Extensible Authentication Protocol (EAP) Session-Id Derivation for EAP Subscriber Identity Module (EAP-SIM), EAP Authentication and Key Agreement (EAP-AKA), and Protected EAP (PEAP)
updates
- rfc-5247 — Extensible Authentication Protocol (EAP) Key Management Framework
Extracted elements (17)
PEAP Session-Id is defined to follow the same pattern as EAP-TLS (RFC 5216 Section 2.3), using client.random || server.random with the PEAP type code 0x19. This definition was already in widespread use in all known PEAP implementations before being formally specified here.
The fast reconnect Session-Id derivation is done via a random value created by the server, along with a secret key and the peer's identity. The document acknowledges no formal security analysis has been done but considers the derivation to be secure.
The original RFC 5247 Appendix A defined Session-Id for EAP-AKA and EAP-SIM using parameters (RAND, AUTN, NONCE_MT) only available in full authentication, making it unusable for fast reconnect. NONCE_S corresponds to RAND and MAC in EAP-Request/AKA-Reauthentication corresponds to AUTN, making NONCE_S || MAC the natural analog for the fast reconnect case.
The issue corrected in this specification (missing Session-Id derivation for fast reconnect in EAP-SIM and EAP-AKA) was first reported by Jouni Malinen as technical erratum ID 5011 against RFC 5247.
The IEEE FILS (Fast Initial Link Setup) authentication standard requires the EAP Session-Id for ERP (EAP Re-authentication Protocol, RFC 6696) to work, motivating the need to correct deficiencies in EAP Session-Id definitions for EAP-SIM and EAP-AKA.
The PEAP Session-Id definition (Session-Id = 0x19 || client.random || server.random) only applies when TLS 1.2 or earlier is used. A different derivation is defined for TLS 1.3 in draft-ietf-emu-tls-eap-types.
The Session-Id derivation for EAP-AKA' (EAP-AKA Prime) is not defined here; RFC 5448bis (draft-ietf-emu-rfc5448bis) defines it along with other updates.
EAP-AKA Session-Id for fast reconnect is derived as the concatenation of the EAP Type Code (0x17) with the NONCE_S field from AT_NONCE_S, followed by the MAC field from AT_MAC from EAP-Request/AKA-Reauthentication: Session-Id = 0x17 || NONCE_S || MAC.
EAP-AKA Session-Id for full authentication is derived as the concatenation of the EAP Type Code (0x17) with the RAND field from AT_RAND, followed by the AUTN field from AT_AUTN: Session-Id = 0x17 || RAND || AUTN.
EAP-SIM Session-Id for fast reconnect is the concatenation of the EAP Type Code (0x12) with the NONCE_S field from AT_NONCE_S, followed by the MAC field from AT_MAC from EAP-Request/SIM/Reauthentication: Session-Id = 0x12 || NONCE_S || MAC, which is 33 octets in length.
EAP-SIM Session-Id for full authentication with n=3 GSM triplets is: Session-Id = 0x12 || RAND1 || RAND2 || RAND3 || NONCE_MT, which is 65 octets in length. RAND1, RAND2, and RAND3 correspond to the RAND value from each GSM triplet.
PEAP Session-Id (EAP Type Code 0x19) is defined as: Session-Id = 0x19 || client.random || server.random, consistent with the EAP-TLS definition in RFC 5216 Section 2.3. This definition applies identically for both full authentication and fast reconnect.
The Session-Id definitions given for EAP-SIM, EAP-AKA, and PEAP are required to be unique per session, unforgeable, and unguessable by an outside party per RFC 5247 Section 10. These definitions have been widely deployed for years in all major EAP implementations.
This specification enables ERP (EAP Re-authentication Protocol) key hierarchy establishment using fast reconnect with EAP-SIM and EAP-AKA by providing the previously missing Session-Id derivation for the fast reconnect case. The updates do not modify the security considerations of RFC 5247.
Very little formal security analysis has been done for the Session-Id definitions specified here, despite their widespread deployment. Any security issues discovered would have serious implications for the Internet as a whole. The document acknowledges this risk explicitly.
EAP-SIM fast reconnect Session-Id is 33 octets in length (1 type byte + 16 NONCE_S bytes + 16 MAC bytes): Session-Id = 0x12 || NONCE_S || MAC.
EAP-SIM full authentication Session-Id length is 49 octets for n=2 (1 type byte + 16*2 RAND bytes + 16 NONCE_MT bytes) and 65 octets for n=3 (1 type byte + 16*3 RAND bytes + 16 NONCE_MT bytes).