eap Mailing List: RE: channel binding

[Salowey, Joe (jsalowey]

> 
> I don't understand this, as we are not discussing the case 
> where EAP derived keys are not used.

[Joe] We are discussing the capabilities of an EAP-method.  Although an
EAP-method can generate keys there is nothing forcing those keys to be
used for anything.  Binding data to the authentication exchange and
binding data to the key derivation are similar but different approaches.
I do not think that one should eliminate binding of data in the
authentication in favor of binding data in the key derivation as they
solve different problems.  I am not familiar with the EAP-IKEv2 use of
"channel bindings", but I would rather see the capability fixed if it
has a problem than removed.