tech-invite   World Map     

3GPP     Specs     Glossaries     Architecture     IMS     UICC       IETF     RFCs     Groups     SIP     ABNFs       Search

RFC 3748

 
 
 

Extensible Authentication Protocol (EAP)

Part 2 of 3, p. 15 to 41
Prev RFC Part       Next RFC Part

 


prevText      Top      Up      ToC       Page 15 
3.  Lower Layer Behavior

3.1.  Lower Layer Requirements

   EAP makes the following assumptions about lower layers:

   [1] Unreliable transport.  In EAP, the authenticator retransmits
       Requests that have not yet received Responses so that EAP does
       not assume that lower layers are reliable.  Since EAP defines its
       own retransmission behavior, it is possible (though undesirable)
       for retransmission to occur both in the lower layer and the EAP
       layer when EAP is run over a reliable lower layer.

Top      Up      ToC       Page 16 
   Note that EAP Success and Failure packets are not retransmitted.
   Without a reliable lower layer, and with a non-negligible error rate,
   these packets can be lost, resulting in timeouts.  It is therefore
   desirable for implementations to improve their resilience to loss of
   EAP Success or Failure packets, as described in Section 4.2.

   [2] Lower layer error detection.  While EAP does not assume that the
       lower layer is reliable, it does rely on lower layer error
       detection (e.g., CRC, Checksum, MIC, etc.).  EAP methods may not
       include a MIC, or if they do, it may not be computed over all the
       fields in the EAP packet, such as the Code, Identifier, Length,
       or Type fields.  As a result, without lower layer error
       detection, undetected errors could creep into the EAP layer or
       EAP method layer header fields, resulting in authentication
       failures.

       For example, EAP TLS [RFC2716], which computes its MIC over the
       Type-Data field only, regards MIC validation failures as a fatal
       error.  Without lower layer error detection, this method, and
       others like it, will not perform reliably.

   [3] Lower layer security.  EAP does not require lower layers to
       provide security services such as per-packet confidentiality,
       authentication, integrity, and replay protection.  However, where
       these security services are available, EAP methods supporting Key
       Derivation (see Section 7.2.1) can be used to provide dynamic
       keying material.  This makes it possible to bind the EAP
       authentication to subsequent data and protect against data
       modification, spoofing, or replay.  See Section 7.1 for details.

   [4] Minimum MTU.  EAP is capable of functioning on lower layers that
       provide an EAP MTU size of 1020 octets or greater.

       EAP does not support path MTU discovery, and fragmentation and
       reassembly is not supported by EAP, nor by the methods defined in
       this specification: Identity (1), Notification (2), Nak Response
       (3), MD5-Challenge (4), One Time Password (5), Generic Token Card
       (6), and expanded Nak Response (254) Types.

       Typically, the EAP peer obtains information on the EAP MTU from
       the lower layers and sets the EAP frame size to an appropriate
       value.  Where the authenticator operates in pass-through mode,
       the authentication server does not have a direct way of
       determining the EAP MTU, and therefore relies on the
       authenticator to provide it with this information, such as via
       the Framed-MTU attribute, as described in [RFC3579], Section 2.4.

Top      Up      ToC       Page 17 
       While methods such as EAP-TLS [RFC2716] support fragmentation and
       reassembly, EAP methods originally designed for use within PPP
       where a 1500 octet MTU is guaranteed for control frames (see
       [RFC1661], Section 6.1) may lack fragmentation and reassembly
       features.

       EAP methods can assume a minimum EAP MTU of 1020 octets in the
       absence of other information.  EAP methods SHOULD include support
       for fragmentation and reassembly if their payloads can be larger
       than this minimum EAP MTU.

       EAP is a lock-step protocol, which implies a certain inefficiency
       when handling fragmentation and reassembly.  Therefore, if the
       lower layer supports fragmentation and reassembly (such as where
       EAP is transported over IP), it may be preferable for
       fragmentation and reassembly to occur in the lower layer rather
       than in EAP.  This can be accomplished by providing an
       artificially large EAP MTU to EAP, causing fragmentation and
       reassembly to be handled within the lower layer.

   [5] Possible duplication.  Where the lower layer is reliable, it will
       provide the EAP layer with a non-duplicated stream of packets.
       However,  while it is desirable that lower layers provide for
       non-duplication, this is not a requirement.  The Identifier field
       provides both the peer and authenticator with the ability to
       detect duplicates.

   [6] Ordering guarantees.  EAP does not require the Identifier to be
       monotonically increasing, and so is reliant on lower layer
       ordering guarantees for correct operation.  EAP was originally
       defined to run on PPP, and [RFC1661] Section 1 has an ordering
       requirement:

           "The Point-to-Point Protocol is designed for simple links
           which transport packets between two peers.  These links
           provide full-duplex simultaneous bi-directional operation,
           and are assumed to deliver packets in order."

       Lower layer transports for EAP MUST preserve ordering between a
       source and destination at a given priority level (the ordering
       guarantee provided by [IEEE-802]).

       Reordering, if it occurs, will typically result in an EAP
       authentication failure, causing EAP authentication to be re-run.
       In an environment in which reordering is likely, it is therefore
       expected that EAP authentication failures will be common.  It is
       RECOMMENDED that EAP only be run over lower layers that provide
       ordering guarantees; running EAP over raw IP or UDP transport is

Top      Up      ToC       Page 18 
       NOT RECOMMENDED.  Encapsulation of EAP within RADIUS [RFC3579]
       satisfies ordering requirements, since RADIUS is a "lockstep"
       protocol that delivers packets in order.

3.2.  EAP Usage Within PPP

   In order to establish communications over a point-to-point link, each
   end of the PPP link first sends LCP packets to configure the data
   link during the Link Establishment phase.  After the link has been
   established, PPP provides for an optional Authentication phase before
   proceeding to the Network-Layer Protocol phase.

   By default, authentication is not mandatory.  If authentication of
   the link is desired, an implementation MUST specify the
   Authentication Protocol Configuration Option during the Link
   Establishment phase.

   If the identity of the peer has been established in the
   Authentication phase, the server can use that identity in the
   selection of options for the following network layer negotiations.

   When implemented within PPP, EAP does not select a specific
   authentication mechanism at the PPP Link Control Phase, but rather
   postpones this until the Authentication Phase.  This allows the
   authenticator to request more information before determining the
   specific authentication mechanism.  This also permits the use of a
   "backend" server which actually implements the various mechanisms
   while the PPP authenticator merely passes through the authentication
   exchange.  The PPP Link Establishment and Authentication phases, and
   the Authentication Protocol Configuration Option, are defined in The
   Point-to-Point Protocol (PPP) [RFC1661].

3.2.1.  PPP Configuration Option Format

   A summary of the PPP Authentication Protocol Configuration Option
   format to negotiate EAP follows.  The fields are transmitted from
   left to right.

   Exactly one EAP packet is encapsulated in the Information field of a
   PPP Data Link Layer frame where the protocol field indicates type hex
   C227 (PPP EAP).

Top      Up      ToC       Page 19 
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |     Authentication Protocol   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type

      3

   Length

      4

   Authentication Protocol

      C227 (Hex) for Extensible Authentication Protocol (EAP)

3.3.  EAP Usage Within IEEE 802

   The encapsulation of EAP over IEEE 802 is defined in [IEEE-802.1X].
   The IEEE 802 encapsulation of EAP does not involve PPP, and IEEE
   802.1X does not include support for link or network layer
   negotiations.  As a result, within IEEE 802.1X, it is not possible to
   negotiate non-EAP authentication mechanisms, such as PAP or CHAP
   [RFC1994].

3.4.  Lower Layer Indications

   The reliability and security of lower layer indications is dependent
   on the lower layer.  Since EAP is media independent, the presence or
   absence of lower layer security is not taken into account in the
   processing of EAP messages.

   To improve reliability, if a peer receives a lower layer success
   indication as defined in Section 7.2, it MAY conclude that a Success
   packet has been lost, and behave as if it had actually received a
   Success packet.  This includes choosing to ignore the Success in some
   circumstances as described in Section 4.2.

   A discussion of some reliability and security issues with lower layer
   indications in PPP, IEEE 802 wired networks, and IEEE 802.11 wireless
   LANs can be found in the Security Considerations, Section 7.12.

   After EAP authentication is complete, the peer will typically
   transmit and receive data via the authenticator.  It is desirable to
   provide assurance that the entities transmitting data are the same
   ones that successfully completed EAP authentication.  To accomplish

Top      Up      ToC       Page 20 
   this, it is necessary for the lower layer to provide per-packet
   integrity, authentication and replay protection, and to bind these
   per-packet services to the keys derived during EAP authentication.
   Otherwise, it is possible for subsequent data traffic to be modified,
   spoofed, or replayed.

   Where keying material for the lower layer ciphersuite is itself
   provided by EAP, ciphersuite negotiation and key activation are
   controlled by the lower layer.  In PPP, ciphersuites are negotiated
   within ECP so that it is not possible to use keys derived from EAP
   authentication until the completion of ECP.  Therefore, an initial
   EAP exchange cannot be protected by a PPP ciphersuite, although EAP
   re-authentication can be protected.

   In IEEE 802 media, initial key activation also typically occurs after
   completion of EAP authentication.  Therefore an initial EAP exchange
   typically cannot be protected by the lower layer ciphersuite,
   although an EAP re-authentication or pre-authentication exchange can
   be protected.

4.  EAP Packet Format

   A summary of the EAP packet format is shown below.  The fields are
   transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    Data ...
   +-+-+-+-+

   Code

      The Code field is one octet and identifies the Type of EAP packet.
      EAP Codes are assigned as follows:

         1       Request
         2       Response
         3       Success
         4       Failure

      Since EAP only defines Codes 1-4, EAP packets with other codes
      MUST be silently discarded by both authenticators and peers.

Top      Up      ToC       Page 21 
   Identifier

      The Identifier field is one octet and aids in matching Responses
      with Requests.

   Length

      The Length field is two octets and indicates the length, in
      octets, of the EAP packet including the Code, Identifier, Length,
      and Data fields.  Octets outside the range of the Length field
      should be treated as Data Link Layer padding and MUST be ignored
      upon reception.  A message with the Length field set to a value
      larger than the number of received octets MUST be silently
      discarded.

   Data

      The Data field is zero or more octets.  The format of the Data
      field is determined by the Code field.

4.1.  Request and Response

   Description

      The Request packet (Code field set to 1) is sent by the
      authenticator to the peer.  Each Request has a Type field which
      serves to indicate what is being requested.  Additional Request
      packets MUST be sent until a valid Response packet is received, an
      optional retry counter expires, or a lower layer failure
      indication is received.

      Retransmitted Requests MUST be sent with the same Identifier value
      in order to distinguish them from new Requests.  The content of
      the data field is dependent on the Request Type.  The peer MUST
      send a Response packet in reply to a valid Request packet.
      Responses MUST only be sent in reply to a valid Request and never
      be retransmitted on a timer.

      If a peer receives a valid duplicate Request for which it has
      already sent a Response, it MUST resend its original Response
      without reprocessing the Request.  Requests MUST be processed in
      the order that they are received, and MUST be processed to their
      completion before inspecting the next Request.

   A summary of the Request and Response packet format follows.  The
   fields are transmitted from left to right.

Top      Up      ToC       Page 22 
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |  Type-Data ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

   Code

      1 for Request
      2 for Response

   Identifier

      The Identifier field is one octet.  The Identifier field MUST be
      the same if a Request packet is retransmitted due to a timeout
      while waiting for a Response.  Any new (non-retransmission)
      Requests MUST modify the Identifier field.

      The Identifier field of the Response MUST match that of the
      currently outstanding Request.  An authenticator receiving a
      Response whose Identifier value does not match that of the
      currently outstanding Request MUST silently discard the Response.

      In order to avoid confusion between new Requests and
      retransmissions, the Identifier value chosen for each new Request
      need only be different from the previous Request, but need not be
      unique within the conversation.  One way to achieve this is to
      start the Identifier at an initial value and increment it for each
      new Request.  Initializing the first Identifier with a random
      number rather than starting from zero is recommended, since it
      makes sequence attacks somewhat more difficult.

      Since the Identifier space is unique to each session,
      authenticators are not restricted to only 256 simultaneous
      authentication conversations.  Similarly, with re-authentication,
      an EAP conversation might continue over a long period of time, and
      is not limited to only 256 roundtrips.

   Implementation Note: The authenticator is responsible for
   retransmitting Request messages.  If the Request message is obtained
   from elsewhere (such as from a backend authentication server), then
   the authenticator will need to save a copy of the Request in order to
   accomplish this.  The peer is responsible for detecting and handling
   duplicate Request messages before processing them in any way,
   including passing them on to an outside party.  The authenticator is
   also responsible for discarding Response messages with a non-matching

Top      Up      ToC       Page 23 
   Identifier value before acting on them in any way, including passing
   them on to the backend authentication server for verification.  Since
   the authenticator can retransmit before receiving a Response from the
   peer, the authenticator can receive multiple Responses, each with a
   matching Identifier.  Until a new Request is received by the
   authenticator, the Identifier value is not updated, so that the
   authenticator forwards Responses to the backend authentication
   server, one at a time.

   Length

      The Length field is two octets and indicates the length of the EAP
      packet including the Code, Identifier, Length, Type, and Type-Data
      fields.  Octets outside the range of the Length field should be
      treated as Data Link Layer padding and MUST be ignored upon
      reception.  A message with the Length field set to a value larger
      than the number of received octets MUST be silently discarded.

   Type

      The Type field is one octet.  This field indicates the Type of
      Request or Response.  A single Type MUST be specified for each EAP
      Request or Response.  An initial specification of Types follows in
      Section 5 of this document.

      The Type field of a Response MUST either match that of the
      Request, or correspond to a legacy or Expanded Nak (see Section
      5.3) indicating that a Request Type is unacceptable to the peer.
      A peer MUST NOT send a Nak (legacy or expanded) in response to a
      Request, after an initial non-Nak Response has been sent.  An EAP
      server receiving a Response not meeting these requirements MUST
      silently discard it.

   Type-Data

      The Type-Data field varies with the Type of Request and the
      associated Response.

4.2.  Success and Failure

   The Success packet is sent by the authenticator to the peer after
   completion of an EAP authentication method (Type 4 or greater) to
   indicate that the peer has authenticated successfully to the
   authenticator.  The authenticator MUST transmit an EAP packet with
   the Code field set to 3 (Success).  If the authenticator cannot
   authenticate the peer (unacceptable Responses to one or more
   Requests), then after unsuccessful completion of the EAP method in
   progress, the implementation MUST transmit an EAP packet with the

Top      Up      ToC       Page 24 
   Code field set to 4 (Failure).  An authenticator MAY wish to issue
   multiple Requests before sending a Failure response in order to allow
   for human typing mistakes.  Success and Failure packets MUST NOT
   contain additional data.

   Success and Failure packets MUST NOT be sent by an EAP authenticator
   if the specification of the given method does not explicitly permit
   the method to finish at that point.  A peer EAP implementation
   receiving a Success or Failure packet where sending one is not
   explicitly permitted MUST silently discard it.  By default, an EAP
   peer MUST silently discard a "canned" Success packet (a Success
   packet sent immediately upon connection).  This ensures that a rogue
   authenticator will not be able to bypass mutual authentication by
   sending a Success packet prior to conclusion of the EAP method
   conversation.

   Implementation Note: Because the Success and Failure packets are not
   acknowledged, they are not retransmitted by the authenticator, and
   may be potentially lost.  A peer MUST allow for this circumstance as
   described in this note.  See also Section 3.4 for guidance on the
   processing of lower layer success and failure indications.

   As described in Section 2.1, only a single EAP authentication method
   is allowed within an EAP conversation.  EAP methods may implement
   result indications.  After the authenticator sends a failure result
   indication to the peer, regardless of the response from the peer, it
   MUST subsequently send a Failure packet.  After the authenticator
   sends a success result indication to the peer and receives a success
   result indication from the peer, it MUST subsequently send a Success
   packet.

   On the peer, once the method completes unsuccessfully (that is,
   either the authenticator sends a failure result indication, or the
   peer decides that it does not want to continue the conversation,
   possibly after sending a failure result indication), the peer MUST
   terminate the conversation and indicate failure to the lower layer.
   The peer MUST silently discard Success packets and MAY silently
   discard Failure packets.  As a result, loss of a Failure packet need
   not result in a timeout.

   On the peer, after success result indications have been exchanged by
   both sides, a Failure packet MUST be silently discarded.  The peer
   MAY, in the event that an EAP Success is not received, conclude that
   the EAP Success packet was lost and that authentication concluded
   successfully.

Top      Up      ToC       Page 25 
   If the authenticator has not sent a result indication, and the peer
   is willing to continue the conversation, the peer waits for a Success
   or Failure packet once the method completes, and MUST NOT silently
   discard either of them.  In the event that neither a Success nor
   Failure packet is received, the peer SHOULD terminate the
   conversation to avoid lengthy timeouts in case the lost packet was an
   EAP Failure.

   If the peer attempts to authenticate to the authenticator and fails
   to do so, the authenticator MUST send a Failure packet and MUST NOT
   grant access by sending a Success packet.  However, an authenticator
   MAY omit having the peer authenticate to it in situations where
   limited access is offered (e.g., guest access).  In this case, the
   authenticator MUST send a Success packet.

   Where the peer authenticates successfully to the authenticator, but
   the authenticator does not send a result indication, the
   authenticator MAY deny access by sending a Failure packet where the
   peer is not currently authorized for network access.

   A summary of the Success and Failure packet format is shown below.
   The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Code

      3 for Success
      4 for Failure

   Identifier

      The Identifier field is one octet and aids in matching replies to
      Responses.  The Identifier field MUST match the Identifier field
      of the Response packet that it is sent in response to.

   Length

      4

Top      Up      ToC       Page 26 
4.3.  Retransmission Behavior

   Because the authentication process will often involve user input,
   some care must be taken when deciding upon retransmission strategies
   and authentication timeouts.  By default, where EAP is run over an
   unreliable lower layer, the EAP retransmission timer SHOULD be
   dynamically estimated.  A maximum of 3-5 retransmissions is
   suggested.

   When run over a reliable lower layer (e.g., EAP over ISAKMP/TCP, as
   within [PIC]), the authenticator retransmission timer SHOULD be set
   to an infinite value, so that retransmissions do not occur at the EAP
   layer.  The peer may still maintain a timeout value so as to avoid
   waiting indefinitely for a Request.

   Where the authentication process requires user input, the measured
   round trip times may be determined by user responsiveness rather than
   network characteristics, so that dynamic RTO estimation may not be
   helpful.  Instead, the retransmission timer SHOULD be set so as to
   provide sufficient time for the user to respond, with longer timeouts
   required in certain cases, such as where Token Cards (see Section
   5.6) are involved.

   In order to provide the EAP authenticator with guidance as to the
   appropriate timeout value, a hint can be communicated to the
   authenticator by the backend authentication server (such as via the
   RADIUS Session-Timeout attribute).

   In order to dynamically estimate the EAP retransmission timer, the
   algorithms for the estimation of SRTT, RTTVAR, and RTO described in
   [RFC2988] are RECOMMENDED, including use of Karn's algorithm, with
   the following potential modifications:

   [a] In order to avoid synchronization behaviors that can occur with
       fixed timers among distributed systems, the retransmission timer
       is calculated with a jitter by using the RTO value and randomly
       adding a value drawn between -RTOmin/2 and RTOmin/2.  Alternative
       calculations to create jitter MAY be used.  These MUST be
       pseudo-random.  For a discussion of pseudo-random number
       generation, see [RFC1750].

   [b] When EAP is transported over a single link (as opposed to over
       the Internet), smaller values of RTOinitial, RTOmin, and RTOmax
       MAY be used.  Recommended values are RTOinitial=1 second,
       RTOmin=200ms, and RTOmax=20 seconds.

Top      Up      ToC       Page 27 
   [c] When EAP is transported over a single link (as opposed to over
       the Internet), estimates MAY be done on a per-authenticator
       basis, rather than a per-session basis.  This enables the
       retransmission estimate to make the most use of information on
       link-layer behavior.

   [d] An EAP implementation MAY clear SRTT and RTTVAR after backing off
       the timer multiple times, as it is likely that the current SRTT
       and RTTVAR are bogus in this situation.  Once SRTT and RTTVAR are
       cleared, they should be initialized with the next RTT sample
       taken as described in [RFC2988] equation 2.2.

5.  Initial EAP Request/Response Types

   This section defines the initial set of EAP Types used in Request/
   Response exchanges.  More Types may be defined in future documents.
   The Type field is one octet and identifies the structure of an EAP
   Request or Response packet.  The first 3 Types are considered special
   case Types.

   The remaining Types define authentication exchanges.  Nak (Type 3) or
   Expanded Nak (Type 254) are valid only for Response packets, they
   MUST NOT be sent in a Request.

   All EAP implementations MUST support Types 1-4, which are defined in
   this document, and SHOULD support Type 254.  Implementations MAY
   support other Types defined here or in future RFCs.

             1       Identity
             2       Notification
             3       Nak (Response only)
             4       MD5-Challenge
             5       One Time Password (OTP)
             6       Generic Token Card (GTC)
           254       Expanded Types
           255       Experimental use

   EAP methods MAY support authentication based on shared secrets.  If
   the shared secret is a passphrase entered by the user,
   implementations MAY support entering passphrases with non-ASCII
   characters.  In this case, the input should be processed using an
   appropriate stringprep [RFC3454] profile, and encoded in octets using
   UTF-8 encoding [RFC2279].  A preliminary version of a possible
   stringprep profile is described in [SASLPREP].

Top      Up      ToC       Page 28 
5.1.  Identity

   Description

      The Identity Type is used to query the identity of the peer.
      Generally, the authenticator will issue this as the initial
      Request.  An optional displayable message MAY be included to
      prompt the peer in the case where there is an expectation of
      interaction with a user.  A Response of Type 1 (Identity) SHOULD
      be sent in Response to a Request with a Type of 1 (Identity).

      Some EAP implementations piggy-back various options into the
      Identity Request after a NUL-character.  By default, an EAP
      implementation SHOULD NOT assume that an Identity Request or
      Response can be larger than 1020 octets.

      It is RECOMMENDED that the Identity Response be used primarily for
      routing purposes and selecting which EAP method to use.  EAP
      Methods SHOULD include a method-specific mechanism for obtaining
      the identity, so that they do not have to rely on the Identity
      Response.  Identity Requests and Responses are sent in cleartext,
      so an attacker may snoop on the identity, or even modify or spoof
      identity exchanges.  To address these threats, it is preferable
      for an EAP method to include an identity exchange that supports
      per-packet authentication, integrity and replay protection, and
      confidentiality.  The Identity Response may not be the appropriate
      identity for the method; it may have been truncated or obfuscated
      so as to provide privacy, or it may have been decorated for
      routing purposes.  Where the peer is configured to only accept
      authentication methods supporting protected identity exchanges,
      the peer MAY provide an abbreviated Identity Response (such as
      omitting the peer-name portion of the NAI [RFC2486]).  For further
      discussion of identity protection, see Section 7.3.

   Implementation Note: The peer MAY obtain the Identity via user input.
   It is suggested that the authenticator retry the Identity Request in
   the case of an invalid Identity or authentication failure to allow
   for potential typos on the part of the user.  It is suggested that
   the Identity Request be retried a minimum of 3 times before
   terminating the authentication.  The Notification Request MAY be used
   to indicate an invalid authentication attempt prior to transmitting a
   new Identity Request (optionally, the failure MAY be indicated within
   the message of the new Identity Request itself).

Top      Up      ToC       Page 29 
   Type

      1

   Type-Data

      This field MAY contain a displayable message in the Request,
      containing UTF-8 encoded ISO 10646 characters [RFC2279].  Where
      the Request contains a null, only the portion of the field prior
      to the null is displayed.  If the Identity is unknown, the
      Identity Response field should be zero bytes in length.  The
      Identity Response field MUST NOT be null terminated.  In all
      cases, the length of the Type-Data field is derived from the
      Length field of the Request/Response packet.

   Security Claims (see Section 7.2):

      Auth. mechanism:           None
      Ciphersuite negotiation:   No
      Mutual authentication:     No
      Integrity protection:      No
      Replay protection:         No
      Confidentiality:           No
      Key derivation:            No
      Key strength:              N/A
      Dictionary attack prot.:   N/A
      Fast reconnect:            No
      Crypt. binding:            N/A
      Session independence:      N/A
      Fragmentation:             No
      Channel binding:           No

5.2.  Notification

   Description

      The Notification Type is optionally used to convey a displayable
      message from the authenticator to the peer.  An authenticator MAY
      send a Notification Request to the peer at any time when there is
      no outstanding Request, prior to completion of an EAP
      authentication method.  The peer MUST respond to a Notification
      Request with a Notification Response unless the EAP authentication
      method specification prohibits the use of Notification messages.
      In any case, a Nak Response MUST NOT be sent in response to a
      Notification Request.  Note that the default maximum length of a
      Notification Request is 1020 octets.  By default, this leaves at
      most 1015 octets for the human readable message.

Top      Up      ToC       Page 30 
      An EAP method MAY indicate within its specification that
      Notification messages must not be sent during that method.  In
      this case, the peer MUST silently discard Notification Requests
      from the point where an initial Request for that Type is answered
      with a Response of the same Type.

      The peer SHOULD display this message to the user or log it if it
      cannot be displayed.  The Notification Type is intended to provide
      an acknowledged notification of some imperative nature, but it is
      not an error indication, and therefore does not change the state
      of the peer.  Examples include a password with an expiration time
      that is about to expire, an OTP sequence integer which is nearing
      0, an authentication failure warning, etc.  In most circumstances,
      Notification should not be required.

   Type

      2

   Type-Data

      The Type-Data field in the Request contains a displayable message
      greater than zero octets in length, containing UTF-8 encoded ISO
      10646 characters [RFC2279].  The length of the message is
      determined by the Length field of the Request packet.  The message
      MUST NOT be null terminated.  A Response MUST be sent in reply to
      the Request with a Type field of 2 (Notification).  The Type-Data
      field of the Response is zero octets in length.  The Response
      should be sent immediately (independent of how the message is
      displayed or logged).

   Security Claims (see Section 7.2):

      Auth. mechanism:           None
      Ciphersuite negotiation:   No
      Mutual authentication:     No
      Integrity protection:      No
      Replay protection:         No
      Confidentiality:           No
      Key derivation:            No
      Key strength:              N/A
      Dictionary attack prot.:   N/A
      Fast reconnect:            No
      Crypt. binding:            N/A
      Session independence:      N/A
      Fragmentation:             No
      Channel binding:           No

Top      Up      ToC       Page 31 
5.3.  Nak

5.3.1.  Legacy Nak

   Description

      The legacy Nak Type is valid only in Response messages.  It is
      sent in reply to a Request where the desired authentication Type
      is unacceptable.  Authentication Types are numbered 4 and above.
      The Response contains one or more authentication Types desired by
      the Peer.  Type zero (0) is used to indicate that the sender has
      no viable alternatives, and therefore the authenticator SHOULD NOT
      send another Request after receiving a Nak Response containing a
      zero value.

      Since the legacy Nak Type is valid only in Responses and has very
      limited functionality, it MUST NOT be used as a general purpose
      error indication, such as for communication of error messages, or
      negotiation of parameters specific to a particular EAP method.

   Code

      2 for Response.

   Identifier

      The Identifier field is one octet and aids in matching Responses
      with Requests.  The Identifier field of a legacy Nak Response MUST
      match the Identifier field of the Request packet that it is sent
      in response to.

   Length

      >=6

   Type

      3

   Type-Data

      Where a peer receives a Request for an unacceptable authentication
      Type (4-253,255), or a peer lacking support for Expanded Types
      receives a Request for Type 254, a Nak Response (Type 3) MUST be
      sent.  The Type-Data field of the Nak Response (Type 3) MUST
      contain one or more octets indicating the desired authentication
      Type(s), one octet per Type, or the value zero (0) to indicate no
      proposed alternative.  A peer supporting Expanded Types that

Top      Up      ToC       Page 32 
      receives a Request for an unacceptable authentication Type (4-253,
      255) MAY include the value 254 in the Nak Response (Type 3) to
      indicate the desire for an Expanded authentication Type. If the
      authenticator can accommodate this preference, it will respond
      with an Expanded Type Request (Type 254).

   Security Claims (see Section 7.2):

      Auth. mechanism:           None
      Ciphersuite negotiation:   No
      Mutual authentication:     No
      Integrity protection:      No
      Replay protection:         No
      Confidentiality:           No
      Key derivation:            No
      Key strength:              N/A
      Dictionary attack prot.:   N/A
      Fast reconnect:            No
      Crypt. binding:            N/A
      Session independence:      N/A
      Fragmentation:             No
      Channel binding:           No


5.3.2.  Expanded Nak

   Description

      The Expanded Nak Type is valid only in Response messages.  It MUST
      be sent only in reply to a Request of Type 254 (Expanded Type)
      where the authentication Type is unacceptable.  The Expanded Nak
      Type uses the Expanded Type format itself, and the Response
      contains one or more authentication Types desired by the peer, all
      in Expanded Type format.  Type zero (0) is used to indicate that
      the sender has no viable alternatives.  The general format of the
      Expanded Type is described in Section 5.7.

      Since the Expanded Nak Type is valid only in Responses and has
      very limited functionality, it MUST NOT be used as a general
      purpose error indication, such as for communication of error
      messages, or negotiation of parameters specific to a particular
      EAP method.

   Code

      2 for Response.

Top      Up      ToC       Page 33 
   Identifier

      The Identifier field is one octet and aids in matching Responses
      with Requests.  The Identifier field of an Expanded Nak Response
      MUST match the Identifier field of the Request packet that it is
      sent in response to.

   Length

      >=20

   Type

      254

   Vendor-Id

      0 (IETF)

   Vendor-Type

      3 (Nak)

   Vendor-Data

      The Expanded Nak Type is only sent when the Request contains an
      Expanded Type (254) as defined in Section 5.7.  The Vendor-Data
      field of the Nak Response MUST contain one or more authentication
      Types (4 or greater), all in expanded format, 8 octets per Type,
      or the value zero (0), also in Expanded Type format, to indicate
      no proposed alternative.  The desired authentication Types may
      include a mixture of Vendor-Specific and IETF Types.  For example,
      an Expanded Nak Response indicating a preference for OTP (Type 5),
      and an MIT (Vendor-Id=20) Expanded Type of 6 would appear as
      follows:

Top      Up      ToC       Page 34 
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     2         |  Identifier   |           Length=28           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |   Type=254    |                0 (IETF)                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                3 (Nak)                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |   Type=254    |                0 (IETF)                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                5 (OTP)                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |   Type=254    |                20 (MIT)                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                6                              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   An Expanded Nak Response indicating a no desired alternative would
   appear as follows:

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     2         |  Identifier   |           Length=20           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |   Type=254    |                0 (IETF)                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                3 (Nak)                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |   Type=254    |                0 (IETF)                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                0 (No alternative)             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Security Claims (see Section 7.2):

      Auth. mechanism:           None
      Ciphersuite negotiation:   No
      Mutual authentication:     No
      Integrity protection:      No
      Replay protection:         No
      Confidentiality:           No
      Key derivation:            No
      Key strength:              N/A
      Dictionary attack prot.:   N/A
      Fast reconnect:            No
      Crypt. binding:            N/A

Top      Up      ToC       Page 35 
      Session independence:      N/A
      Fragmentation:             No
      Channel binding:           No


5.4.  MD5-Challenge

   Description

      The MD5-Challenge Type is analogous to the PPP CHAP protocol
      [RFC1994] (with MD5 as the specified algorithm).  The Request
      contains a "challenge" message to the peer.  A Response MUST be
      sent in reply to the Request.  The Response MAY be either of Type
      4 (MD5-Challenge), Nak (Type 3), or Expanded Nak (Type 254).  The
      Nak reply indicates the peer's desired authentication Type(s).
      EAP peer and EAP server implementations MUST support the MD5-
      Challenge mechanism.  An authenticator that supports only pass-
      through MUST allow communication with a backend authentication
      server that is capable of supporting MD5-Challenge, although the
      EAP authenticator implementation need not support MD5-Challenge
      itself.  However, if the EAP authenticator can be configured to
      authenticate peers locally (e.g., not operate in pass-through),
      then the requirement for support of the MD5-Challenge mechanism
      applies.

      Note that the use of the Identifier field in the MD5-Challenge
      Type is different from that described in [RFC1994].  EAP allows
      for retransmission of MD5-Challenge Request packets, while
      [RFC1994] states that both the Identifier and Challenge fields
      MUST change each time a Challenge (the CHAP equivalent of the
      MD5-Challenge Request packet) is sent.

      Note: [RFC1994] treats the shared secret as an octet string, and
      does not specify how it is entered into the system (or if it is
      handled by the user at all).  EAP MD5-Challenge implementations
      MAY support entering passphrases with non-ASCII characters.  See
      Section 5 for instructions how the input should be processed and
      encoded into octets.

   Type

      4

   Type-Data

      The contents of the Type-Data field is summarized below.  For
      reference on the use of these fields, see the PPP Challenge
      Handshake Authentication Protocol [RFC1994].

Top      Up      ToC       Page 36 
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Value-Size   |  Value ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Name ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Security Claims (see Section 7.2):

      Auth. mechanism:           Password or pre-shared key.
      Ciphersuite negotiation:   No
      Mutual authentication:     No
      Integrity protection:      No
      Replay protection:         No
      Confidentiality:           No
      Key derivation:            No
      Key strength:              N/A
      Dictionary attack prot.:   No
      Fast reconnect:            No
      Crypt. binding:            N/A
      Session independence:      N/A
      Fragmentation:             No
      Channel binding:           No

5.5.  One-Time Password (OTP)

   Description

      The One-Time Password system is defined in "A One-Time Password
      System" [RFC2289] and "OTP Extended Responses" [RFC2243].  The
      Request contains an OTP challenge in the format described in
      [RFC2289].  A Response MUST be sent in reply to the Request.  The
      Response MUST be of Type 5 (OTP), Nak (Type 3), or Expanded Nak
      (Type 254).  The Nak Response indicates the peer's desired
      authentication Type(s).  The EAP OTP method is intended for use
      with the One-Time Password system only, and MUST NOT be used to
      provide support for cleartext passwords.

   Type

      5

Top      Up      ToC       Page 37 
   Type-Data

      The Type-Data field contains the OTP "challenge" as a displayable
      message in the Request.  In the Response, this field is used for
      the 6 words from the OTP dictionary [RFC2289].  The messages MUST
      NOT be null terminated.  The length of the field is derived from
      the Length field of the Request/Reply packet.

      Note: [RFC2289] does not specify how the secret pass-phrase is
      entered by the user, or how the pass-phrase is converted into
      octets.  EAP OTP implementations MAY support entering passphrases
      with non-ASCII characters.  See Section 5 for instructions on how
      the input should be processed and encoded into octets.

   Security Claims (see Section 7.2):

      Auth. mechanism:           One-Time Password
      Ciphersuite negotiation:   No
      Mutual authentication:     No
      Integrity protection:      No
      Replay protection:         Yes
      Confidentiality:           No
      Key derivation:            No
      Key strength:              N/A
      Dictionary attack prot.:   No
      Fast reconnect:            No
      Crypt. binding:            N/A
      Session independence:      N/A
      Fragmentation:             No
      Channel binding:           No


5.6.  Generic Token Card (GTC)

   Description

      The Generic Token Card Type is defined for use with various Token
      Card implementations which require user input.  The Request
      contains a displayable message and the Response contains the Token
      Card information necessary for authentication.  Typically, this
      would be information read by a user from the Token card device and
      entered as ASCII text.  A Response MUST be sent in reply to the
      Request.  The Response MUST be of Type 6 (GTC), Nak (Type 3), or
      Expanded Nak (Type 254).  The Nak Response indicates the peer's
      desired authentication Type(s).  The EAP GTC method is intended
      for use with the Token Cards supporting challenge/response

Top      Up      ToC       Page 38 
      authentication and MUST NOT be used to provide support for
      cleartext passwords in the absence of a protected tunnel with
      server authentication.

   Type

      6

   Type-Data

      The Type-Data field in the Request contains a displayable message
      greater than zero octets in length.  The length of the message is
      determined by the Length field of the Request packet.  The message
      MUST NOT be null terminated.  A Response MUST be sent in reply to
      the Request with a Type field of 6 (Generic Token Card).  The
      Response contains data from the Token Card required for
      authentication.  The length of the data is determined by the
      Length field of the Response packet.

      EAP GTC implementations MAY support entering a response with non-
      ASCII characters.  See Section 5 for instructions how the input
      should be processed and encoded into octets.

   Security Claims (see Section 7.2):

      Auth. mechanism:           Hardware token.
      Ciphersuite negotiation:   No
      Mutual authentication:     No
      Integrity protection:      No
      Replay protection:         No
      Confidentiality:           No
      Key derivation:            No
      Key strength:              N/A
      Dictionary attack prot.:   No
      Fast reconnect:            No
      Crypt. binding:            N/A
      Session independence:      N/A
      Fragmentation:             No
      Channel binding:           No


5.7.  Expanded Types

   Description

      Since many of the existing uses of EAP are vendor-specific, the
      Expanded method Type is available to allow vendors to support
      their own Expanded Types not suitable for general usage.

Top      Up      ToC       Page 39 
      The Expanded Type is also used to expand the global Method Type
      space beyond the original 255 values.  A Vendor-Id of 0 maps the
      original 255 possible Types onto a space of 2^32-1 possible Types.
      (Type 0 is only used in a Nak Response to indicate no acceptable
      alternative).

      An implementation that supports the Expanded attribute MUST treat
      EAP Types that are less than 256 equivalently, whether they appear
      as a single octet or as the 32-bit Vendor-Type within an Expanded
      Type where Vendor-Id is 0.  Peers not equipped to interpret the
      Expanded Type MUST send a Nak as described in Section 5.3.1, and
      negotiate a more suitable authentication method.

      A summary of the Expanded Type format is shown below.  The fields
      are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |               Vendor-Id                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          Vendor-Type                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |              Vendor data...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type

      254 for Expanded Type

   Vendor-Id

      The Vendor-Id is 3 octets and represents the SMI Network
      Management Private Enterprise Code of the Vendor in network byte
      order, as allocated by IANA.  A Vendor-Id of zero is reserved for
      use by the IETF in providing an expanded global EAP Type space.

   Vendor-Type

      The Vendor-Type field is four octets and represents the vendor-
      specific method Type.

      If the Vendor-Id is zero, the Vendor-Type field is an extension
      and superset of the existing namespace for EAP Types.  The first
      256 Types are reserved for compatibility with single-octet EAP
      Types that have already been assigned or may be assigned in the
      future.  Thus, EAP Types from 0 through 255 are semantically
      identical, whether they appear as single octet EAP Types or as

Top      Up      ToC       Page 40 
      Vendor-Types when Vendor-Id is zero.  There is one exception to
      this rule: Expanded Nak and Legacy Nak packets share the same
      Type, but must be treated differently because they have a
      different format.

   Vendor-Data

      The Vendor-Data field is defined by the vendor.  Where a Vendor-Id
      of zero is present, the Vendor-Data field will be used for
      transporting the contents of EAP methods of Types defined by the
      IETF.

5.8.  Experimental

   Description

      The Experimental Type has no fixed format or content.  It is
      intended for use when experimenting with new EAP Types.  This Type
      is intended for experimental and testing purposes.  No guarantee
      is made for interoperability between peers using this Type, as
      outlined in [RFC3692].

   Type

      255

   Type-Data

      Undefined

6.  IANA Considerations

   This section provides guidance to the Internet Assigned Numbers
   Authority (IANA) regarding registration of values related to the EAP
   protocol, in accordance with BCP 26, [RFC2434].

   There are two name spaces in EAP that require registration: Packet
   Codes and method Types.

   EAP is not intended as a general-purpose protocol, and allocations
   SHOULD NOT be made for purposes unrelated to authentication.

   The following terms are used here with the meanings defined in BCP
   26: "name space", "assigned value", "registration".

   The following policies are used here with the meanings defined in BCP
   26: "Private Use", "First Come First Served", "Expert Review",
   "Specification Required", "IETF Consensus", "Standards Action".

Top      Up      ToC       Page 41 
   For registration requests where a Designated Expert should be
   consulted, the responsible IESG area director should appoint the
   Designated Expert.  The intention is that any allocation will be
   accompanied by a published RFC.  But in order to allow for the
   allocation of values prior to the RFC being approved for publication,
   the Designated Expert can approve allocations once it seems clear
   that an RFC will be published.  The Designated expert will post a
   request to the EAP WG mailing list (or a successor designated by the
   Area Director) for comment and review, including an Internet-Draft.
   Before a period of 30 days has passed, the Designated Expert will
   either approve or deny the registration request and publish a notice
   of the decision to the EAP WG mailing list or its successor, as well
   as informing IANA.  A denial notice must be justified by an
   explanation, and in the cases where it is possible, concrete
   suggestions on how the request can be modified so as to become
   acceptable should be provided.

6.1.  Packet Codes

   Packet Codes have a range from 1 to 255, of which 1-4 have been
   allocated.  Because a new Packet Code has considerable impact on
   interoperability, a new Packet Code requires Standards Action, and
   should be allocated starting at 5.

6.2.  Method Types

   The original EAP method Type space has a range from 1 to 255, and is
   the scarcest resource in EAP, and thus must be allocated with care.
   Method Types 1-45 have been allocated, with 20 available for re-use.
   Method Types 20 and 46-191 may be allocated on the advice of a
   Designated Expert, with Specification Required.

   Allocation of blocks of method Types (more than one for a given
   purpose) should require IETF Consensus.  EAP Type Values 192-253 are
   reserved and allocation requires Standards Action.

   Method Type 254 is allocated for the Expanded Type.  Where the
   Vendor-Id field is non-zero, the Expanded Type is used for functions
   specific only to one vendor's implementation of EAP, where no
   interoperability is deemed useful.  When used with a Vendor-Id of
   zero, method Type 254 can also be used to provide for an expanded
   IETF method Type space.  Method Type values 256-4294967295 may be
   allocated after Type values 1-191 have been allocated, on the advice
   of a Designated Expert, with Specification Required.

   Method Type 255 is allocated for Experimental use, such as testing of
   new EAP methods before a permanent Type is allocated.


Next RFC Part