Browse Prior Art Database

Extensible Authentication Protocol Tunneled Transport Layer Security Authenticated Protocol Version 0 (EAP-TTLSv0) (RFC5281)

IP.com Disclosure Number: IPCOM000173609D
Original Publication Date: 2008-Aug-01
Included in the Prior Art Database: 2008-Aug-16

Publishing Venue

Internet Society Requests For Comment (RFCs)

Related People

P. Funk: AUTHOR [+2]

Abstract

EAP-TTLS is an EAP (Extensible Authentication Protocol) method that encapsulates a TLS (Transport Layer Security) session, consisting of a handshake phase and a data phase. During the handshake phase, the server is authenticated to the client (or client and server are mutually authenticated) using standard TLS procedures, and keying material is generated in order to create a cryptographically secure tunnel for information exchange in the subsequent data phase. During the data phase, the client is authenticated to the server (or client and server are mutually authenticated) using an arbitrary authentication mechanism encapsulated within the secure tunnel. The encapsulated authentication mechanism may itself be EAP, or it may be another authentication protocol such as PAP, CHAP, MS-CHAP, or MS- CHAP-V2. Thus, EAP-TTLS allows legacy password-based authentication protocols to be used against existing authentication databases, while protecting the security of these legacy protocols against eavesdropping, man-in-the-middle, and other attacks. The data phase may also be used for additional, arbitrary data exchange.

This text was extracted from an ASCII text file.
This is the abbreviated version, containing approximately 2% of the total text.

Network Working Group                                            P. Funk Request for Comments: 5281                                  Unaffiliated Category: Informational                                  S. Blake-Wilson                                                                  SafeNet                                                              August 2008

   Extensible Authentication Protocol Tunneled Transport Layer Security              Authenticated Protocol Version 0 (EAP-TTLSv0)

Status of This Memo

   This memo provides information for the Internet community.  It does    not specify an Internet standard of any kind.  Distribution of this    memo is unlimited.

Abstract

   EAP-TTLS is an EAP (Extensible Authentication Protocol) method that

   encapsulates a TLS (Transport Layer Security) session, consisting of

   a handshake phase and a data phase.  During the handshake phase, the

   server is authenticated to the client (or client and server are

   mutually authenticated) using standard TLS procedures, and keying

   material is generated in order to create a cryptographically secure

   tunnel for information exchange in the subsequent data phase.  During

   the data phase, the client is authenticated to the server (or client

   and server are mutually authenticated) using an arbitrary

   authentication mechanism encapsulated within the secure tunnel.  The

   encapsulated authentication mechanism may itself be EAP, or it may be

   another authentication protocol such as PAP, CHAP, MS-CHAP, or MS-

   CHAP-V2.  Thus, EAP-TTLS allows legacy password-based authentication

   protocols to be used against existing authentication databases, while

   protecting the security of these legacy protocols against

   eavesdropping, man-in-the-middle, and other attacks.  The data phase

   may also be used for additional, arbitrary data exchange.

 Funk & Blake-Wilson          Informational                      [Page 1]
 RFC 5281                       EAP-TTLSv0                    August 2008

 Table of Contents

   1. Introduction ....................................................4

   2. Motivation ......................................................5

   3. Requirements Language ...........................................7

   4. Terminology .....................................................7

   5. Architectural Model .............................................9

      5.1. Carrier Protocols .........................................10

      5.2. Security Relationships ....................................10

   ...