My name is Pascal Urien, ENST Pascal.Urien@enst.fr 56th IETF San Francisco CA, March 16-21, 2003 “EAP support in smartcards” Draft-urien-EAP-smartcard-01.txt My name is Pascal Urien, ENST Pascal.Urien@enst.fr

Draft Objectives 1/2 Standardization initiative for EAP support in smartcard. Agreement between major smartcard manufacturers. Under discussion in the wlan smartcard consortium (www.wlansmartcard.org) supported by nineteen founding members. Definition of an “universal” ISO 7816 interface, e.g. supporting most of EAP authentication protocols. Height services are defined in this version. Three logical interfaces. Network interface. Smartcard directly processes EAP messages (requests, notifications). EAP profiles definition. A set of rules (if needed) for supporting a particular authentication protocol (messages maximum size, …). Operating system interface. Identity management. Multiple triplets (EAP-ID, EAP-Type, cryptographic keys) are stored in the smartcard; a triplet is required by each network. User profile, typically an LDAP record stored in the smartcard (under discussion). Management interface. Identities & profiles download and update. Management could be done via dedicated EAP protocols (under discussion).

Draft Objectives 2/2. EAP EAP / 7816 EAP / LAN EAP / RADIUS ISO 7816 Smartcard Supplicant Authenticator RADIUS server EAP EAP profile EAP profile EAP / 7816 EAP / LAN EAP / RADIUS EAP Engine ISO 7816 802.1x RADIUS EAP-ID EAP-Type Crypto Key(s) Secure Authentication. User authentication rather than computer authentication One smartcard for several networks. Interoperability between EAP smartcards.

Smartcard Facilities. Tamper resistant device, highly tested (credit card, GSM card, PKI card…) Low cost. Multiple form factors (ISO 7816 – credit card format, SIM GSM 11.11, USB…). Sufficient cryptographic performances (RSA 2048 bits calculation in 500 ms). Can be issued for millions users (half a billion – 600 millions of smartcard produced in 2001). Can compute multiple EAP protocols. Can be used in various networks (memory size around 128 kb, one Mb with the FLASH technology).

EAP smartcard components. EAP authentication protocols profiles OTHER EAP-MD5 EAP-SIM EAP-TLS Identity List Secure EAP Framework IDENTITY EAP-ID EAP TYPE CRYPTO Key(s) PROFILE My-Home dad MD5 Password Network access policy My-Office dad@dot.com TLS RSA Keys + X509 certificate Office Credentials SF-Airport dad@Airport.com SIM Ki Subscription Get-Next-Identity() Get-Preferred-Identity() Set-Identity() Get-Pairwise-Master-Key() Get-Subscriber-Profile OS interface Network interface Management Interface Add-Identity() Delete-Identity() EAP-Packets()

EAP smartcard, services list. APDU COMMENTS Add-Identity A0 16 81 P2 00 xx Add an identity entry to the EAP smartcard Delete-Identity A0 16 82 P2 00 00 Delete an identity entry Get-Preferred-Identity A0 16 02 00 00 xx Get the preferred identity Get-Next-Identity A0 16 01 00 00 xx Extract the next identity from a circular list Get-Subscriber-Profile A0 16 08 00 00 xx Get subscriber profile. Set-Identity A0 16 08 00 xx 00 Set the smartcard current identity EAP-Packets A0 80 00 00 xx yy Process an EAP message (requests and notifications. Produce a response is necessary Get-Pairwise-Master-Key A0 A6 00 00 00 20 Get the session key.

EAP smartcard profiles. Comments MD5 Informative purpose EAP-SIM Profile for EAP-SIM EAP-TLS The maximum EAP message length of a no fragmented packet is set to 240 bytes. For a fragmented EAP message, the maximum length value is 240 bytes. PEAP Under Discussion