eap Mailing List: Re: RE: channel binding

[Nicolas Williams (Nicolas.Williams]

On Mon, Aug 08, 2005 at 11:37:19PM +0000, Yoshihiro Ohba wrote:
> >From: "Salowey, Joe" <jsalowey [at] cisco.com>
> >Date: Mon, 8 Aug 2005 11:12:48 -0700
> >
> >[Joe] Neither mechanism is ideal, as the both require changes to the
> >system. I am not arguing against binding information in the key
> >derivation.   I am saying that performing this function in the mechanism
> >is different that performing it in the key derivation and that I believe
> >it is advantageous to have this functionality in the mechanism.
> 
> I think this is where we have different opinions. I don't think using EAP 
> methods to 
> carry channel parameters a good idea (even in the form a blob), while you 
> think it is 
> advantageous...

Except that channel bindings are part of EAP.  That you think they're not
a good idea does not make the feature go away :)  Are you proposing that
the feature be removed?  Or simply that some mechanism or other not
provide it?  The former would require, er, much process and would likely
not succeed; the latter may be a matter of course for some types of
mechanisms, but for those that provide full keying functionality I see
no reason not to also provide channel binding (though you might argue
that features such as channel binding and cryptographic binding could be
provided by pseudo-mechanisms stacked atop any mechanism that provides
for key derivation, and I'd agree, but I'd rather see such features
provided natively as well).

Nico
--