Subject: EAP should use SASL not krb5

From: [email-masked] (Sam Hartman)
Date: Fri, 1 Nov 2002 19:11:49 -0500 (EST)

It seems to me that EAP should be based on SASL and not directly on
krb5.  Several of us reviewed EAP two IETF meetings ago and came to
the conclusion that doing an EAP SASL specification would be fairly
easy.

I'd certainly be happy to help with such a specification.

---

From: Derek Atkins <[email-masked]>
Date: 01 Nov 2002 19:36:58 -0500

Thanks for the feedback.  I'll pass it on to my cohorts, however I
think they want a krb5-specific method (for a number of reasons, which
I'm not sure I can state yet).  If we decide to try SASL instead of
krb5, then I'll certainly ask for your help.  However I've got the
majority of a krb5 method already designed.

-derek

--
       Derek Atkins
       Computer and Internet Security Consultant
       [email-masked]             www.ihtfp.com

---

From: Derek Atkins <[email-masked]>
Date: 02 Nov 2002 21:57:47 -0500

Lawrence Greenfield <[email-masked]> writes:

>    From: Derek Atkins <[email-masked]>
>    Date: 01 Nov 2002 19:36:58 -0500
> 
> Since SASL doesn't create any on-the-wire costs and very minor
> documentation costs, it seems silly to me to shy away from SASL. It
> would be somewhat helpful if you could elaborate on the problems.
> 
> If the existing GSSAPI SASL mechanism isn't appropriate (you want a
> Kerberos but not GSS method?) then you can always define a new SASL
> mechanism...

GSSAPI does not provide for Initial Authentication.  We are trying to
accomodate Initial Authentication (both AS_REQ/AS_REP and
TGS_REQ/TGS_REP) within the EAP method.

The particular usage case is when a client is connecting to the
network for the first time.  They do not have tickets, but cannot
reach a KDC to acquire them (because they are not on the network yet).
We've devised an EAP method that will deal with this situation (and
also result in tickets on the client).

I've asked about generalizing the protocol, but there are specific
features of Kerberos (as opposed to other GSSAPI mechanisms) that are
desired, in particular cachable credentials and the lack of public-key
operations.

> Larry

-derek

---

From: Simon Josefsson <[email-masked]>
Date: Sun, 03 Nov 2002 20:33:38 +0100

> TGS_REQ/TGS_REP) within the EAP method.

That sounds similar to what I have been trying to achieve with a SASL
method:

http://josefsson.org/draft-josefsson-sasl-kerberos5.txt

It has not been submitted as the implementation is not finished.

---

From: Lawrence Greenfield <[email-masked]>
Date: Sat, 2 Nov 2002 21:09:51 -0500

<[email-masked]>
Sender: [email-masked]

Larry