Basic Password Exchange within the Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST)
RFC 5421

Network Working Group                                      N. Cam-Winget
Request for Comments: 5421                                       H. Zhou
Category: Informational                                    Cisco Systems
                                                              March 2009

       Basic Password Exchange within the Flexible Authentication
   via Secure Tunneling Extensible Authentication Protocol (EAP-FAST)

Status of This Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (c) 2009 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents in effect on the date of
   publication of this document (http://trustee.ietf.org/license-info).
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.

   This document may contain material from IETF Documents or IETF
   Contributions published or made publicly available before November
   10, 2008.  The person(s) controlling the copyright in some of this
   material may not have granted the IETF Trust the right to allow
   modifications of such material outside the IETF Standards Process.
   Without obtaining an adequate license from the person(s) controlling
   the copyright in such materials, this document may not be modified
   outside the IETF Standards Process, and derivative works of it may
   not be created outside the IETF Standards Process, except to format
   it for publication as an RFC or to translate it into languages other
   than English.

IESG Note

   EAP-FAST has been implemented by many vendors and it is used in the
   Internet.  Publication of this specification is intended to promote
   interoperability by documenting current use of existing EAP methods
   within EAP-FAST.

   The EAP method EAP-FAST-GTC reuses the EAP type code assigned to EAP-
   GTC (6).  The reuse of previously assigned EAP Type Codes is
   incompatible with EAP method negotiation as defined in RFC 3748.

Cam-Winget & Zhou            Informational                      [Page 1]
RFC 5421                   EAP-FAST with GTC                  March 2009

   Since EAP-GTC does not support method-specific version negotiation,
   the use of EAP-FAST-GTC is implied when used inside the EAP-FAST
   tunnel during authentication.  This behavior may cause problems in
   implementations where the use of another vendor's EAP-GTC is
   required.  Since such support requires special case execution of a
   method within a tunnel, it also complicates implementations that use
   the same method code both within and outside of the tunnel method.
   If EAP-FAST were to be designed today, these difficulties could be
   avoided by utilization of unique EAP Type codes.  Given these issues,
   assigned method types must not be re-used with different meaning
   inside tunneled methods in the future.

Abstract

   The Flexible Authentication via Secure Tunneling Extensible
   Authentication Protocol (EAP-FAST) method enables secure
   communication between a peer and a server by using Transport Layer
   Security (TLS) to establish a mutually authenticated tunnel.  Within
   this tunnel, a basic password exchange, based on the Generic Token
   Card method (EAP-GTC), may be executed to authenticate the peer.

Table of Contents

   1. Introduction ....................................................2
      1.1. Specification Requirements .................................3
   2. EAP-FAST GTC Authentication .....................................3
   3. Security Considerations .........................................7
      3.1. Security Claims ............................................7
   4. IANA Considerations .............................................8
   5. Acknowledgments .................................................9
   6. References ......................................................9
      6.1. Normative References .......................................9
      6.2. Informative References .....................................9

1.  Introduction

   EAP-FAST [RFC4851] is an EAP method that can be used to mutually
   authenticate a peer and server.  This document describes the EAP-FAST
   inner EAP method, EAP-FAST-GTC, which is used to authenticate the
   peer through a basic password exchange.  EAP-FAST-GTC was developed
   to support using cleartext passwords to authenticate to legacy user
   databases, to facilitate password change, and to support one time
   password features such as new pin mode.  Message exchanges, including
   user credentials, are cleartext strings transferred within the