Dynamic Provisioning Using Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST)
RFC 5422

Network Working Group                                      N. Cam-Winget
Request for Comments: 5422                                     D. McGrew
Category: Informational                                       J. Salowey
                                                                 H. Zhou
                                                           Cisco Systems
                                                              March 2009

        Dynamic Provisioning Using Flexible Authentication via
     Secure Tunneling Extensible Authentication Protocol (EAP-FAST)

Status of This Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (c) 2009 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents in effect on the date of
   publication of this document (http://trustee.ietf.org/license-info).
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.

   This document may contain material from IETF Documents or IETF
   Contributions published or made publicly available before November
   10, 2008.  The person(s) controlling the copyright in some of this
   material may not have granted the IETF Trust the right to allow
   modifications of such material outside the IETF Standards Process.
   Without obtaining an adequate license from the person(s) controlling
   the copyright in such materials, this document may not be modified
   outside the IETF Standards Process, and derivative works of it may
   not be created outside the IETF Standards Process, except to format
   it for publication as an RFC or to translate it into languages other
   than English.

IESG Note

   EAP-FAST has been implemented by many vendors and it is used in the
   Internet.  Publication of this specification is intended to promote
   interoperability by documenting current use of existing EAP methods
   within EAP-FAST.

Cam-Winget, et al.           Informational                      [Page 1]
RFC 5422          Dynamic Provisioning Using EAP-FAST         March 2009

   The EAP method EAP-FAST-MSCHAPv2 reuses the EAP type code assigned to
   EAP-MSCHAPv2 (26) for authentication within an anonymous TLS tunnel.
   In order to minimize the risk associated with an anonymous tunnel,
   changes to the method were made that are not interoperable with EAP-
   MSCHAPv2.  Since EAP-MSCHAPv2 does not support method-specific
   version negotiation, the use of EAP-FAST-MSCHAPv2 is implied by the
   use of an anonymous EAP-FAST tunnel.  This behavior may cause
   problems in implementations where the use of unaltered EAP-MSCHAPv2
   is needed inside an anonymous EAP-FAST tunnel.  Since such support
   requires special case execution of a method within a tunnel, it also
   complicates implementations that use the same method code both within
   and outside of the tunnel method.  If EAP-FAST were to be designed
   today, these difficulties could be avoided by utilization of unique
   EAP Type codes.  Given these issues, assigned method types must not
   be re-used with different meaning inside tunneled methods in the
   future.

Abstract

   The Flexible Authentication via Secure Tunneling Extensible
   Authentication Protocol (EAP-FAST) method enables secure
   communication between a peer and a server by using Transport Layer
   Security (TLS) to establish a mutually authenticated tunnel.  EAP-
   FAST also enables the provisioning credentials or other information
   through this protected tunnel.  This document describes the use of
   EAP-FAST for dynamic provisioning.

Table of Contents

   1. Introduction ....................................................4
      1.1. Specification Requirements .................................4
      1.2. Terminology ................................................4
   2. EAP-FAST Provisioning Modes .....................................5
   3. Dynamic Provisioning Using EAP-FAST Conversation ................6
      3.1. Phase 1 TLS Tunnel .........................................7
           3.1.1. Server-Authenticated Tunnel .........................7
           3.1.2. Server-Unauthenticated Tunnel .......................7
      3.2. Phase 2 - Tunneled Authentication and Provisioning .........7
           3.2.1. Server-Authenticated Tunneled Authentication ........8
           3.2.2. Server-Unauthenticated Tunneled Authentication ......8
           3.2.3. Authenticating Using EAP-FAST-MSCHAPv2 ..............8
           3.2.4. Use of Other Inner EAP Methods for EAP-FAST
                  Provisioning ........................................9