eap Mailing List: Re: Basic facts about EAP

[Jari Arkko (jari.arkko]

Yoshihiro Ohba wrote:

>Given that the channel binding parameters would have to be pretty well
>specified between the EAP peer and authenticator, the authenticator
>can send the opaque objects to the EAP server via a AAA protocol
>(e.g., a channel-binding attribute/AVP).  The EAP server will be able
>to calculate the AAA-Key without necessarily knowing the semantics of
>the opaque objects.  What do you think?
>  
>
Sure. In fact, we are mostly doing this already... almost all
information that
one can think of as being a channel property already has an associated
AAA attribute.

But I was more worried about how the peer and the AAA server can be in
sync about the parameters to be used. If they don't communicate over
EAP, this leaves only full one-time specification as an option. If they
communicate (as in various drafts that propose to do channel binding),
then the set of parameters can evolve.

--Jari