Transport ........................................................................................................... 11
2.2 Message Syntax .................................................................................................. 11
2.2.1 EAP Packet ................................................................................................... 11
2.2.2 PEAP Packet .................................................................................................. 12
2.2.3 TLV ............................................................................................................. 14
2.2.4 Vendor-Specific TLV ....................................................................................... 14
2.2.5 EAP Expanded Types ...................................................................................... 15
2.2.6 EAP Extensions Methods.................................................................................. 15
2.2.6.1 EAP TLV Extensions Method ........................................................................ 16
2.2.6.1.1 Cryptobinding TLV ............................................................................... 16
2.2.6.1.2 Result TLV ......................................................................................... 19
2.2.6.1.3 SoH Response TLV .............................................................................. 20
2.2.6.2 SoH EAP Extensions Method ....................................................................... 20
2.2.6.2.1 SoH Request TLV ................................................................................ 21
2.2.6.2.2 SoH TLV ............................................................................................ 21
3 Protocol Details ..................................................................................................... 23
3.1 Common Details.................................................................................................. 23
3.1.1 Abstract Data Model ....................................................................................... 23
3.1.2 Timers ......................................................................................................... 23
3.1.3 Initialization .................................................................................................. 23
3.1.4 Higher-Layer Triggered Events ......................................................................... 23
3.1.5 Message Processing Events and Sequencing Rules ............................................... 23
3.1.5.1 Status and Error Handling .......................................................................... 23
3.1.5.2 PEAP Packet Processing ............................................................................. 23
3.1.5.3 Version Negotiation ................................................................................... 23
3.1.5.4 Phase 1 (TLS Tunnel Establishment) ............................................................ 24
3.1.5.5 SoH Transmission ..................................................................................... 24
3.1.5.6 Cryptobinding .......................................................................................... 24
3.1.5.6.1 Input Data Used in the Cryptobinding HMAC-SHA1-160 Operation ............... 25
3.1.5.6.2 Key Used in the Cryptobinding HMAC-SHA1-160 Operation ......................... 25
3.1.5.6.2.1 PEAP Tunnel Key (TK) ..................................................................... 25
3.1.5.6.2.2 Intermediate PEAP MAC Key (IPMK) and Compound MAC Key (CMK) ...... 26
3.1.5.7 Phase 2 (EAP Encapsulation) ...................................................................... 27
3.1.6 Key Management ........................................................................................... 28
3.1.7 Timer Events ................................................................................................. 28
3.1.8 Other Local Events ......................................................................................... 28
3.2 Peer Details ........................................................................................................ 28
3.2.1 Abstract Data Model ....................................................................................... 28
3.2.2 Timers ......................................................................................................... 29
3.2.3 Initialization .................................................................................................. 29
3.2.4 Higher-Layer Triggered Events ......................................................................... 29
3.2.5 Message Processing Events and Sequencing Rules ............................................... 29
3.2.5.1 Status and Error Handling .......................................................................... 29
3.2.5.2 EAP Packet Processing ............................................................................... 29
3.2.5.3 Phase 1 (TLS Tunnel Establishment) ............................................................ 29
3.2.5.4 SoH Request Processing ............................................................................ 30
3.2.5.5 SoH Response Processing........................................................................... 31
3.2.5.6 EAP Peer Cryptobinding Processing .............................................................. 31
3.2.5.7 Phase 2 (EAP Encapsulation) ...................................................................... 31
3.2.6 Key Management ........................................................................................... 32
3.2.7 Timer Events ................................................................................................. 32
3.2.8 Other Local Events ......................................................................................... 32
3.3 EAP Server Details ............................................................................................... 32
3.3.1 Abstract Data Model ....................................................................................... 32
3.3.2 Timers ......................................................................................................... 32
3.3.3 Initialization .................................................................................................. 33
3.3.4 Higher-Layer Triggered Events ......................................................................... 33
3.3.5 Message Processing Events and Sequencing Rules ............................................... 33
3.3.5.1 Status and Error Handling .......................................................................... 33
3.3.5.2 EAP Packet Processing ............................................................................... 33
3.3.5.3 Phase 1 (TLS Tunnel Establishment) ............................................................ 33
3.3.5.4 SoH Processing ........................................................................................ 34
3.3.5.5 PEAP Server Cryptobinding Processing ......................................................... 34
3.3.5.6 Phase 2 (EAP Encapsulation) ...................................................................... 35
3.3.6 Key Management ........................................................................................... 35
3.3.7 Timer Events ................................................................................................. 35
3.3.8 Other Local Events ......................................................................................... 35
4 Protocol Examples ................................................................................................. 36
4.1 Examples with No Support for Cryptobinding and SoH Processing ................................ 36
4.1.1 Successful PEAP Phase 1 and 2 Negotiation ........................................................ 36
4.1.2 Successful PEAP Phase 1 with Failed Phase 2 Negotiation ...................................... 37
4.1.3 Successful PEAP Phase 1 with Fast Reconnect ..................................................... 38
4.2 Cryptobinding and SoH Processing Supported on EAP Server Only ............................... 39
4.2.1 Successful PEAP Phase 1 and 2 Negotiation ........................................................ 39
4.3 Cryptobinding and SoH Processing on EAP Server and EAP Peer .................................. 40
4.3.1 Successful PEAP Phase 1 and 2 Negotiation ........................................................ 41
4.3.2 Successful PEAP Phase 1 with Fast Reconnect ..................................................... 42
4.3.3 Fallback to Full Authentication upon a Fast Reconnect Failure ................................ 42
5 Security ................................................................................................................. 44
5.1 Security Considerations for Implementers ............................................................... 44
5.1.1 Fast Reconnect .............................................................................................. 44
5.1.2 Identity Verification ........................................................................................ 44
5.1.3 Authentication Outcomes ................................................................................ 44
5.2 Index of Security Parameters ................................................................................ 44
http://www.rayfile.com/files/1a90eff3-7e0e-11dd-bf4d-0019d11a795f/