eap Mailing List: Re: issue 325 - channel bindings

[Jari Arkko (jari.arkko]

Ok.

Bernard Aboba wrote:

> How about this?
>
> "Channel Bindings include lower layer parameters that
> are verified for consistency between the EAP peer and server.
> In order to avoid introducing media dependencies, EAP
> methods that transport Channel Binding data MUST treat this
> data as opaque octets.
>
> Typically the EAP method imports Channel Bindings from the
> lower layer on the peer, and transmits them securely to the
> EAP server, which exports them to the lower layer or AAA layer.  However,
> transport may occur from EAP server to peer, or may be
> bi-directional.  On the side of the exchange (peer or server)
> where Channel Bindings are verified, the lower layer or AAA layer passes
> the result of the verification (TRUE or FALSE) up to the
> EAP method.
>
> While the verification can be done either by the peer
> or the server, typically only the server has the knowledge to
> determine the correctness of the values, as opposed to merely
> verifying their equality."