draft-ietf-dime-erp-13.txt   draft-ietf-dime-erp-14.txt 
skipping to change at page 1, line 15 skipping to change at page 1, line 15
Intended status: Standards Track Orange Labs Intended status: Standards Track Orange Labs
Expires: April 25, 2013 S. Decugis Expires: April 25, 2013 S. Decugis
INSIDE Secure INSIDE Secure
Q. Wu Q. Wu
Huawei Huawei
G. Zorn G. Zorn
Network Zen Network Zen
October 22, 2012 October 22, 2012
Diameter Support for the EAP Re-authentication Protocol (ERP) Diameter Support for the EAP Re-authentication Protocol (ERP)
draft-ietf-dime-erp-13.txt draft-ietf-dime-erp-14.txt
Abstract Abstract
The EAP Re-authentication Protocol (ERP) defines extensions to the The EAP Re-authentication Protocol (ERP) defines extensions to the
Extensible Authentication Protocol (EAP) to support efficient re- Extensible Authentication Protocol (EAP) to support efficient re-
authentication between the peer and an EAP Re-authentication (ER) authentication between the peer and an EAP Re-authentication (ER)
server through a compatible authenticator. This document specifies server through a compatible authenticator. This document specifies
Diameter support for ERP. It defines a new Diameter ERP application Diameter support for ERP. It defines a new Diameter ERP application
to transport ERP messages between an ER authenticator and the ER to transport ERP messages between an ER authenticator and the ER
server, and a set of new AVPs that can be used to transport the server, and a set of new AVPs that can be used to transport the
skipping to change at page 10, line 51 skipping to change at page 10, line 51
specific code (EAP-Initiate). The peer should fallback to full EAP specific code (EAP-Initiate). The peer should fallback to full EAP
authentication in this case. authentication in this case.
When the authenticator receives an EAP-Initiate/Re-auth message from When the authenticator receives an EAP-Initiate/Re-auth message from
the peer, the message is processed as described in RFC 6696 with the peer, the message is processed as described in RFC 6696 with
regard to the EAP state machine. It creates a Diameter ERP/DER regard to the EAP state machine. It creates a Diameter ERP/DER
message following the general process of Diameter EAP [RFC4072], with message following the general process of Diameter EAP [RFC4072], with
the following differences: the following differences:
The Application Id in the header is set to <Diameter ERP> (code The Application Id in the header is set to <Diameter ERP> (code
TBD ). TBD1 ).
The value in Auth-Application-Id AVP is also set to <Diameter The value in Auth-Application-Id AVP is also set to <Diameter
ERP>. ERP>.
The keyName-NAI attribute from the ERP message is used to create The keyName-NAI attribute from the ERP message is used to create
the content of the User-Name and Destination-Realm AVPs. the content of the User-Name and Destination-Realm AVPs.
The Auth-Request-Type AVP content is set to the appropriate value. The Auth-Request-Type AVP content is set to the appropriate value.
The EAP-Payload AVP contains the EAP-Initiate/Re-Auth meassge. The EAP-Payload AVP contains the EAP-Initiate/Re-Auth meassge.
Then this ERP/DER message is sent as described in Section 4. Then this ERP/DER message is sent as described in Section 4.
The ER server receives and processes this request as described in The ER server receives and processes this request as described in
Section 4. It then creates an ERP/DEA message following the general Section 4. It then creates an ERP/DEA message following the general
process described in RFC4072 [RFC4072], with the following process described in RFC4072 [RFC4072], with the following
differences: differences:
The Application Id in the header is set to <Diameter ERP> (code The Application Id in the header is set to <Diameter ERP> (code
TBD). TBD1).
The value of the Auth-Application-Id AVP is also set to <Diameter The value of the Auth-Application-Id AVP is also set to <Diameter
ERP>. ERP>.
The EAP-Payload AVP contains the EAP-Finish/Re-auth message. The EAP-Payload AVP contains the EAP-Finish/Re-auth message.
If authentication is successful, an instance of the Key AVP If authentication is successful, an instance of the Key AVP
containing the Re-authentication Master Session Key (rMSK) derived containing the Re-authentication Master Session Key (rMSK) derived
by ERP is included. by ERP is included.
When the authenticator receives this ERP/DEA answer, it processes it When the authenticator receives this ERP/DEA answer, it processes it
as described in the Diameter EAP Application specification [RFC4072] as described in the Diameter EAP Application specification [RFC4072]
and RFC 6696: the content of the EAP-Payload AVP is forwarded to the and RFC 6696: the content of the EAP-Payload AVP is forwarded to the
peer, and the contents of the Keying-Material AVP peer, and the contents of the Keying-Material AVP
[I-D.ietf-dime-local-keytran] is used as a shared secret for a secure [I-D.ietf-dime-local-keytran] is used as a shared secret for a secure
association protocol specific to the lower-layer in use. association protocol specific to the lower-layer in use.
7. Application Id 7. Application Id
We define a new Diameter application in this document, Diameter ERP We define a new Diameter application in this document, Diameter ERP
Application, with an Application Id value of TBD. Diameter nodes Application, with an Application Id value of TBD1. Diameter nodes
conforming to this specification in the role of ER server MUST conforming to this specification in the role of ER server MUST
advertise support by including an Auth-Application-Id AVP with a advertise support by including an Auth-Application-Id AVP with a
value of Diameter ERP in the Capabilities-Exchange-Request and value of Diameter ERP in the Capabilities-Exchange-Request and
Capabilities-Exchange-Answer commands [I-D.ietf-dime-rfc3588bis]. Capabilities-Exchange-Answer commands [I-D.ietf-dime-rfc3588bis].
The primary use of the Diameter ERP Application Id is to ensure The primary use of the Diameter ERP Application Id is to ensure
proper routing of the messages, and that the nodes that advertise the proper routing of the messages, and that the nodes that advertise the
support for this application do understand the new AVPs defined in support for this application do understand the new AVPs defined in
Section 8, although these AVP have the 'M' flag cleared. Section 8, although these AVP have the 'M' flag cleared.
8. AVPs 8. AVPs
The following sub-sections discuss the AVPs used by the Diameter ERP The following sub-sections discuss the AVPs used by the Diameter ERP
application. application.
8.1. ERP-RK-Request AVP 8.1. ERP-RK-Request AVP
The ERP-RK-Request AVP (AVP Code TBD) is of type grouped AVP. This The ERP-RK-Request AVP (AVP Code TBD2) is of type grouped AVP. This
AVP is used by the ER server to indicate its willingness to act as ER AVP is used by the ER server to indicate its willingness to act as ER
server for a particular session. server for a particular session.
This AVP has the M and V bits cleared. This AVP has the M and V bits cleared.
ERP-RK-Request ::= < AVP Header: TBD > ERP-RK-Request ::= < AVP Header: TBD2 >
{ ERP-Realm } { ERP-Realm }
* [ AVP ] * [ AVP ]
Figure 5: ERP-RK-Request ABNF Figure 5: ERP-RK-Request ABNF
8.2. ERP-Realm AVP 8.2. ERP-Realm AVP
The ERP-Realm AVP (AVP Code TBD) is of type DiameterIdentity. It The ERP-Realm AVP (AVP Code TBD3) is of type DiameterIdentity. It
contains the name of the realm in which the ER server is located. contains the name of the realm in which the ER server is located.
This AVP has the M and V bits cleared. This AVP has the M and V bits cleared.
8.3. Key AVP 8.3. Key AVP
The Key AVP [I-D.ietf-dime-local-keytran] is of type "Grouped" and is The Key AVP [I-D.ietf-dime-local-keytran] is of type "Grouped" and is
used to carry the rRK or rMSK and associated attributes. The usage used to carry the rRK or rMSK and associated attributes. The usage
of the Key AVP and its constituent AVPs in this application is of the Key AVP and its constituent AVPs in this application is
specified in the following sub-sections. specified in the following sub-sections.
skipping to change at page 13, line 28 skipping to change at page 13, line 28
This section defines new Result-Code [I-D.ietf-dime-rfc3588bis] This section defines new Result-Code [I-D.ietf-dime-rfc3588bis]
values that MUST be supported by all Diameter implementations that values that MUST be supported by all Diameter implementations that
conform to this specification. conform to this specification.
9.1. Permanent Failures 9.1. Permanent Failures
Errors that fall within the Permanent Failures category are used to Errors that fall within the Permanent Failures category are used to
inform the peer that the request failed and SHOULD NOT be attempted inform the peer that the request failed and SHOULD NOT be attempted
again. again.
DIAMETER_ERROR_ EAP_CODE_UNKNOWN (TBD) DIAMETER_ERROR_ EAP_CODE_UNKNOWN (TBD4)
This error code is used by the Diameter server to inform the This error code is used by the Diameter server to inform the
peer that the received EAP-PAYLOAD AVP contains an EAP packet peer that the received EAP-PAYLOAD AVP contains an EAP packet
with an unknown EAP code. with an unknown EAP code.
10. Contributors 10. Contributors
Hannes Tschofenig wrote the initial draft of this document. Hannes Tschofenig wrote the initial draft of this document.
Lakshminath Dondeti contributed to the early versions of the Lakshminath Dondeti contributed to the early versions of the
document. document.
11. Acknowledgements 11. Acknowledgements
Hannes Tschofenig, Zhen Cao and Jouni Korhonen provided useful Hannes Tschofenig, Zhen Cao, Benoit Claise, Elwyn Davies and Jouni
reviews. Korhonen provided useful reviews.
Vidya Narayanan reviewed a rough draft version of the document and Vidya Narayanan reviewed a rough draft version of the document and
found some errors. found some errors.
Many thanks to these people! Many thanks to these people!
12. IANA Considerations 12. IANA Considerations
This document requires IANA registration of the following new This document requires IANA registration of the following new
elements in the Authentication, Authorization, and Accounting (AAA) elements in the Authentication, Authorization, and Accounting (AAA)
skipping to change at page 14, line 36 skipping to change at page 14, line 36
These AVPs are defined in Section 8. These AVPs are defined in Section 8.
12.3. New Permanent Failures Result-Code AVP Values 12.3. New Permanent Failures Result-Code AVP Values
This specification requires IANA to allocate a new value from the This specification requires IANA to allocate a new value from the
"Result-Code AVP Values (code 268) - Permanent Failure" registry "Result-Code AVP Values (code 268) - Permanent Failure" registry
according to the policy specified in Section 11.3.2 of Fajardo, et according to the policy specified in Section 11.3.2 of Fajardo, et
al. [I-D.ietf-dime-rfc3588bis] for the following Result-Code: al. [I-D.ietf-dime-rfc3588bis] for the following Result-Code:
DIAMETER_ERROR_EAP_CODE_UNKNOWN TBD DIAMETER_ERROR_EAP_CODE_UNKNOWN TBD4
This result-code value is defined in Section 9. This result-code value is defined in Section 9.
13. Security Considerations 13. Security Considerations
The security considerations from the following documents apply here: The security considerations from the following documents apply here:
o Fajardo, et al. [I-D.ietf-dime-rfc3588bis] o Fajardo, et al. [I-D.ietf-dime-rfc3588bis]
o RFC 4072 [RFC4072] o RFC 4072 [RFC4072]
 End of changes. 10 change blocks. 
11 lines changed or deleted 11 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/