RFC 3748 - Extensible Authentication Protocol (EAP)

Status of this Memo: Standards Track

Published: June 2004

Obsoletes: RFC 2284

Abstract

This document defines the Extensible Authentication Protocol (EAP), an authentication framework which supports multiple authentication methods. EAP typically runs directly over data link layers such as Point-to-Point Protocol (PPP) or IEEE 802, without requiring IP. EAP provides its own support for duplicate elimination and retransmission, but is reliant on lower layer ordering guarantees. Fragmentation is not supported within EAP itself; however, individual EAP methods may support this.

This document obsoletes RFC 2284. A summary of the changes between this document and RFC 2284 is available in Appendix A.

Contents

• 1. Introduction
  • 1.1. Specification of Requirements
  • 1.2. Terminology
  • 1.3. Applicability
• 2. Extensible Authentication Protocol (EAP)
  • 2.1. Support for Sequences
  • 2.2. EAP Multiplexing Model
  • 2.3. Pass-Through Behavior
  • 2.4. Peer-to-Peer Operation
• 3. Lower Layer Behavior
  • 3.1. Lower Layer Requirements
  • 3.2. EAP Usage Within PPP
  • 3.3. EAP Usage Within IEEE 802
  • 3.4. Lower Layer Indications
• 4. EAP Packet Format
  • 4.1. Request and Response
  • 4.2. Success and Failure
  • 4.3. Retransmission Behavior
• 5. Initial EAP Request/Response Types
  • 5.1. Identity
  • 5.2. Notification
  • 5.3. Nak
  • 5.4. MD5-Challenge
  • 5.5. One-Time Password (OTP)
  • 5.6. Generic Token Card (GTC)
  • 5.7. Expanded Types
  • 5.8. Experimental
• 6. IANA Considerations
  • 6.1. Packet Codes
  • 6.2. Method Types
• 7. Security Considerations
  • 7.1. Threat Model
  • 7.2. Security Claims
  • 7.3. Identity Protection
  • 7.4. Man-in-the-Middle Attacks
  • 7.5. Packet Modification Attacks
  • 7.6. Dictionary Attacks
  • 7.7. Connection to an Untrusted Network
  • 7.8. Negotiation Attacks
  • 7.9. Implementation Idiosyncrasies
  • 7.10. Key Derivation
  • 7.11. Weak Ciphersuites
  • 7.12. Link Layer
  • 7.13. Separation of Authenticator and Backend Authentication Server
  • 7.14. Cleartext Passwords
  • 7.15. Channel Binding
  • 7.16. Protected Result Indications
• 8. Acknowledgements
• 9. References
  • 9.1. Normative References
  • 9.2. Informative References
• Appendix A. Changes from RFC 2284
• Authors' Addresses