eap Mailing List: Re: Proposed Resolution to Issue 357: Channel Binding Definition

[Yoshihiro Ohba (yohba]

On Tue, Jun 06, 2006 at 10:19:07PM -0700, Narayanan, Vidya wrote:
> Hi Bernard,
> The proposed text by Jari went through some revisions as I recall, based
> on some discussions on the list. Here is the latest on that text I
> pulled out from one of Jari's email, subsequent to the discussions: 
> 
> "I'd be happy to restrict the definition to peer and server agreeing
> that they have the same view of the channel properties claimed by the
> authenticator.
> 
> (But part of the distinction may also be in the specific implementation
> of the "agreement"; what we are looking for is that the values agree,
> without specifying who sends the values and who verifies them.)"
> 
> Based on the above, how about the following definition? 
> 
> "Channel Binding
> 
> A secure mechanism for ensuring that a chosen set of channel properties
> (such as authenticator identifiers and properties) are agreed upon by
> the EAP peer and server." 

After Jari's email, I created a thread "Channel Binding analysis" for
further discussion.  I still believe three party agreement is
essential for Channel Binding.  To me the two party agreement
mentioned above looks similar to issueing a Kerberos ticket that is
never verified by the consumers of the ticket.

Yoshihiro Ohba

> 
> Vidya
> 
> > -----Original Message-----
> > From: Bernard Aboba [mailto:bernard_aboba [at] hotmail.com] 
> > Sent: Saturday, June 03, 2006 6:41 PM
> > To: eap [at] frascone.com
> > Subject: [eap] Proposed Resolution to Issue 357: Channel 
> > Binding Definition
> > 
> > The text of Issue 357 is enclosed below.  The proposed 
> > resolution is to accept the definition proposed by Jari Arkko:
> > 
> > "Channel Binding
> > 
> > A secure mechanism for ensuring that a chosen set of channel 
> > properties (such as endpoint identifiers) are agreed upon by 
> > the EAP peer, authenticator and server."
> > 
> > --------------------------------------------------------------
> > ----------------------------------
> > Issue 357: Channel Binding Definition
> > Submitter name: Vidya Narayanan
> > Submitter email address: vidyan [at] qualcomm.com Date Submitted: 
> > May 1, 2006
> > Reference: http://lists.frascone.com/pipermail/eap/msg04227.html
> > Document: KEYING-12
> > Comment type: 'T'echnical
> > Priority: '1' Should fix
> > Section: 1.2
> > Rationale/Explanation of issue:
> > The document defines channel binding
> > as a communication within an EAP method - this seems a bit 
> > restrictive, given that channel binding information could be 
> > carried out-of-band as well. The only requirement is that the 
> > information be integrity protected between the peer and server.
> > 
> > Requested change:
> > Change wording to:
> > 
> > "The communication of integrity-protected channel properties 
> > such as endpoint identifiers which can be compared to values 
> > communicated via out of band mechanisms (such as via a AAA or 
> > lower layer protocol)."
> > 
> > 
> > _________________________________________________________________
> > To unsubscribe or modify your subscription options, please visit:
> > http://lists.frascone.com/mailman/listinfo/eap
> > 
> > Arhives: http://lists.frascone.com/pipermail/eap
> > 
> _________________________________________________________________
> To unsubscribe or modify your subscription options, please visit:
> http://lists.frascone.com/mailman/listinfo/eap
> 
> Arhives: http://lists.frascone.com/pipermail/eap
>