issue 357: Channel Binding Definition

Hi Jari,

> 
> Re: do all the three parties have to be involved in the

> binding? I believe that is essential for the definition
to say this.
> 

Agreed. 

> Re: the data that is subject to channel binding. I
think it 
> is clear that not all data known by the parties needs
to be 
> bound. Traditionally, we've only talked about security
or 
> billing related information, such as the NAS identity
and 
> type and cost of service. A large number of other
parameters 
> may be known by some of the parties, but not relevant
from a 
> verification perspective.
> 

True. Actually, there does seem to be a line of thinking
where perhaps
channel binding capabilities can even be tied to the peer
verifying
advertised capabilities of the authenticator with the AAA
server. Of
course, it can be argued that it has nothing really to do
with channel
binding (and I'd agree) - but, goes to prove again that
this is an
opaque blob that may not be fully available at the peer. 

> Re: do all the parties share the same data? I tend to
agree 
> with Vidya here that its sufficient to for the verifier
to 
> check that the data it gets is correct. But this issue
is 
> also related to policies of what the parties want to be

> verified. If the server wants to verify FOO but the
client 
> does not send it, we're not helping. This leads me to
think 
> that the channel bindings, if we ever get them
deployed, are 
> going to have use a well standardized set of parameters
or 
> else we have a policy management problem in our hands.
But 
> see below for a process comment.
> 
> Process comment: Lets try to focus on the definition of

> channel bindings rather than their implementation in
this 
> discussion. EAP keying framework does not define how to

> implement them, or whether to pick solution 1, 2, or 3.
> 

Fully agree with this. Let's define it for the EAP keying
document and
continue to discuss solutions later for a separate document.

> Suggested text:
> 
> "Channel Binding
> 
> A secure mechanism for ensuring that a chosen set of
channel 
> properties (such as endpoint identifiers) are agreed
upon by 
> the EAP peer,  authenticator and server."
> 
> Vidya: note that the "chosen set" may be
different in 
> different situations, depending on what information is
available.
> 

Agree with the chosen set part. But, what is the
authenticator agreeing
to? Isn't it just an agreement about the authenticator
between the peer
and server? 

Vidya

> --Jari
> 
> 
>
____________________________________________________________
_____
> To unsubscribe or modify your subscription options,
please visit:
> http:/
/lists.frascone.com/mailman/listinfo/eap
> 
> Arhives: http://lists.
frascone.com/pipermail/eap
> 
____________________________________________________________
_____
To unsubscribe or modify your subscription options, please
visit:
http:/
/lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.
frascone.com/pipermail/eap

issue 357: Channel Binding Definition

Thread: issue 357: Channel Binding Definition