1. Pascal Urien & All Pascal.Urien@enst.fr
58th IETF Minneapolis, MN, November 9-14, “EAP support in smartcards”
draft-urien-eap-smartcard-03.txt
Pascal Urien & All

2. EAP Support in Smartcard – Overview
Goals: EAP support in smartcard
Definition of an “universal”, opened, ISO 7816 interface, e.g. supporting most of EAP authentication protocols.
Could be a new item at the EAP WG.
EAP smartcard benefits: security enhancement
EAP protocols are computed in a trusted and tamper resistant environment.
Network credentials are securely stored.
Smartcard bearer doesn’t know its network credentials (shared secret, asymmetric keys…)
Smartcard can’t be cloned.
Smartcard use is enable by the user’s PIN-code
Smartcard private values are protected by the issuer’s PIN-code
Other aspects: scalability, availability, performances
Scalability. One billion smartcards produced in 2003.
Multiple form factors (ISO 7816 Credit Card Format, SIM GSM 11.11, USB…).
Sufficient cryptographic performances (RSA 2048 bits calculation in 500 ms), memory size around 128 kb, one Mb with the FLASH technology).

3. EAP Smartcard Services
Network interface.
EAP messages processing (requests, notifications). A session key (PMK …) may be computed.
EAP profile. A guideline for a particular EAP protocol (MD5, EAP-TLS, EAP-SIM, …).
Operating System/Terminal interface.
Identity Management. Multiple triplets (EAP-ID, EAP-Type, cryptographic keys) are stored in the smartcard and pointed by an identity parameter.
User Profile. An information (ASN.1 encoded) meaningful for the terminal or the network.
Preferred SSIDs
X509 Certificates.
Management/Personalization interface.
Identities & User Profiles setting.
User/Issuer Interface
EAP smartcard is logically protected by two Personal Identification Number
User PIN code (user protection).
Issuer PIN code (service protection).

4. Use Case Start EAP Application User PIN Code Verification
// Select EAP application (AID= )
Select.request: 00 A
Select.response: 90 00
// Get current identity
Get-Current-Identity.request: A
Get-Current-Identity.response
// !Pin code is requested
// PIN code verification (0000)
Verify.request: A FF FF FF FF
Verify.response:
// Try again
Get-Current-Identity.response: C 04
Get-Current-Identity.request A
Get-Current-Identity.response:
// Get-Next-Identity()
Get-Next-Identity.request: A
Get-Next-Identity.response: 6C 04
Get-Next-Identity.request: A
Get-Next-Identity.response:
// Set-Identity()
Set-Identity.request: A
Set-Identity.response: 90 00
// Process EAP-Packets()
EAP-Packet.request: A A
EAP-Packet.response:
GetResponse.request: A0 C
GetResponse.response: 02 A
EAP-Packet.request A A
EAP-Packet.response:
GetResponse.request: A0 C
GetResponse.response: 02 A CF A5 2D CD 63 5F 5C 6D
55 B8 09 FD B7 BB EC 3C 90 00
User PIN Code Verification
Identity Discovery
Identity Setting
Identity
EAP Messages
Processing
MD5