eap Mailing List: EAP and roaming

[Julien Bournelle (julien.bournelle]

Hi all,

 In the roaming case, the EAP authenticator and EAP server do not belong
 to the same administrative entity. LEt's say that authenticator belong
 to company A and EAP server to company B.

 In draft-ietf-eap-keying-06.txt, it is assumed that the
 AAA-Key is provided in a AAA-Token. 

 From security requirements in p. 51:

 "TO ensure against compromise, the AAA-Token MUST be integrity
 protected, authenticated, replay protected and encrypted in transit,
 using well-established cryptographic algorithms"

 TO follow this requirement, it implies that the A's EAP authenticator
 has a direct SA with B's EAP server.

 So if the company B does not allow SA establishment between its EAP
 server with EAP authenticator from other company, EAP shouldn't be used.

 Am I missing something ?
 
-- 
julien.bournelle at int-evry.fr