November 10, 2003EAP WG, IETF 581 EAP State Machines (draft-ietf-eap-statemachine-01) John Vollbrecht, Pasi Eronen, Nick Petroni, Yoshihiro Ohba

November 10, 2003EAP WG, IETF 582 Overview State machines for –EAP peer –EAP authenticator Including special cases for passthrough and backend authenticator Goals –Informational, not normative –Make understanding 2284bis easier –Work with 802.1X-REV state machines

November 10, 2003EAP WG, IETF 583 Status Adopted as WG work item at IETF57 Currently in WG last call

November 10, 2003EAP WG, IETF 584 EAP peer No changes since IETF57 (draft-vollbrecht-eap-state-04)

November 10, 2003EAP WG, IETF 585 EAP authenticator “Passthrough method” and “backend adapter” were difficult to understand New approach: three state machines –Standalone –Backend –Full (standalone + passthrough) No “special methods” or “adapters”

November 10, 2003EAP WG, IETF 586 Standalone authenticator No passthrough or AAA issues Peer-visible behavior should comply to this even when passthrough is used Interfaces to –Lower layer (matching 802.1X-REV) –EAP methods

November 10, 2003EAP WG, IETF 587 Backend authenticator Interfaces to –AAA module (RFC3579, Diameter EAP) –EAP methods Differences from standalone –Sends and receives EAP messages via AAA module instead of 1X-REV interface –No retransmissions –First packet can be EAP Response

November 10, 2003EAP WG, IETF 588 Full authenticator Standalone with a passthrough ”switch” Interfaces to –Lower layer (matching 802.1X-REV) –EAP methods (when not in passthrough mode) –AAA module (when in passthrough mode)

November 10, 2003EAP WG, IETF 589 Full & backend Full & backend Lower layer Full authenticator EAP method Backend authenticator AAA AAA interface Lower layer if Method interface AAA EAP method

November 10, 2003EAP WG, IETF 5810 Full authenticator Diagram split to two pages –1 st page: standalone authenticator + one transition for passthrough switch –2 nd page: passthrough mode Single transition from page 1 to 2 –…so the split should not make reading more difficult? –…easy to see what a “passthrough-only” authenticator does?

November 10, 2003EAP WG, IETF 5811 Next steps Handle issues from WG last call Publish as Informational