Subject: RE: [SECMECH] Desire to standardize some specific EAP mechanisms

From: "Salowey, Joe" <[email-masked]>
Date: Thu, 14 Jul 2005 22:09:01 -0700

I think this could be a reasonable approach, although I would like to
see the work of standardizing specific mechanisms and work to generalize
methods start in parallel.  

As far as mechanisms go I think it is relatively important to get a
revision of EAP-TLS into the standards track.  Through the use of TLS
you can cover X.509 and pre-shared key credentials.  I think there is
also  interest in the EAP community to standardize additional pre-shared
key mechanisms (EAP-PSK, EAP-PAX)  and tunneled methods (PEAP, TTLS,
EAP-FAST).  

Joe

_______________________________________________
SECMECH mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/secmech

---

From: "Tschofenig, Hannes" <[email-masked]>
Date: Fri, 15 Jul 2005 09:32:23 +0200

hi sam, 

it seems that you already have some eap methods in mind that you would like to standardize. 
can you tell us more? 

ciao
hannes

> -----Ursprüngliche Nachricht-----
> Von: [email-masked] 
> [mailto:[email-masked]] Im Auftrag von Sam Hartman
> Gesendet: Donnerstag, 14. Juli 2005 22:37
> An: [email-masked]
> Betreff: [SECMECH] Desire to standardize some specific EAP mechanisms 
> 
> 
> 
> 
> Comments from the EAP chairs and the IESG suggest there is a strong
> desire to standardize some specific EAP mechanisms probably before the
> GUAM work is done.
> 
> I think this might be doable particularly if the EAP mechanisms
> standardized are things like eap-tls where there are already
> alternatives for other frameworks.  The issue is simply one of timing.
> 
> The original proposal was to do that work in the EAP working group and
> to (depending on BOF results) spin up secmech to do the more general
> work.
> 
> I'm uncomfortable with that work being done outside the security area.
> I'm also uncomfortable with two ongoing parallel efforts without
> strong coordination.
> 
> I propose that if we want to take that approach we standardize the
> specific mechanisms in the secmech group along with doing the more
> general work.  For timing reasons we might even need to prioritize
> some of the EAP work.  I think there are many advantages to doing so:
> 
> 1) We become more familiar with the requirements of EAP and 
> the same group of people doing general work get specific 
> practical experience.
> 
> 2) Since the same group of people are doing both the general and
>    specific work you are likely to get better sanity checking across
>    the projects.
> 
> 3) You make sure the efforts don't diverge.
> 
> 4) You leverage security review experience from the GSS and SASL
>    comnunities and practical deployment experience from the 
> EAP community.
> 
> If we take that approach, two things need to happen.  First, we need
> to get a specific set of mechanisms to standardize early into the
> charter.  Second, we would need at least one int-area chair--possibly
> one of the existing EAP chairs if willing to serve--by the time a WG
> is chartered.
> 
> Thanks for your consideration,
> 
> --Sam
> 
>