55th IETF Atlanta, GA, November 17-21, 2002

1
55th IETFAtlanta, GA, November 17-21, 2002EAP
support in smartcards
Draft-urien-EAP-smartcard-00.txt

• My name is Pascal Urien
• urienp_at_wifisecurity.org

2
Draft Overview
Smartcard
Supplicant
Authenticator
RADIUS server
EAP
EAP / RADIUS
EAP / LAN
EAP / 7816
RADIUS
802.1x
ISO 7816

• Secure Authentication
• User authentication rather than computer
  authentication.

3
Draft Objectives.

• EAP support in smartcards.
• EAP is computed in smartcard.
• Profiles definition, for some EAP types (EAP-SIM,
  EAP-TLS, )
• Interoperability between ISO 7816 EAP smartcards.
  
• Agreement between major smartcard manufacturers.
• Four service primitives.
• Get-Next-identity()
• Set-Identity()
• EAP-Packet()
• Get-RSN-Master-Key()

EAP ENGINE
MD5
EAP SIM
IAK KERB
EAP AKA
EAP TLS
EAP Smartcard
4
Draft content.

• Defines 4 services primitives associated to four
  APDUs and two informative profiles.
• EAP-SIM
• EAP-MD5
• 4 Services, shuttled by 4 APDUs.
• Get_Next_Identity()
• CLAA0 INS16 P101 P200 Lc0 Lexx
• Set_Identity()
• CLAA0 INS16 P180 P200 Lcxx Le00
• EAP_Packet()
• CLAA0 INS80 P100 P200 Lcxx Leyy
• Get_RSN_Master_key()
• CLAA0 INSA6 P100 P200 Lc00 Le16.

5
System Identity Concept

• A wireless user may have several (EAP) identity
  associated to various 802.11 networks. The system
  identity is an ASCII string pointed to a
  particular (EAP) identity. The draft suggest
  three identity types,
• The network SSID as described in the 802.11
  standard .
• The NAI , the network realms and user name.
• A users identification (UID) e.g. an ASCII
  string, for example a friendly name.
• Get-Next-Identity()
• Returns an identity from a circular list.
• Set-Identity()
• Sets the smartcard identity, e.g everything
  required for EAP packet computing.
• The triplet (EAP-Identity, EAP-Type, Key(s)).

6
EAP Support.

• EAP_Packet()
• EAP-Packet() processes an EAP (request) message
  an returns an EAP (response) message.
• Get_RSN_Master_Key()
• Returns the session master key, if any, deduced
  from a successful authentication scenario.

Secure Trusted EAP Engine
In
Out
Master_Key