Re: [Emu] Adoption call for eap.arpa

[Jan-Frederik Rieckers]

On 12.03.24 13:45, Alexander Clouter wrote:

On Tue, 12 Mar 2024, at 12:37, Yanlei(Ray) wrote:

My understanding here is that the EAP server and client will not
authenticate each other in EAP-TLS, and all the authentication will be
done in the " captive portal ". So why recommend EAP-TLS as a
provisioning method? Just send the identifier "por...@eap.arpa" and
then jump to a " captive portal ". Is that OK?

So for OOB provisioning (ie. get an IP to access a captive portal) the 
conversation would be:

EAP-Identity Request

<<< EAP-Identity Response[por...@eap.arpa]

EAP-Success

Sounds sensible.

I don't think it's that straight forward.


Cheers,
Janfred
--
Herr Jan-Frederik Rieckers
Security, Trust & Identity Services

E-Mail: rieck...@dfn.de | Fon: +49 30884299-339 | Fax: +49 30884299-370
Pronomen: er/sein | Pronouns: he/him
__________________________________________________________________________________


Verein zur Förderung eines Deutschen Forschungsnetzes e.V.
Alexanderplatz 1 | 10178 Berlin
https://www.dfn.de


Geschäftsführung: Dr. Christian Grimm | Jochem Pattloch
VR AG Charlottenburg 7729B | USt.-ID. DE 136623822

For Enterprise-WiFi we still need cryptographic keys for the WiFi 4-way handshake, so establishing a TLS-Tunnel is needed to derive the WPA keys. DFN - Deutsches Forschungsnetz | German National Research and Education Network Vorstand: Prof. Dr.-Ing. Stefan Wesner | Prof. Dr. Helmut Reiser | Christian Zens

smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
Emu mailing list
Emu@ietf.org
https://www.ietf.org/mailman/listinfo/emu