<?xml version='1.0' encoding='utf-8'?>
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" version="3" ipr="trust200902" docName="draft-ietf-emu-rfc7170bis-22" number="9930" category="std" consensus="true" submissionType="IETF" obsoletes="7170" updates="9427" tocInclude="true" sortRefs="true" symRefs="true" xml:lang="en" prepTime="2026-02-27T15:28:13" indexInclude="true" scripts="Common,Latin" tocDepth="3">
  <link href="https://datatracker.ietf.org/doc/draft-ietf-emu-rfc7170bis-22" rel="prev"/>
  <link href="https://dx.doi.org/10.17487/rfc9930" rel="alternate"/>
  <link href="urn:issn:2070-1721" rel="alternate"/>
  <front>
    <title abbrev="TEAP Version 1">Tunnel Extensible Authentication Protocol (TEAP) Version 1</title>
    <seriesInfo name="RFC" value="9930" stream="IETF"/>
    <author initials="A." surname="DeKok" fullname="Alan DeKok" role="editor">
      <organization showOnFrontPage="true"/>
      <address>
        <email>alan.dekok@inkbridge.io</email>
      </address>
    </author>
    <date month="02" year="2026"/>
    <area>SEC</area>
    <workgroup>emu</workgroup>
    <keyword>example</keyword>
    <abstract pn="section-abstract">
      <t indent="0" pn="section-abstract-1">This document defines the Tunnel Extensible Authentication Protocol
(TEAP) version 1.  TEAP is a tunnel-based EAP method that enables
secure communication between a peer and a server by using the
Transport Layer Security (TLS) protocol to establish a mutually
authenticated tunnel.  Within the tunnel, TLV objects are used to
convey authentication-related data between the EAP peer and the EAP
server.  This document obsoletes RFC 7170 and updates RFC 9427 by
moving all TEAP specifications from those documents to this one.</t>
    </abstract>
    <boilerplate>
      <section anchor="status-of-memo" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.1">
        <name slugifiedName="name-status-of-this-memo">Status of This Memo</name>
        <t indent="0" pn="section-boilerplate.1-1">
            This is an Internet Standards Track document.
        </t>
        <t indent="0" pn="section-boilerplate.1-2">
            This document is a product of the Internet Engineering Task Force
            (IETF).  It represents the consensus of the IETF community.  It has
            received public review and has been approved for publication by
            the Internet Engineering Steering Group (IESG).  Further
            information on Internet Standards is available in Section 2 of 
            RFC 7841.
        </t>
        <t indent="0" pn="section-boilerplate.1-3">
            Information about the current status of this document, any
            errata, and how to provide feedback on it may be obtained at
            <eref target="https://www.rfc-editor.org/info/rfc9930" brackets="none"/>.
        </t>
      </section>
      <section anchor="copyright" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.2">
        <name slugifiedName="name-copyright-notice">Copyright Notice</name>
        <t indent="0" pn="section-boilerplate.2-1">
            Copyright (c) 2026 IETF Trust and the persons identified as the
            document authors. All rights reserved.
        </t>
        <t indent="0" pn="section-boilerplate.2-2">
            This document is subject to BCP 78 and the IETF Trust's Legal
            Provisions Relating to IETF Documents
            (<eref target="https://trustee.ietf.org/license-info" brackets="none"/>) in effect on the date of
            publication of this document. Please review these documents
            carefully, as they describe your rights and restrictions with
            respect to this document. Code Components extracted from this
            document must include Revised BSD License text as described in
            Section 4.e of the Trust Legal Provisions and are provided without
            warranty as described in the Revised BSD License.
        </t>
      </section>
    </boilerplate>
    <toc>
      <section anchor="toc" numbered="false" removeInRFC="false" toc="exclude" pn="section-toc.1">
        <name slugifiedName="name-table-of-contents">Table of Contents</name>
        <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1">
          <li pn="section-toc.1-1.1">
            <t indent="0" pn="section-toc.1-1.1.1"><xref derivedContent="1" format="counter" sectionFormat="of" target="section-1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-introduction">Introduction</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.1.2">
              <li pn="section-toc.1-1.1.2.1">
                <t indent="0" keepWithNext="true" pn="section-toc.1-1.1.2.1.1"><xref derivedContent="1.1" format="counter" sectionFormat="of" target="section-1.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-interoperability-issues">Interoperability Issues</xref></t>
              </li>
              <li pn="section-toc.1-1.1.2.2">
                <t indent="0" keepWithNext="true" pn="section-toc.1-1.1.2.2.1"><xref derivedContent="1.2" format="counter" sectionFormat="of" target="section-1.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-requirements-language">Requirements Language</xref></t>
              </li>
              <li pn="section-toc.1-1.1.2.3">
                <t indent="0" keepWithNext="true" pn="section-toc.1-1.1.2.3.1"><xref derivedContent="1.3" format="counter" sectionFormat="of" target="section-1.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-terminology">Terminology</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.2">
            <t indent="0" pn="section-toc.1-1.2.1"><xref derivedContent="2" format="counter" sectionFormat="of" target="section-2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-protocol-overview">Protocol Overview</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.2.2">
              <li pn="section-toc.1-1.2.2.1">
                <t indent="0" pn="section-toc.1-1.2.2.1.1"><xref derivedContent="2.1" format="counter" sectionFormat="of" target="section-2.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-architectural-model">Architectural Model</xref></t>
              </li>
              <li pn="section-toc.1-1.2.2.2">
                <t indent="0" pn="section-toc.1-1.2.2.2.1"><xref derivedContent="2.2" format="counter" sectionFormat="of" target="section-2.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-protocol-layering-model">Protocol-Layering Model</xref></t>
              </li>
              <li pn="section-toc.1-1.2.2.3">
                <t indent="0" pn="section-toc.1-1.2.2.3.1"><xref derivedContent="2.3" format="counter" sectionFormat="of" target="section-2.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-outer-tlvs-versus-inner-tlv">Outer TLVs Versus Inner TLVs</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.3">
            <t indent="0" pn="section-toc.1-1.3.1"><xref derivedContent="3" format="counter" sectionFormat="of" target="section-3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-teap-protocol">TEAP Protocol</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2">
              <li pn="section-toc.1-1.3.2.1">
                <t indent="0" pn="section-toc.1-1.3.2.1.1"><xref derivedContent="3.1" format="counter" sectionFormat="of" target="section-3.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-version-negotiation">Version Negotiation</xref></t>
              </li>
              <li pn="section-toc.1-1.3.2.2">
                <t indent="0" pn="section-toc.1-1.3.2.2.1"><xref derivedContent="3.2" format="counter" sectionFormat="of" target="section-3.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-teap-authentication-phase-1">TEAP Authentication Phase 1: Tunnel Establishment</xref></t>
              </li>
              <li pn="section-toc.1-1.3.2.3">
                <t indent="0" pn="section-toc.1-1.3.2.3.1"><xref derivedContent="3.3" format="counter" sectionFormat="of" target="section-3.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-server-certificate-requirem">Server Certificate Requirements</xref></t>
              </li>
              <li pn="section-toc.1-1.3.2.4">
                <t indent="0" pn="section-toc.1-1.3.2.4.1"><xref derivedContent="3.4" format="counter" sectionFormat="of" target="section-3.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-server-certificate-validati">Server Certificate Validation</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.4.2">
                  <li pn="section-toc.1-1.3.2.4.2.1">
                    <t indent="0" pn="section-toc.1-1.3.2.4.2.1.1"><xref derivedContent="3.4.1" format="counter" sectionFormat="of" target="section-3.4.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-client-certificates-sent-du">Client Certificates Sent During Phase 1</xref></t>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.3.2.5">
                <t indent="0" pn="section-toc.1-1.3.2.5.1"><xref derivedContent="3.5" format="counter" sectionFormat="of" target="section-3.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-resumption">Resumption</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.5.2">
                  <li pn="section-toc.1-1.3.2.5.2.1">
                    <t indent="0" pn="section-toc.1-1.3.2.5.2.1.1"><xref derivedContent="3.5.1" format="counter" sectionFormat="of" target="section-3.5.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-tls-session-resumption-usin">TLS Session Resumption Using Server State</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.5.2.2">
                    <t indent="0" pn="section-toc.1-1.3.2.5.2.2.1"><xref derivedContent="3.5.2" format="counter" sectionFormat="of" target="section-3.5.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-tls-session-resumption-using">TLS Session Resumption Using Client State</xref></t>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.3.2.6">
                <t indent="0" pn="section-toc.1-1.3.2.6.1"><xref derivedContent="3.6" format="counter" sectionFormat="of" target="section-3.6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-teap-authentication-phase-2">TEAP Authentication Phase 2: Tunneled Authentication</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.6.2">
                  <li pn="section-toc.1-1.3.2.6.2.1">
                    <t indent="0" pn="section-toc.1-1.3.2.6.2.1.1"><xref derivedContent="3.6.1" format="counter" sectionFormat="of" target="section-3.6.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-inner-method-ordering">Inner Method Ordering</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.6.2.2">
                    <t indent="0" pn="section-toc.1-1.3.2.6.2.2.1"><xref derivedContent="3.6.2" format="counter" sectionFormat="of" target="section-3.6.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-inner-eap-authentication">Inner EAP Authentication</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.6.2.3">
                    <t indent="0" pn="section-toc.1-1.3.2.6.2.3.1"><xref derivedContent="3.6.3" format="counter" sectionFormat="of" target="section-3.6.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-inner-password-authenticati">Inner Password Authentication</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.6.2.4">
                    <t indent="0" pn="section-toc.1-1.3.2.6.2.4.1"><xref derivedContent="3.6.4" format="counter" sectionFormat="of" target="section-3.6.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-eap-mschapv2">EAP-MSCHAPv2</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.6.2.5">
                    <t indent="0" pn="section-toc.1-1.3.2.6.2.5.1"><xref derivedContent="3.6.5" format="counter" sectionFormat="of" target="section-3.6.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-limitations-on-inner-method">Limitations on Inner Methods</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.6.2.6">
                    <t indent="0" pn="section-toc.1-1.3.2.6.2.6.1"><xref derivedContent="3.6.6" format="counter" sectionFormat="of" target="section-3.6.6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-protected-termination-and-a">Protected Termination and Acknowledged Result Indication</xref></t>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.3.2.7">
                <t indent="0" pn="section-toc.1-1.3.2.7.1"><xref derivedContent="3.7" format="counter" sectionFormat="of" target="section-3.7"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-determining-peer-id-and-ser">Determining Peer-Id and Server-Id</xref></t>
              </li>
              <li pn="section-toc.1-1.3.2.8">
                <t indent="0" pn="section-toc.1-1.3.2.8.1"><xref derivedContent="3.8" format="counter" sectionFormat="of" target="section-3.8"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-teap-session-identifier">TEAP Session Identifier</xref></t>
              </li>
              <li pn="section-toc.1-1.3.2.9">
                <t indent="0" pn="section-toc.1-1.3.2.9.1"><xref derivedContent="3.9" format="counter" sectionFormat="of" target="section-3.9"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-error-handling">Error Handling</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.9.2">
                  <li pn="section-toc.1-1.3.2.9.2.1">
                    <t indent="0" pn="section-toc.1-1.3.2.9.2.1.1"><xref derivedContent="3.9.1" format="counter" sectionFormat="of" target="section-3.9.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-outer-layer-errors">Outer-Layer Errors</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.9.2.2">
                    <t indent="0" pn="section-toc.1-1.3.2.9.2.2.1"><xref derivedContent="3.9.2" format="counter" sectionFormat="of" target="section-3.9.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-tls-layer-errors">TLS Layer Errors</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.9.2.3">
                    <t indent="0" pn="section-toc.1-1.3.2.9.2.3.1"><xref derivedContent="3.9.3" format="counter" sectionFormat="of" target="section-3.9.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-phase-2-errors">Phase 2 Errors</xref></t>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.3.2.10">
                <t indent="0" pn="section-toc.1-1.3.2.10.1"><xref derivedContent="3.10" format="counter" sectionFormat="of" target="section-3.10"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-fragmentation">Fragmentation</xref></t>
              </li>
              <li pn="section-toc.1-1.3.2.11">
                <t indent="0" pn="section-toc.1-1.3.2.11.1"><xref derivedContent="3.11" format="counter" sectionFormat="of" target="section-3.11"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-services-requested-by-the-p">Services Requested by the Peer</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.11.2">
                  <li pn="section-toc.1-1.3.2.11.2.1">
                    <t indent="0" pn="section-toc.1-1.3.2.11.2.1.1"><xref derivedContent="3.11.1" format="counter" sectionFormat="of" target="section-3.11.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-certificate-provisioning-wi">Certificate Provisioning Within the Tunnel</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.11.2.2">
                    <t indent="0" pn="section-toc.1-1.3.2.11.2.2.1"><xref derivedContent="3.11.2" format="counter" sectionFormat="of" target="section-3.11.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-certificate-content-and-use">Certificate Content and Uses</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.11.2.3">
                    <t indent="0" pn="section-toc.1-1.3.2.11.2.3.1"><xref derivedContent="3.11.3" format="counter" sectionFormat="of" target="section-3.11.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-server-unauthenticated-prov">Server Unauthenticated Provisioning Mode</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.11.2.4">
                    <t indent="0" pn="section-toc.1-1.3.2.11.2.4.1"><xref derivedContent="3.11.4" format="counter" sectionFormat="of" target="section-3.11.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-channel-binding">Channel Binding</xref></t>
                  </li>
                </ul>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.4">
            <t indent="0" pn="section-toc.1-1.4.1"><xref derivedContent="4" format="counter" sectionFormat="of" target="section-4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-message-formats">Message Formats</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.4.2">
              <li pn="section-toc.1-1.4.2.1">
                <t indent="0" pn="section-toc.1-1.4.2.1.1"><xref derivedContent="4.1" format="counter" sectionFormat="of" target="section-4.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-teap-message-format">TEAP Message Format</xref></t>
              </li>
              <li pn="section-toc.1-1.4.2.2">
                <t indent="0" pn="section-toc.1-1.4.2.2.1"><xref derivedContent="4.2" format="counter" sectionFormat="of" target="section-4.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-teap-tlv-format-and-support">TEAP TLV Format and Support</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.4.2.2.2">
                  <li pn="section-toc.1-1.4.2.2.2.1">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.1.1"><xref derivedContent="4.2.1" format="counter" sectionFormat="of" target="section-4.2.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-general-tlv-format">General TLV Format</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.2">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.2.1"><xref derivedContent="4.2.2" format="counter" sectionFormat="of" target="section-4.2.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-authority-id-tlv">Authority-ID TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.3">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.3.1"><xref derivedContent="4.2.3" format="counter" sectionFormat="of" target="section-4.2.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-identity-type-tlv">Identity-Type TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.4">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.4.1"><xref derivedContent="4.2.4" format="counter" sectionFormat="of" target="section-4.2.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-result-tlv">Result TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.5">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.5.1"><xref derivedContent="4.2.5" format="counter" sectionFormat="of" target="section-4.2.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-nak-tlv">NAK TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.6">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.6.1"><xref derivedContent="4.2.6" format="counter" sectionFormat="of" target="section-4.2.6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-error-tlv">Error TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.7">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.7.1"><xref derivedContent="4.2.7" format="counter" sectionFormat="of" target="section-4.2.7"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-channel-binding-tlv">Channel-Binding TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.8">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.8.1"><xref derivedContent="4.2.8" format="counter" sectionFormat="of" target="section-4.2.8"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-vendor-specific-tlv">Vendor-Specific TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.9">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.9.1"><xref derivedContent="4.2.9" format="counter" sectionFormat="of" target="section-4.2.9"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-request-action-tlv">Request-Action TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.10">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.10.1"><xref derivedContent="4.2.10" format="counter" sectionFormat="of" target="section-4.2.10"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-eap-payload-tlv">EAP-Payload TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.11">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.11.1"><xref derivedContent="4.2.11" format="counter" sectionFormat="of" target="section-4.2.11"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-intermediate-result-tlv">Intermediate-Result TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.12">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.12.1"><xref derivedContent="4.2.12" format="counter" sectionFormat="of" target="section-4.2.12"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-pac-tlv">PAC TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.13">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.13.1"><xref derivedContent="4.2.13" format="counter" sectionFormat="of" target="section-4.2.13"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-crypto-binding-tlv">Crypto-Binding TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.14">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.14.1"><xref derivedContent="4.2.14" format="counter" sectionFormat="of" target="section-4.2.14"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-basic-password-auth-req-tlv">Basic-Password-Auth-Req TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.15">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.15.1"><xref derivedContent="4.2.15" format="counter" sectionFormat="of" target="section-4.2.15"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-basic-password-auth-resp-tl">Basic-Password-Auth-Resp TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.16">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.16.1"><xref derivedContent="4.2.16" format="counter" sectionFormat="of" target="section-4.2.16"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-pkcs7-tlv">PKCS#7 TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.17">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.17.1"><xref derivedContent="4.2.17" format="counter" sectionFormat="of" target="section-4.2.17"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-pkcs10-tlv">PKCS#10 TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.18">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.18.1"><xref derivedContent="4.2.18" format="counter" sectionFormat="of" target="section-4.2.18"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-trusted-server-root-tlv">Trusted-Server-Root TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.19">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.19.1"><xref derivedContent="4.2.19" format="counter" sectionFormat="of" target="section-4.2.19"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-csr-attributes-tlv">CSR-Attributes TLV</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.2.2.20">
                    <t indent="0" pn="section-toc.1-1.4.2.2.2.20.1"><xref derivedContent="4.2.20" format="counter" sectionFormat="of" target="section-4.2.20"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-identity-hint-tlv">Identity-Hint TLV</xref></t>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.4.2.3">
                <t indent="0" pn="section-toc.1-1.4.2.3.1"><xref derivedContent="4.3" format="counter" sectionFormat="of" target="section-4.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-tlv-rules">TLV Rules</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.4.2.3.2">
                  <li pn="section-toc.1-1.4.2.3.2.1">
                    <t indent="0" pn="section-toc.1-1.4.2.3.2.1.1"><xref derivedContent="4.3.1" format="counter" sectionFormat="of" target="section-4.3.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-outer-tlvs">Outer TLVs</xref></t>
                  </li>
                  <li pn="section-toc.1-1.4.2.3.2.2">
                    <t indent="0" pn="section-toc.1-1.4.2.3.2.2.1"><xref derivedContent="4.3.2" format="counter" sectionFormat="of" target="section-4.3.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-inner-tlvs">Inner TLVs</xref></t>
                  </li>
                </ul>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.5">
            <t indent="0" pn="section-toc.1-1.5.1"><xref derivedContent="5" format="counter" sectionFormat="of" target="section-5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-limitations-of-teapv1">Limitations of TEAPv1</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.5.2">
              <li pn="section-toc.1-1.5.2.1">
                <t indent="0" pn="section-toc.1-1.5.2.1.1"><xref derivedContent="5.1" format="counter" sectionFormat="of" target="section-5.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-interoperable-inner-methods">Interoperable Inner Methods</xref></t>
              </li>
              <li pn="section-toc.1-1.5.2.2">
                <t indent="0" pn="section-toc.1-1.5.2.2.1"><xref derivedContent="5.2" format="counter" sectionFormat="of" target="section-5.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-explanation-and-background">Explanation and Background</xref></t>
              </li>
              <li pn="section-toc.1-1.5.2.3">
                <t indent="0" pn="section-toc.1-1.5.2.3.1"><xref derivedContent="5.3" format="counter" sectionFormat="of" target="section-5.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-next-steps">Next Steps</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.6">
            <t indent="0" pn="section-toc.1-1.6.1"><xref derivedContent="6" format="counter" sectionFormat="of" target="section-6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-cryptographic-calculations">Cryptographic Calculations</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.6.2">
              <li pn="section-toc.1-1.6.2.1">
                <t indent="0" pn="section-toc.1-1.6.2.1.1"><xref derivedContent="6.1" format="counter" sectionFormat="of" target="section-6.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-teap-authentication-phase-1-">TEAP Authentication Phase 1: Key Derivations</xref></t>
              </li>
              <li pn="section-toc.1-1.6.2.2">
                <t indent="0" pn="section-toc.1-1.6.2.2.1"><xref derivedContent="6.2" format="counter" sectionFormat="of" target="section-6.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-intermediate-compound-key-d">Intermediate Compound Key Derivations</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.6.2.2.2">
                  <li pn="section-toc.1-1.6.2.2.2.1">
                    <t indent="0" pn="section-toc.1-1.6.2.2.2.1.1"><xref derivedContent="6.2.1" format="counter" sectionFormat="of" target="section-6.2.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-generating-the-inner-method">Generating the Inner Method Session Key</xref></t>
                  </li>
                  <li pn="section-toc.1-1.6.2.2.2.2">
                    <t indent="0" pn="section-toc.1-1.6.2.2.2.2.1"><xref derivedContent="6.2.2" format="counter" sectionFormat="of" target="section-6.2.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-generating-s-imck">Generating S-IMCK</xref></t>
                  </li>
                  <li pn="section-toc.1-1.6.2.2.2.3">
                    <t indent="0" pn="section-toc.1-1.6.2.2.2.3.1"><xref derivedContent="6.2.3" format="counter" sectionFormat="of" target="section-6.2.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-choosing-inner-methods-secu">Choosing Inner Methods Securely</xref></t>
                  </li>
                  <li pn="section-toc.1-1.6.2.2.2.4">
                    <t indent="0" pn="section-toc.1-1.6.2.2.2.4.1"><xref derivedContent="6.2.4" format="counter" sectionFormat="of" target="section-6.2.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-managing-and-computing-cryp">Managing and Computing Crypto-Binding</xref></t>
                  </li>
                  <li pn="section-toc.1-1.6.2.2.2.5">
                    <t indent="0" pn="section-toc.1-1.6.2.2.2.5.1"><xref derivedContent="6.2.5" format="counter" sectionFormat="of" target="section-6.2.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-unintended-side-effects">Unintended Side Effects</xref></t>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.6.2.3">
                <t indent="0" pn="section-toc.1-1.6.2.3.1"><xref derivedContent="6.3" format="counter" sectionFormat="of" target="section-6.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-computing-the-compound-mac">Computing the Compound MAC</xref></t>
              </li>
              <li pn="section-toc.1-1.6.2.4">
                <t indent="0" pn="section-toc.1-1.6.2.4.1"><xref derivedContent="6.4" format="counter" sectionFormat="of" target="section-6.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-eap-master-session-key-gene">EAP Master Session Key Generation</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.7">
            <t indent="0" pn="section-toc.1-1.7.1"><xref derivedContent="7" format="counter" sectionFormat="of" target="section-7"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-iana-considerations">IANA Considerations</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.7.2">
              <li pn="section-toc.1-1.7.2.1">
                <t indent="0" pn="section-toc.1-1.7.2.1.1"><xref derivedContent="7.1" format="counter" sectionFormat="of" target="section-7.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-teap-tlv-types">TEAP TLV Types</xref></t>
              </li>
              <li pn="section-toc.1-1.7.2.2">
                <t indent="0" pn="section-toc.1-1.7.2.2.1"><xref derivedContent="7.2" format="counter" sectionFormat="of" target="section-7.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-teap-error-tlv-value-5-erro">TEAP Error TLV (value 5) Error Codes</xref></t>
              </li>
              <li pn="section-toc.1-1.7.2.3">
                <t indent="0" pn="section-toc.1-1.7.2.3.1"><xref derivedContent="7.3" format="counter" sectionFormat="of" target="section-7.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-tls-exporter-labels">TLS Exporter Labels</xref></t>
              </li>
              <li pn="section-toc.1-1.7.2.4">
                <t indent="0" pn="section-toc.1-1.7.2.4.1"><xref derivedContent="7.4" format="counter" sectionFormat="of" target="section-7.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-extended-master-session-key">Extended Master Session Key (EMSK) Parameters</xref></t>
              </li>
              <li pn="section-toc.1-1.7.2.5">
                <t indent="0" pn="section-toc.1-1.7.2.5.1"><xref derivedContent="7.5" format="counter" sectionFormat="of" target="section-7.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-extensible-authentication-p">Extensible Authentication Protocol (EAP) Registry</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.8">
            <t indent="0" pn="section-toc.1-1.8.1"><xref derivedContent="8" format="counter" sectionFormat="of" target="section-8"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-security-considerations">Security Considerations</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.8.2">
              <li pn="section-toc.1-1.8.2.1">
                <t indent="0" pn="section-toc.1-1.8.2.1.1"><xref derivedContent="8.1" format="counter" sectionFormat="of" target="section-8.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-mutual-authentication-and-i">Mutual Authentication and Integrity Protection</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.2">
                <t indent="0" pn="section-toc.1-1.8.2.2.1"><xref derivedContent="8.2" format="counter" sectionFormat="of" target="section-8.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-method-negotiation">Method Negotiation</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.3">
                <t indent="0" pn="section-toc.1-1.8.2.3.1"><xref derivedContent="8.3" format="counter" sectionFormat="of" target="section-8.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-separation-of-phase-1-and-p">Separation of Phase 1 and Phase 2 Servers</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.4">
                <t indent="0" pn="section-toc.1-1.8.2.4.1"><xref derivedContent="8.4" format="counter" sectionFormat="of" target="section-8.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-mitigation-of-known-vulnera">Mitigation of Known Vulnerabilities and Protocol Deficiencies</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.8.2.4.2">
                  <li pn="section-toc.1-1.8.2.4.2.1">
                    <t indent="0" pn="section-toc.1-1.8.2.4.2.1.1"><xref derivedContent="8.4.1" format="counter" sectionFormat="of" target="section-8.4.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-user-identity-protection-an">User Identity Protection and Verification</xref></t>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.8.2.5">
                <t indent="0" pn="section-toc.1-1.8.2.5.1"><xref derivedContent="8.5" format="counter" sectionFormat="of" target="section-8.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-dictionary-attack-resistanc">Dictionary Attack Resistance</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.8.2.5.2">
                  <li pn="section-toc.1-1.8.2.5.2.1">
                    <t indent="0" pn="section-toc.1-1.8.2.5.2.1.1"><xref derivedContent="8.5.1" format="counter" sectionFormat="of" target="section-8.5.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-protection-against-on-path-">Protection Against On-Path Attacks</xref></t>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.8.2.6">
                <t indent="0" pn="section-toc.1-1.8.2.6.1"><xref derivedContent="8.6" format="counter" sectionFormat="of" target="section-8.6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-protecting-against-forged-c">Protecting Against Forged Cleartext EAP Packets</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.7">
                <t indent="0" pn="section-toc.1-1.8.2.7.1"><xref derivedContent="8.7" format="counter" sectionFormat="of" target="section-8.7"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-use-of-cleartext-passwords">Use of Cleartext Passwords</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.8">
                <t indent="0" pn="section-toc.1-1.8.2.8.1"><xref derivedContent="8.8" format="counter" sectionFormat="of" target="section-8.8"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-accidental-or-unintended-be">Accidental or Unintended Behavior</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.9">
                <t indent="0" pn="section-toc.1-1.8.2.9.1"><xref derivedContent="8.9" format="counter" sectionFormat="of" target="section-8.9"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-implicit-challenge">Implicit Challenge</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.10">
                <t indent="0" pn="section-toc.1-1.8.2.10.1"><xref derivedContent="8.10" format="counter" sectionFormat="of" target="section-8.10"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-security-claims">Security Claims</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.9">
            <t indent="0" pn="section-toc.1-1.9.1"><xref derivedContent="9" format="counter" sectionFormat="of" target="section-9"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-references">References</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.9.2">
              <li pn="section-toc.1-1.9.2.1">
                <t indent="0" pn="section-toc.1-1.9.2.1.1"><xref derivedContent="9.1" format="counter" sectionFormat="of" target="section-9.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-normative-references">Normative References</xref></t>
              </li>
              <li pn="section-toc.1-1.9.2.2">
                <t indent="0" pn="section-toc.1-1.9.2.2.1"><xref derivedContent="9.2" format="counter" sectionFormat="of" target="section-9.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-informative-references">Informative References</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.10">
            <t indent="0" pn="section-toc.1-1.10.1"><xref derivedContent="Appendix A" format="default" sectionFormat="of" target="section-appendix.a"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-evaluation-against-tunnel-b">Evaluation Against Tunnel-Based EAP Method Requirements</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.10.2">
              <li pn="section-toc.1-1.10.2.1">
                <t indent="0" pn="section-toc.1-1.10.2.1.1"><xref derivedContent="A.1" format="counter" sectionFormat="of" target="section-appendix.a.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-411-rfc-complia">Requirement 4.1.1: RFC Compliance</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.2">
                <t indent="0" pn="section-toc.1-1.10.2.2.1"><xref derivedContent="A.2" format="counter" sectionFormat="of" target="section-appendix.a.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-421-tls-require">Requirement 4.2.1: TLS Requirements</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.3">
                <t indent="0" pn="section-toc.1-1.10.2.3.1"><xref derivedContent="A.3" format="counter" sectionFormat="of" target="section-appendix.a.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-42111-cipher-su">Requirement 4.2.1.1.1: Cipher Suite Negotiation</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.4">
                <t indent="0" pn="section-toc.1-1.10.2.4.1"><xref derivedContent="A.4" format="counter" sectionFormat="of" target="section-appendix.a.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-42112-tunnel-da">Requirement 4.2.1.1.2: Tunnel Data Protection Algorithms</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.5">
                <t indent="0" pn="section-toc.1-1.10.2.5.1"><xref derivedContent="A.5" format="counter" sectionFormat="of" target="section-appendix.a.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-42113-tunnel-au">Requirement 4.2.1.1.3: Tunnel Authentication and Key Establishment</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.6">
                <t indent="0" pn="section-toc.1-1.10.2.6.1"><xref derivedContent="A.6" format="counter" sectionFormat="of" target="section-appendix.a.6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-4212-tunnel-rep">Requirement 4.2.1.2: Tunnel Replay Protection</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.7">
                <t indent="0" pn="section-toc.1-1.10.2.7.1"><xref derivedContent="A.7" format="counter" sectionFormat="of" target="section-appendix.a.7"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-4213-tls-extens">Requirement 4.2.1.3: TLS Extensions</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.8">
                <t indent="0" pn="section-toc.1-1.10.2.8.1"><xref derivedContent="A.8" format="counter" sectionFormat="of" target="section-appendix.a.8"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-4214-peer-ident">Requirement 4.2.1.4: Peer Identity Privacy</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.9">
                <t indent="0" pn="section-toc.1-1.10.2.9.1"><xref derivedContent="A.9" format="counter" sectionFormat="of" target="section-appendix.a.9"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-4215-session-re">Requirement 4.2.1.5: Session Resumption</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.10">
                <t indent="0" pn="section-toc.1-1.10.2.10.1"><xref derivedContent="A.10" format="counter" sectionFormat="of" target="section-appendix.a.10"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-422-fragmentati">Requirement 4.2.2: Fragmentation</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.11">
                <t indent="0" pn="section-toc.1-1.10.2.11.1"><xref derivedContent="A.11" format="counter" sectionFormat="of" target="section-appendix.a.11"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-423-protection-">Requirement 4.2.3: Protection of Data External to Tunnel</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.12">
                <t indent="0" pn="section-toc.1-1.10.2.12.1"><xref derivedContent="A.12" format="counter" sectionFormat="of" target="section-appendix.a.12"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-431-extensible-">Requirement 4.3.1: Extensible Attribute Types</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.13">
                <t indent="0" pn="section-toc.1-1.10.2.13.1"><xref derivedContent="A.13" format="counter" sectionFormat="of" target="section-appendix.a.13"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-432-request-cha">Requirement 4.3.2: Request/Challenge Response Operation</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.14">
                <t indent="0" pn="section-toc.1-1.10.2.14.1"><xref derivedContent="A.14" format="counter" sectionFormat="of" target="section-appendix.a.14"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-433-indicating-">Requirement 4.3.3: Indicating Criticality of Attributes</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.15">
                <t indent="0" pn="section-toc.1-1.10.2.15.1"><xref derivedContent="A.15" format="counter" sectionFormat="of" target="section-appendix.a.15"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-434-vendor-spec">Requirement 4.3.4: Vendor-Specific Support</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.16">
                <t indent="0" pn="section-toc.1-1.10.2.16.1"><xref derivedContent="A.16" format="counter" sectionFormat="of" target="section-appendix.a.16"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-435-result-indi">Requirement 4.3.5: Result Indication</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.17">
                <t indent="0" pn="section-toc.1-1.10.2.17.1"><xref derivedContent="A.17" format="counter" sectionFormat="of" target="section-appendix.a.17"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-436-internation">Requirement 4.3.6: Internationalization of Display Strings</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.18">
                <t indent="0" pn="section-toc.1-1.10.2.18.1"><xref derivedContent="A.18" format="counter" sectionFormat="of" target="section-appendix.a.18"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-44-eap-channel-">Requirement 4.4: EAP Channel-Binding Requirements</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.19">
                <t indent="0" pn="section-toc.1-1.10.2.19.1"><xref derivedContent="A.19" format="counter" sectionFormat="of" target="section-appendix.a.19"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-4511-confidenti">Requirement 4.5.1.1: Confidentiality and Integrity</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.20">
                <t indent="0" pn="section-toc.1-1.10.2.20.1"><xref derivedContent="A.20" format="counter" sectionFormat="of" target="section-appendix.a.20"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-4512-authentica">Requirement 4.5.1.2: Authentication of Server</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.21">
                <t indent="0" pn="section-toc.1-1.10.2.21.1"><xref derivedContent="A.21" format="counter" sectionFormat="of" target="section-appendix.a.21"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-4513-server-cer">Requirement 4.5.1.3: Server Certificate Revocation Checking</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.22">
                <t indent="0" pn="section-toc.1-1.10.2.22.1"><xref derivedContent="A.22" format="counter" sectionFormat="of" target="section-appendix.a.22"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-452-internation">Requirement 4.5.2: Internationalization</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.23">
                <t indent="0" pn="section-toc.1-1.10.2.23.1"><xref derivedContent="A.23" format="counter" sectionFormat="of" target="section-appendix.a.23"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-453-metadata">Requirement 4.5.3: Metadata</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.24">
                <t indent="0" pn="section-toc.1-1.10.2.24.1"><xref derivedContent="A.24" format="counter" sectionFormat="of" target="section-appendix.a.24"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-454-password-ch">Requirement 4.5.4: Password Change</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.25">
                <t indent="0" pn="section-toc.1-1.10.2.25.1"><xref derivedContent="A.25" format="counter" sectionFormat="of" target="section-appendix.a.25"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-461-method-nego">Requirement 4.6.1: Method Negotiation</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.26">
                <t indent="0" pn="section-toc.1-1.10.2.26.1"><xref derivedContent="A.26" format="counter" sectionFormat="of" target="section-appendix.a.26"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-462-chained-met">Requirement 4.6.2: Chained Methods</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.27">
                <t indent="0" pn="section-toc.1-1.10.2.27.1"><xref derivedContent="A.27" format="counter" sectionFormat="of" target="section-appendix.a.27"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-463-cryptograph">Requirement 4.6.3: Cryptographic Binding with the TLS Tunnel</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.28">
                <t indent="0" pn="section-toc.1-1.10.2.28.1"><xref derivedContent="A.28" format="counter" sectionFormat="of" target="section-appendix.a.28"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-464-peer-initia">Requirement 4.6.4: Peer-Initiated EAP Authentication</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.29">
                <t indent="0" pn="section-toc.1-1.10.2.29.1"><xref derivedContent="A.29" format="counter" sectionFormat="of" target="section-appendix.a.29"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-requirement-465-method-meta">Requirement 4.6.5: Method Metadata</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.11">
            <t indent="0" pn="section-toc.1-1.11.1"><xref derivedContent="Appendix B" format="default" sectionFormat="of" target="section-appendix.b"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-major-differences-from-eap-">Major Differences from EAP-FAST</xref></t>
          </li>
          <li pn="section-toc.1-1.12">
            <t indent="0" pn="section-toc.1-1.12.1"><xref derivedContent="Appendix C" format="default" sectionFormat="of" target="section-appendix.c"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-examples">Examples</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.12.2">
              <li pn="section-toc.1-1.12.2.1">
                <t indent="0" pn="section-toc.1-1.12.2.1.1"><xref derivedContent="C.1" format="counter" sectionFormat="of" target="section-appendix.c.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-successful-authentication">Successful Authentication</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.2">
                <t indent="0" pn="section-toc.1-1.12.2.2.1"><xref derivedContent="C.2" format="counter" sectionFormat="of" target="section-appendix.c.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-failed-authentication">Failed Authentication</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.3">
                <t indent="0" pn="section-toc.1-1.12.2.3.1"><xref derivedContent="C.3" format="counter" sectionFormat="of" target="section-appendix.c.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-full-tls-handshake-using-ce">Full TLS Handshake Using Certificate-Based Cipher Suite</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.4">
                <t indent="0" pn="section-toc.1-1.12.2.4.1"><xref derivedContent="C.4" format="counter" sectionFormat="of" target="section-appendix.c.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-client-authentication-durin">Client Authentication During Phase 1 with Identity Privacy</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.5">
                <t indent="0" pn="section-toc.1-1.12.2.5.1"><xref derivedContent="C.5" format="counter" sectionFormat="of" target="section-appendix.c.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-fragmentation-and-reassembl">Fragmentation and Reassembly</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.6">
                <t indent="0" pn="section-toc.1-1.12.2.6.1"><xref derivedContent="C.6" format="counter" sectionFormat="of" target="section-appendix.c.6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-sequence-of-eap-methods">Sequence of EAP Methods</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.7">
                <t indent="0" pn="section-toc.1-1.12.2.7.1"><xref derivedContent="C.7" format="counter" sectionFormat="of" target="section-appendix.c.7"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-failed-crypto-binding">Failed Crypto-Binding</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.8">
                <t indent="0" pn="section-toc.1-1.12.2.8.1"><xref derivedContent="C.8" format="counter" sectionFormat="of" target="section-appendix.c.8"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-sequence-of-eap-method-with">Sequence of EAP Method with Vendor-Specific TLV Exchange</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.9">
                <t indent="0" pn="section-toc.1-1.12.2.9.1"><xref derivedContent="C.9" format="counter" sectionFormat="of" target="section-appendix.c.9"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-peer-requests-inner-method-">Peer Requests Inner Method After Server Sends Result TLV</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.10">
                <t indent="0" pn="section-toc.1-1.12.2.10.1"><xref derivedContent="C.10" format="counter" sectionFormat="of" target="section-appendix.c.10"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-channel-binding-2">Channel Binding</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.11">
                <t indent="0" pn="section-toc.1-1.12.2.11.1"><xref derivedContent="C.11" format="counter" sectionFormat="of" target="section-appendix.c.11"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-pkcs-exchange">PKCS Exchange</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.12">
                <t indent="0" pn="section-toc.1-1.12.2.12.1"><xref derivedContent="C.12" format="counter" sectionFormat="of" target="section-appendix.c.12"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-failure-scenario">Failure Scenario</xref></t>
              </li>
              <li pn="section-toc.1-1.12.2.13">
                <t indent="0" pn="section-toc.1-1.12.2.13.1"><xref derivedContent="C.13" format="counter" sectionFormat="of" target="section-appendix.c.13"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-client-certificate-in-phase">Client Certificate in Phase 1</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.13">
            <t indent="0" pn="section-toc.1-1.13.1"><xref derivedContent="Appendix D" format="default" sectionFormat="of" target="section-appendix.d"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-changes-from-rfc-7170">Changes from RFC 7170</xref></t>
          </li>
          <li pn="section-toc.1-1.14">
            <t indent="0" pn="section-toc.1-1.14.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.e"/><xref derivedContent="" format="title" sectionFormat="of" target="name-acknowledgments">Acknowledgments</xref></t>
          </li>
          <li pn="section-toc.1-1.15">
            <t indent="0" pn="section-toc.1-1.15.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.f"/><xref derivedContent="" format="title" sectionFormat="of" target="name-contributors">Contributors</xref></t>
          </li>
          <li pn="section-toc.1-1.16">
            <t indent="0" pn="section-toc.1-1.16.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.g"/><xref derivedContent="" format="title" sectionFormat="of" target="name-authors-address">Author's Address</xref></t>
          </li>
        </ul>
      </section>
    </toc>
  </front>
  <middle>
    <section anchor="introduction" numbered="true" removeInRFC="false" toc="include" pn="section-1">
      <name slugifiedName="name-introduction">Introduction</name>
      <t indent="0" pn="section-1-1">A tunnel-based Extensible Authentication Protocol (EAP) method is an
EAP method that establishes a secure tunnel and executes other EAP
methods under the protection of that secure tunnel.  A tunnel-based
EAP method can be used in any lower-layer protocol that supports EAP
authentication.  There are several existing tunnel-based EAP methods
that use Transport Layer Security (TLS) <xref target="RFC8446" format="default" sectionFormat="of" derivedContent="RFC8446"/> to establish the
secure tunnel.  EAP methods supporting this include Protected EAP
(PEAP) <xref target="PEAP" format="default" sectionFormat="of" derivedContent="PEAP"/>, EAP Tunneled Transport Layer Security (EAP-TTLS) <xref target="RFC5281" format="default" sectionFormat="of" derivedContent="RFC5281"/>, and EAP Flexible Authentication via Secure Tunneling
(EAP-FAST) <xref target="RFC4851" format="default" sectionFormat="of" derivedContent="RFC4851"/>.  However, they all are either vendor-specific or
informational, and the industry calls for a Standards Track
tunnel-based EAP method.  <xref target="RFC6678" format="default" sectionFormat="of" derivedContent="RFC6678"/> outlines the list of requirements for a
standard tunnel-based EAP method.</t>
      <t indent="0" pn="section-1-2">This document describes the Tunnel Extensible Authentication Protocol
(TEAP) version 1, which is based on EAP-FAST <xref target="RFC4851" format="default" sectionFormat="of" derivedContent="RFC4851"/>.  The changes from EAP-FAST to TEAP are largely minor in order
to meet the requirements outlined in <xref target="RFC6678" format="default" sectionFormat="of" derivedContent="RFC6678"/> for a standard
tunnel-based EAP method.</t>
      <t indent="0" pn="section-1-3">This document also defines cryptographic derivations for use with TLS 1.2.  When TLS 1.3 is used, the
definitions of cryptographic derivations in <xref target="RFC9427" format="default" sectionFormat="of" derivedContent="RFC9427"/> <bcp14>MUST</bcp14> be used
instead of the ones given here.</t>
      <t indent="0" pn="section-1-4">Note that while it is technically possible to use TEAPv1 with TLS 1.0
and TLS 1.1, those protocols have been deprecated in <xref target="RFC8996" format="default" sectionFormat="of" derivedContent="RFC8996"/>.  As
such, the definitions given here are only applicable for TLS 1.2 and TLS 1.3.</t>
      <section anchor="interoperability" numbered="true" removeInRFC="false" toc="include" pn="section-1.1">
        <name slugifiedName="name-interoperability-issues">Interoperability Issues</name>
        <t indent="0" pn="section-1.1-1">This document contains substantial changes from <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/>.  These
changes are largely clarifications and corrections to that
specification.</t>
        <t indent="0" pn="section-1.1-2">However, there is one major change from <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/> in the
specification of the cryptographic-binding information.  While there
were multiple implementations of <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/>, the text in that
document was interpreted differently by each implementation.  The
implementations are interoperable, but only for a subset of the
functionalities described in <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/>.</t>
        <t indent="0" pn="section-1.1-3">This specification describes how TEAPv1 works in theory but also
explains what subset of TEAPv1 is currently interoperable.  In order
to simplify the description of an already complex specification, all
interoperability issues are documented separately from the normal
protocol operation.</t>
        <t indent="0" pn="section-1.1-4">Please see <xref target="limitations" format="default" sectionFormat="of" derivedContent="Section 5"/> for further discussion of
interoperability issues.</t>
      </section>
      <section anchor="specification-requirements" numbered="true" removeInRFC="false" toc="include" pn="section-1.2">
        <name slugifiedName="name-requirements-language">Requirements Language</name>
        <t indent="0" pn="section-1.2-1">
    The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>",
    "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>",
    "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
    "<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are
    to be interpreted as described in BCP 14 <xref target="RFC2119" format="default" sectionFormat="of" derivedContent="RFC2119"/>
          <xref target="RFC8174" format="default" sectionFormat="of" derivedContent="RFC8174"/> when, and only when, they appear in all capitals,
    as shown here. 
</t>
      </section>
      <section anchor="terminology" numbered="true" removeInRFC="false" toc="include" pn="section-1.3">
        <name slugifiedName="name-terminology">Terminology</name>
        <t indent="0" pn="section-1.3-1">Much of the terminology in this document comes from <xref target="RFC3748" format="default" sectionFormat="of" derivedContent="RFC3748"/>.
Additional terms are defined below:</t>
        <dl spacing="normal" newline="true" indent="3" pn="section-1.3-2">
          <dt pn="section-1.3-2.1">Type-Length-Value (TLV)</dt>
          <dd pn="section-1.3-2.2">The TEAP utilizes objects in TLV format.  The TLV format is
  defined in <xref target="teap-tlv-format" format="default" sectionFormat="of" derivedContent="Section 4.2"/>.</dd>
          <dt pn="section-1.3-2.3">Inner Method</dt>
          <dd pn="section-1.3-2.4">An authentication method that is sent as application data inside of a
  TLS exchange that is carried over TEAP.  The Inner Method can be an EAP
  authentication method, a username/password authentication, or a
  vendor-specific authentication method.  Where the TLS connection is
  authenticated, the Inner Method could also be a Public Key Cryptography
  Standard (PKCS) exchange.</dd>
        </dl>
      </section>
    </section>
    <section anchor="protocol-overview" numbered="true" removeInRFC="false" toc="include" pn="section-2">
      <name slugifiedName="name-protocol-overview">Protocol Overview</name>
      <t indent="0" pn="section-2-1">TEAP authentication occurs in two phases after the initial EAP
Identity request/response exchange.  In the first phase, TEAP employs
the TLS <xref target="RFC8446" format="default" sectionFormat="of" derivedContent="RFC8446"/> handshake to provide an authenticated key exchange
and to establish a protected tunnel.  Once the tunnel is established,
the second phase begins with the peer and server engaging in further
conversations to establish the required authentication and
authorization policies.  TEAP makes use of TLV objects to carry out
the inner authentication, results, and other information, such as
channel-binding information.</t>
      <t indent="0" pn="section-2-2">As discussed in <xref section="2.1.7" sectionFormat="of" target="RFC9190" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9190#section-2.1.7" derivedContent="RFC9190"/> and <xref section="3.1" sectionFormat="of" target="RFC9427" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9427#section-3.1" derivedContent="RFC9427"/>,
the outer EAP Identity <bcp14>SHOULD</bcp14> be an anonymous Network Access
Identifier (NAI) as described in <xref section="2.4" sectionFormat="of" target="RFC7542" format="default" derivedLink="https://rfc-editor.org/rfc/rfc7542#section-2.4" derivedContent="RFC7542"/>.  While <xref section="5.1" sectionFormat="of" target="RFC3748" format="default" derivedLink="https://rfc-editor.org/rfc/rfc3748#section-5.1" derivedContent="RFC3748"/> places no
limits on the contents of the Identity field, <xref section="2.6" sectionFormat="of" target="RFC7542" format="default" derivedLink="https://rfc-editor.org/rfc/rfc7542#section-2.6" derivedContent="RFC7542"/>
states that Identities that do not follow the NAI format cannot be
transported in an Authentication, Authorization, and Accounting (AAA)
proxy network.  As such, Identities in non-NAI form are likely to not
work outside of limited and local networks.</t>
      <t indent="0" pn="section-2-3">Any inner identities (EAP or otherwise) <bcp14>SHOULD</bcp14> also
follow the recommendations of <xref section="3.1" sectionFormat="comma" target="RFC9427" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9427#section-3.1" derivedContent="RFC9427"/> about inner identities.</t>
      <t indent="0" pn="section-2-4"><xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/> defined a Protected Access Credential (PAC) to mirror
EAP-FAST <xref target="RFC4851" format="default" sectionFormat="of" derivedContent="RFC4851"/>.  However, implementation experience and analysis
determined that the PAC was not necessary.  Instead, TEAP performs
session resumption using the NewSessionTicket message as defined in 
Sections <xref section="2.1.2" sectionFormat="bare" target="RFC9190" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9190#section-2.1.2" derivedContent="RFC9190"/> and <xref section="2.1.3" sectionFormat="bare" target="RFC9190" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9190#section-2.1.3" derivedContent="RFC9190"/> of <xref target="RFC9190" format="default" sectionFormat="of" derivedContent="RFC9190"/>.  As such, the PAC has
been deprecated.</t>
      <t indent="0" pn="section-2-5">The TEAP conversation is used to establish or resume an existing
session to typically establish network connectivity between a peer
and the network.  Upon successful execution of TEAP, the EAP peer and
EAP server both derive strong session key material (Master Session Key <xref target="RFC3748" format="default" sectionFormat="of" derivedContent="RFC3748"/>) that can then be
communicated to the network access server (NAS) for use in
establishing a link-layer security association.</t>
      <section anchor="architectural-model" numbered="true" removeInRFC="false" toc="include" pn="section-2.1">
        <name slugifiedName="name-architectural-model">Architectural Model</name>
        <t indent="0" pn="section-2.1-1">The network architectural model for TEAP usage is shown below:</t>
        <figure align="left" suppress-title="false" pn="figure-1">
          <name slugifiedName="name-teap-architectural-model">TEAP Architectural Model</name>
          <artwork align="left" pn="section-2.1-2.1">
 +----------+      +----------+      +----------+      +----------+
 |          |      |          |      |          |      |  Inner   |
 |   Peer   |&lt;----&gt;|  Authen- |&lt;----&gt;|   TEAP   |&lt;----&gt;|  Method  |
 |          |      |  ticator |      |  server  |      |  server  |
 |          |      |          |      |          |      |          |
 +----------+      +----------+      +----------+      +----------+</artwork>
        </figure>
        <t indent="0" pn="section-2.1-3">The Peer and Authenticator are defined in <xref section="1.2" sectionFormat="comma" target="RFC3748" format="default" derivedLink="https://rfc-editor.org/rfc/rfc3748#section-1.2" derivedContent="RFC3748"/>.
The TEAP server is the "backend authentication server" defined in
<xref section="1.2" sectionFormat="comma" target="RFC3748" format="default" derivedLink="https://rfc-editor.org/rfc/rfc3748#section-1.2" derivedContent="RFC3748"/>.  The "Inner Method server" is usually part of the
TEAP server and handles the application data (Inner Methods, EAP, passwords, etc.)
inside of the TLS tunnel.</t>
        <t indent="0" pn="section-2.1-4">The entities depicted above are logical entities and may or may not
correspond to separate network components.  For example, the TEAP
server and Inner Method server might be a single entity; the
authenticator and TEAP server might be a single entity; or the
functions of the authenticator, TEAP server, and Inner Method server
might be combined into a single physical device.  For example,
typical IEEE 802.11 deployments place the authenticator in an access
point (AP) while a RADIUS server may provide the TEAP and inner
method server components.  The above diagram illustrates the division
of labor among entities in a general manner and shows how a
distributed system might be constructed; however, actual systems
might be realized more simply.  The security considerations in
<xref target="separation-p1-p2" format="default" sectionFormat="of" derivedContent="Section 8.3"/> provide an additional discussion of the implications of
separating the TEAP server from the Inner Method server.</t>
      </section>
      <section anchor="protocol-layering-model" numbered="true" removeInRFC="false" toc="include" pn="section-2.2">
        <name slugifiedName="name-protocol-layering-model">Protocol-Layering Model</name>
        <t indent="0" pn="section-2.2-1">TEAP packets are encapsulated
        within EAP; EAP in turn requires a transport protocol.  TEAP packets
        encapsulate TLS, which is then used to encapsulate user authentication
        information.  Thus, TEAP messaging can be described using a layered
        model, where each layer encapsulates the layer above it.  The
        following diagram clarifies the relationship between protocols:</t>
        <figure align="left" suppress-title="false" pn="figure-2">
          <name slugifiedName="name-protocol-layering-model-2">Protocol-Layering Model</name>
          <artwork align="left" pn="section-2.2-2.1">
 +------------------------------------------+
 | Inner EAP Method | Other TLV information |
 |------------------------------------------|
 |         TLV Encapsulation (TLVs)         |
 |------------------------------------------+---------------------+
 |                      TLS                 | Optional Outer TLVs |
 |----------------------------------------------------------------|
 |                            TEAP                                |
 |----------------------------------------------------------------|
 |                            EAP                                 |
 |----------------------------------------------------------------|
 |     Carrier Protocol (EAP over LAN, RADIUS, Diameter, etc.)    |
 +----------------------------------------------------------------+</artwork>
        </figure>
        <t indent="0" pn="section-2.2-3">The TLV layer is a payload with TLV objects as defined in
<xref target="teap-tlv-format" format="default" sectionFormat="of" derivedContent="Section 4.2"/>.  The TLV objects are used to carry arbitrary parameters
between an EAP peer and an EAP server.  All data exchanges in the TEAP-protected tunnel are encapsulated in a TLV layer.</t>
        <t indent="0" pn="section-2.2-4">Methods for encapsulating EAP within carrier protocols are already
defined.  For example, IEEE 802.1X <xref target="IEEE.802-1X.2020" format="default" sectionFormat="of" derivedContent="IEEE.802-1X.2020"/> may be used to
transport EAP between the peer and the authenticator; RADIUS
<xref target="RFC3579" format="default" sectionFormat="of" derivedContent="RFC3579"/> or Diameter <xref target="RFC4072" format="default" sectionFormat="of" derivedContent="RFC4072"/> may be used to transport EAP between
the authenticator and the EAP server.</t>
      </section>
      <section anchor="outer-tlvs-versus-inner-tlvs" numbered="true" removeInRFC="false" toc="include" pn="section-2.3">
        <name slugifiedName="name-outer-tlvs-versus-inner-tlv">Outer TLVs Versus Inner TLVs</name>
        <t indent="0" pn="section-2.3-1">TEAP packets may include TLVs both inside and outside the TLS tunnel
defined as follows:</t>
        <dl spacing="normal" newline="true" indent="3" pn="section-2.3-2">
          <dt pn="section-2.3-2.1">Outer TLVs</dt>
          <dd pn="section-2.3-2.2">This term is used to refer to optional TLVs outside the TLS tunnel,
  which are only allowed in the first two messages in the TEAP.  That
  is the first EAP-server-to-peer message and first peer-to-EAP-server
  message.  If the message is fragmented, the whole set of fragments is
  counted as one message.</dd>
          <dt pn="section-2.3-2.3">Inner TLVs</dt>
          <dd pn="section-2.3-2.4">This term is used to refer to TLVs sent within the TLS tunnel.  In TEAP
  Phase 1, Outer TLVs are used to help establish the TLS tunnel, but no Inner
  TLVs are used.  In Phase 2 of TEAP, TLS records may encapsulate zero or more
  Inner TLVs, but no Outer TLVs are used.</dd>
        </dl>
      </section>
    </section>
    <section anchor="teap-protocol" numbered="true" removeInRFC="false" toc="include" pn="section-3">
      <name slugifiedName="name-teap-protocol">TEAP Protocol</name>
      <t indent="0" pn="section-3-1">The operation of the protocol, including Phase 1 and Phase 2, is the
topic of this section.  The format of TEAP messages is given in
<xref target="message-formats" format="default" sectionFormat="of" derivedContent="Section 4"/>, and the cryptographic calculations are given in <xref target="cryptographic-calculations" format="default" sectionFormat="of" derivedContent="Section 6"/>.</t>
      <section anchor="version-negotiation" numbered="true" removeInRFC="false" toc="include" pn="section-3.1">
        <name slugifiedName="name-version-negotiation">Version Negotiation</name>
        <t indent="0" pn="section-3.1-1">TEAP packets contain a 3-bit Version field, following the TLS Flags
field, which enables future TEAP implementations to be backward
compatible with previous versions of the protocol.  This
specification documents the TEAP version 1 protocol; implementations
of this specification <bcp14>MUST</bcp14> use a Version field set to 1.</t>
        <t indent="0" pn="section-3.1-2">Version negotiation proceeds as follows:</t>
        <ol spacing="normal" type="1" indent="adaptive" start="1" pn="section-3.1-3">
	  <li pn="section-3.1-3.1" derivedCounter="1.">
            <t indent="0" pn="section-3.1-3.1.1">In the first EAP-Request sent with EAP type=TEAP, the EAP server
<bcp14>MUST</bcp14> set the Version field to the highest version it supports.</t>
          </li>
          <li pn="section-3.1-3.2" derivedCounter="2.">
            <t indent="0" pn="section-3.1-3.2.1">If the EAP peer supports this version of the protocol, it responds
with an EAP-Response of EAP type=TEAP, including the version number
proposed by the TEAP server.</t>
          </li>
          <li pn="section-3.1-3.3" derivedCounter="3.">
            <t indent="0" pn="section-3.1-3.3.1">If the TEAP peer does not support the proposed version but supports
a lower version, it responds with an EAP-Response of EAP type=TEAP and
sets the Version field to its highest supported version.</t>
          </li>
          <li pn="section-3.1-3.4" derivedCounter="4.">
            <t indent="0" pn="section-3.1-3.4.1">If the TEAP peer only supports versions higher than the version
proposed by the TEAP server, then use of TEAP will not be possible.
In this case, the TEAP peer sends back an EAP-Nak either to negotiate
a different EAP type or to indicate no other EAP types are available.</t>
          </li>
          <li pn="section-3.1-3.5" derivedCounter="5.">
            <t indent="0" pn="section-3.1-3.5.1">If the TEAP server does not support the version number proposed by
the TEAP peer, it <bcp14>MUST</bcp14> either terminate the conversation with an EAP
Failure or negotiate a new EAP type.</t>
          </li>
          <li pn="section-3.1-3.6" derivedCounter="6.">
            <t indent="0" pn="section-3.1-3.6.1">If the TEAP server does support the version proposed by the TEAP
peer, then the conversation continues using the version proposed by
the TEAP peer.</t>
          </li>
        </ol>
        <t indent="0" pn="section-3.1-4">The version negotiation procedure guarantees that the TEAP peer and
server will agree to the latest version supported by both parties.
If version negotiation fails, then use of TEAP will not be possible,
and another mutually acceptable EAP method will need to be negotiated
if authentication is to proceed.</t>
        <t indent="0" pn="section-3.1-5">The TEAP version is not protected by TLS and hence can be modified in
transit.  In order to detect a bid-down attack on the TEAP version, the
peers <bcp14>MUST</bcp14> exchange the TEAP version number received during version
negotiation using the Crypto-Binding TLV described in <xref target="crypto-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.13"/>.
The receiver of the Crypto-Binding TLV <bcp14>MUST</bcp14> verify that the version
received in the Crypto-Binding TLV matches the version sent by the
receiver in the TEAP version negotiation.</t>
        <t indent="0" pn="section-3.1-6">Intermediate results are signaled via the Intermediate-Result TLV (<xref target="intermediate-result-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.11"/>).
However, the Crypto-Binding TLV <bcp14>MUST</bcp14> be validated before any
Intermediate-Result TLV or Result TLV is examined.  If the
Crypto-Binding TLV fails to be validated for any reason, then it is a
fatal error and is handled as described in <xref target="phase-2-errors" format="default" sectionFormat="of" derivedContent="Section 3.9.3"/>.</t>
        <t indent="0" pn="section-3.1-7">The true success or failure of TEAP is conveyed by the Result TLV
with value Success or Failure.  However, as EAP terminates with either
a cleartext EAP Success or Failure, a peer will also receive a
cleartext EAP Success or Failure.  The received cleartext EAP Success
or Failure <bcp14>MUST</bcp14> match that received in the Result TLV; the peer <bcp14>SHOULD</bcp14>
silently discard those cleartext EAP Success or Failure messages that
do not coincide with the status sent in the protected Result TLV.</t>
      </section>
      <section anchor="phase1" numbered="true" removeInRFC="false" toc="include" pn="section-3.2">
        <name slugifiedName="name-teap-authentication-phase-1">TEAP Authentication Phase 1: Tunnel Establishment</name>
        <t indent="0" pn="section-3.2-1">TEAP relies on the TLS handshake <xref target="RFC8446" format="default" sectionFormat="of" derivedContent="RFC8446"/> to establish an
authenticated and protected tunnel.  The TLS version offered by the
peer and server <bcp14>MUST</bcp14> be TLS version 1.2 <xref target="RFC5246" format="default" sectionFormat="of" derivedContent="RFC5246"/> or later.  This
version of the TEAP implementation <bcp14>MUST</bcp14> support the following TLS
cipher suites:</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-3.2-2">
          <li pn="section-3.2-2.1">
            <t indent="0" pn="section-3.2-2.1.1">TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</t>
          </li>
          <li pn="section-3.2-2.2">
            <t indent="0" pn="section-3.2-2.2.1">TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</t>
          </li>
        </ul>
        <t indent="0" pn="section-3.2-3">Other cipher suites <bcp14>MAY</bcp14> be supported.  Implementations <bcp14>MUST</bcp14> implement
the recommended cipher suites in <xref section="4.2" sectionFormat="comma" target="RFC9325" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9325#section-4.2" derivedContent="RFC9325"/> for TLS 1.2
and in <xref section="9.1" sectionFormat="comma" target="RFC8446" format="default" derivedLink="https://rfc-editor.org/rfc/rfc8446#section-9.1" derivedContent="RFC8446"/> for TLS 1.3.</t>
        <t indent="0" pn="section-3.2-4">It is <bcp14>REQUIRED</bcp14> that anonymous
cipher suites such as TLS_DH_anon_WITH_AES_128_CBC_SHA <xref target="RFC5246" format="default" sectionFormat="of" derivedContent="RFC5246"/> only
be used in the case when the Inner Method provides
mutual authentication, key generation, and resistance to on-path
and dictionary attacks.  TLS cipher suites that do not provide
confidentiality <bcp14>MUST NOT</bcp14> be used.  During the TEAP Phase 1, the TEAP endpoints <bcp14>MAY</bcp14> negotiate TLS compression.
During TLS tunnel establishment, TLS extensions <bcp14>MAY</bcp14> be used.  For
instance, the Certificate Status Request extension <xref target="RFC6066" format="default" sectionFormat="of" derivedContent="RFC6066"/> and the
Multiple Certificate Status Request extension <xref target="RFC6961" format="default" sectionFormat="of" derivedContent="RFC6961"/> can be used
to leverage a certificate-status protocol such as the Online Certificate
Status Protocol (OCSP) <xref target="RFC6960" format="default" sectionFormat="of" derivedContent="RFC6960"/> to check the validity of server
certificates.  TLS renegotiation indications defined in
<xref target="RFC5746" format="default" sectionFormat="of" derivedContent="RFC5746"/> <bcp14>MUST</bcp14> be supported.</t>
        <t indent="0" pn="section-3.2-5">Use of TLS-PSK is <bcp14>NOT RECOMMENDED</bcp14>.  TEAP has not been designed to work
with TLS-PSK, and no use cases, security analyses, or implementations
have been done.  TLS-PSK may work (or not) with TEAP, depending on the
status of a particular implementation, and it is therefore not useful to
deploy it.</t>
        <t indent="0" pn="section-3.2-6">The EAP server initiates the TEAP conversation with an EAP request
containing a TEAP/Start packet.  This packet includes a set Start (S)
bit, the TEAP version as specified in <xref target="version-negotiation" format="default" sectionFormat="of" derivedContent="Section 3.1"/>, and an authority
identity TLV.  The TLS payload in the initial packet is empty.  The
authority identity TLV (Authority-ID TLV) is used to provide the peer
a hint of the server's identity that may be useful in helping the
peer select the appropriate credential to use.  Assuming that the
peer supports TEAP, the conversation continues with the peer sending
an EAP-Response packet with EAP type of TEAP with the Start (S) bit
clear and the version as specified in <xref target="version-negotiation" format="default" sectionFormat="of" derivedContent="Section 3.1"/>.  This message
encapsulates one or more TLS handshake messages.  If the TEAP version
negotiation is successful, then the TEAP conversation continues until
the EAP server and EAP peer are ready to enter Phase 2.  When the
full TLS handshake is performed, then the first payload of TEAP Phase
2 <bcp14>MAY</bcp14> be sent along with a server-finished handshake message to
reduce the number of round trips.</t>
        <t indent="0" pn="section-3.2-7">TEAP implementations <bcp14>MUST</bcp14> support mutual peer authentication during
tunnel establishment using the TLS cipher suites specified in this
section.  The TEAP peer does not need to authenticate as part of the
TLS exchange but can alternatively be authenticated through
additional exchanges carried out in Phase 2.</t>
        <t indent="0" pn="section-3.2-8">The TEAP tunnel protects peer identity information exchanged during
Phase 2 from disclosure outside the tunnel.  Implementations that
wish to provide identity privacy for the peer identity need to
carefully consider what information is disclosed outside the tunnel
prior to Phase 2.  TEAP implementations <bcp14>SHOULD</bcp14> support the immediate
renegotiation of a TLS session to initiate a new handshake message
exchange under the protection of the current cipher suite.  This
allows support for protection of the peer's identity when using TLS
client authentication.  An example of the exchanges using TLS
renegotiation to protect privacy is shown in <xref target="appendix-c-examples" format="default" sectionFormat="of" derivedContent="Appendix C"/>.</t>
      </section>
      <section anchor="server-certificate-requirements" numbered="true" removeInRFC="false" toc="include" pn="section-3.3">
        <name slugifiedName="name-server-certificate-requirem">Server Certificate Requirements</name>
        <t indent="0" pn="section-3.3-1">Server certificates <bcp14>MUST</bcp14> include a subjectAltName
        extension, with the dnsName attribute containing a Fully Qualified
        Domain Name (FQDN) string.  Server certificates <bcp14>MAY</bcp14>
        also include a SubjectDN containing a single element, "CN=",
        which contains the FQDN of the server.  However, this use of SubjectDN is
        deprecated for TEAP and is forbidden in <xref section="2" sectionFormat="comma" target="RFC9525" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9525#section-2" derivedContent="RFC9525"/>.</t>
        <t indent="0" pn="section-3.3-2">The KeyUsage extensions <bcp14>MAY</bcp14> be included but are not required.</t>
        <t indent="0" pn="section-3.3-3">The Extended Key Usage extensions defined in <xref target="RFC5280" format="default" sectionFormat="of" derivedContent="RFC5280"/> <bcp14>MAY</bcp14> also be included, but their use is discouraged.  Systems <bcp14>SHOULD</bcp14> use a private Certification Authority (CA) for EAP in preference to public CAs.  The most commonly used public CAs are focused on the web, and those certificates are not always suitable for use with EAP.  In contrast, private CAs can be designed for any purposes and can be restricted to an enterprise or an other organization.</t>
      </section>
      <section anchor="server-certificate-validation" numbered="true" removeInRFC="false" toc="include" pn="section-3.4">
        <name slugifiedName="name-server-certificate-validati">Server Certificate Validation</name>
        <t indent="0" pn="section-3.4-1">As part of the TLS negotiation, the server usually presents a
certificate to the peer.  In most cases, the certificate needs to be
validated, but there are a number of situations where the EAP peer
does not need to do certificate validation:</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-3.4-2">
          <li pn="section-3.4-2.1">
            <t indent="0" pn="section-3.4-2.1.1">when the peer has the server's End Entity (EE) certificate pinned or loaded directly into it's trusted anchor information <xref target="RFC4949" format="default" sectionFormat="of" derivedContent="RFC4949"/>;</t>
          </li>
          <li pn="section-3.4-2.2">
            <t indent="0" pn="section-3.4-2.2.1">when the peer is requesting server unauthenticated provisioning;</t>
          </li>
          <li pn="section-3.4-2.3">
            <t indent="0" pn="section-3.4-2.3.1">when the peer is certain that it will be using an authenticated Inner Method.</t>
          </li>
        </ul>
        <t indent="0" pn="section-3.4-3">In some cases, such as onboarding (or "bootstrapping"), the certificate
validation may be delayed.  However, once the onboarding has taken
place, the validation steps described below <bcp14>MUST</bcp14> still be performed.</t>
        <t indent="0" pn="section-3.4-4">In all other cases, the EAP peer <bcp14>MUST</bcp14> validate the server certificate.  This
validation is done in the same manner as is done for EAP-TLS, which is
discussed in <xref section="5.3" sectionFormat="comma" target="RFC9190" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9190#section-5.3" derivedContent="RFC9190"/> and in <xref section="5.3" sectionFormat="comma" target="RFC5216" format="default" derivedLink="https://rfc-editor.org/rfc/rfc5216#section-5.3" derivedContent="RFC5216"/>.
Further guidance on server identity validation can be found in
<xref section="6" sectionFormat="comma" target="RFC9525" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9525#section-6" derivedContent="RFC9525"/>.</t>
        <t indent="0" pn="section-3.4-5">Where the EAP peer has an NAI, EAP peers <bcp14>MUST</bcp14> use the realm to perform
the DNS-ID validation as per <xref section="6" sectionFormat="comma" target="RFC9525" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9525#section-6" derivedContent="RFC9525"/>.
The realm is used both to construct the list of reference identifiers
as defined in <xref section="6" sectionFormat="comma" target="RFC9525" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9525#section-6" derivedContent="RFC9525"/>, and as the
"source domain" field of that same section.</t>
        <t indent="0" pn="section-3.4-6">When performing server certificate validation, implementations <bcp14>MUST</bcp14>
also support the rules in <xref target="RFC5280" format="default" sectionFormat="of" derivedContent="RFC5280"/> for validating certificates
against a known trust anchor.  In addition, implementations <bcp14>MUST</bcp14>
support matching the realm portion of the peer's NAI against a
SubjectAltName of type dnsName within the server certificate.
However, in certain deployments, this comparison might not be
	appropriate or enabled.</t>
        <t indent="0" pn="section-3.4-7">In most situations, the EAP peer will have no network access during
the authentication process.  It will therefore have no way of correlating
the server identity given in the certificate presented by the EAP
server with a hostname, as is done with other protocols such as HTTPS.
Therefore, if the EAP peer has no preconfigured trust anchor, it will
have few, if any, ways of validating the server's certificate.</t>
        <section anchor="client-certs-phase1" numbered="true" removeInRFC="false" toc="include" pn="section-3.4.1">
          <name slugifiedName="name-client-certificates-sent-du">Client Certificates Sent During Phase 1</name>
          <t indent="0" pn="section-3.4.1-1">Note that since TLS client certificates are sent in the clear with TLS 1.2, if
identity protection is required, then it is possible for the TLS
authentication to be renegotiated after the first server
authentication.  To accomplish this, the server will typically not
request a certificate in the server_hello; then, after the
server_finished message is sent and before TEAP Phase 2, the server
<bcp14>MAY</bcp14> send a TLS hello_request.  
This allows the peer to perform client
authentication by sending a client_hello if it wants to or sending a
no_renegotiation alert to the server indicating that it wants to
continue with TEAP Phase 2 instead.  Assuming that the peer permits
renegotiation by sending a client_hello, then the server will respond
with server_hello, certificate, and certificate_request messages.
The peer replies with certificate, client_key_exchange, and
certificate_verify messages.  Since this renegotiation occurs within
the encrypted TLS channel, it does not reveal client certificate
details.  It is possible to perform certificate authentication using
EAP (for example, EAP-TLS) within the TLS session in TEAP
Phase 2 instead of using TLS handshake renegotiation.</t>
          <t indent="0" pn="section-3.4.1-2">When TLS 1.3 or later is used, it is <bcp14>RECOMMENDED</bcp14> that client
certificates are sent in Phase 1 instead of via Phase 2 and EAP-TLS.
Doing so will reduce the number of round trips.  Further discussion of
this issue is given below in <xref target="inner-method-limitations" format="default" sectionFormat="of" derivedContent="Section 3.6.5"/></t>
        </section>
      </section>
      <section anchor="resumption" numbered="true" removeInRFC="false" toc="include" pn="section-3.5">
        <name slugifiedName="name-resumption">Resumption</name>
        <t indent="0" pn="section-3.5-1">For resumption, <xref section="5.7" sectionFormat="comma" target="RFC9190" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9190#section-5.7" derivedContent="RFC9190"/> discusses EAP-TLS resumption
for all versions of TLS and is incorporated herein by reference.
<xref section="4" sectionFormat="comma" target="RFC9427" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9427#section-4" derivedContent="RFC9427"/> is also incorporated by reference, as it
provides generic discussion of resumption for TLS-based EAP methods
when TLS 1.3 is used.</t>
        <t indent="0" pn="section-3.5-2">This document only describes TEAP issues when resumption is used for
TLS versions of 1.2 and earlier.  It also describes resumption issues
that are specific to TEAP for TLS 1.3.</t>
        <t indent="0" pn="section-3.5-3">If the server agrees to resume the session, Phase 2 is bypassed
entirely.  If the server does not agree to resume the session, then
the server rejects the resumption as per <xref section="5.7" sectionFormat="comma" target="RFC9190" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9190#section-5.7" derivedContent="RFC9190"/>.  It
then continues with a full handshake.  After the full TLS handshake
has completed, both EAP server and peer <bcp14>MUST</bcp14> proceed with Phase 2.</t>
        <t indent="0" pn="section-3.5-4">All TEAP implementations <bcp14>MUST</bcp14> support resumption.  Using resumption
can significantly improve the scalability and stability of
authentication systems.  For example, some environments such as
universities may have users re-authenticating multiple times a day, if
not hourly.  Failure to implement resumption would increase the load
on the user database by orders of magnitude, leading to unnecessary
cost.</t>
        <t indent="0" pn="section-3.5-5">The following sections describe how a TEAP session can be resumed
based on server-side or client-side state.</t>
        <section anchor="resume-server-state" numbered="true" removeInRFC="false" toc="include" pn="section-3.5.1">
          <name slugifiedName="name-tls-session-resumption-usin">TLS Session Resumption Using Server State</name>
          <t indent="0" pn="section-3.5.1-1">TEAP session resumption is achieved in the same manner TLS achieves
session resumption.  To support session resumption, the server and peer
cache the Session ID, master secret, and cipher suite.  The
peer attempts to resume a session by including a valid Session ID
from a previous TLS handshake in its ClientHello message.  If the
server finds a match for the Session ID and is willing to establish a
new connection using the specified session state, the server will
respond with the same Session ID and proceed with the TEAP Phase 1
tunnel establishment based on a TLS abbreviated handshake.</t>
        </section>
        <section anchor="tls-session-resumption-using-client-state" numbered="true" removeInRFC="false" toc="include" pn="section-3.5.2">
          <name slugifiedName="name-tls-session-resumption-using">TLS Session Resumption Using Client State</name>
          <t indent="0" pn="section-3.5.2-1">TEAP supports the resumption of sessions based on the state being stored
on the client side using the TLS SessionTicket extension techniques
described in <xref target="RFC5077" format="default" sectionFormat="of" derivedContent="RFC5077"/> and <xref target="RFC9190" format="default" sectionFormat="of" derivedContent="RFC9190"/>.</t>
        </section>
      </section>
      <section anchor="teap-authentication-phase-2-tunneled-authentication" numbered="true" removeInRFC="false" toc="include" pn="section-3.6">
        <name slugifiedName="name-teap-authentication-phase-2">TEAP Authentication Phase 2: Tunneled Authentication</name>
        <t indent="0" pn="section-3.6-1">The second portion of the TEAP authentication occurs immediately
after successful completion of Phase 1.  Phase 2 occurs even if both
peer and authenticator are authenticated in the Phase 1 TLS
negotiation.  Phase 2 <bcp14>MUST NOT</bcp14> occur if the Phase 1 TLS handshake
fails, as that will compromise the security as the tunnel has not
been established successfully.  Phase 2 consists of a series of
requests and responses encapsulated in TLV objects defined in
<xref target="teap-tlv-format" format="default" sectionFormat="of" derivedContent="Section 4.2"/>.  Phase 2 <bcp14>MUST</bcp14> always end with a Crypto-Binding TLV
exchange described in <xref target="crypto-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.13"/> and a protected termination
exchange described in <xref target="protected-termination" format="default" sectionFormat="of" derivedContent="Section 3.6.6"/>.</t>
        <t indent="0" pn="section-3.6-2">If the peer is not authenticated in Phase 1, the TEAP peer <bcp14>SHOULD</bcp14> send
one or more Identity-Hint TLVs (<xref target="identity-hint-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.20"/>) as soon as the
TLS connection has been established.  This information lets the TEAP
server choose an authentication type that is appropriate for that
identity.  When the TEAP peer does not provide an Identity-Hint TLV,
the TEAP server does not know which Inner Method is supported by the
peer.  It must choose an Inner Method and propose it to
the peer, which may reject that Inner Method.  As a result,
the peer fails to authenticate and fails to obtain network access.</t>
        <t indent="0" pn="section-3.6-3">The TLV exchange includes the execution of zero or more inner
methods within the protected tunnel as described in Sections <xref target="inner-eap" format="counter" sectionFormat="of" derivedContent="3.6.2"/>
and <xref target="inner-password" format="counter" sectionFormat="of" derivedContent="3.6.3"/>.  A server <bcp14>MAY</bcp14> proceed directly to the
protected termination exchange without performing any inner
authentication if it does not wish to request further authentication
from the peer.  A server <bcp14>MAY</bcp14> request one or more authentications
within the protected tunnel.  After completion of each Inner Method,
the server decides whether or not to begin another Inner Method or
to send a Result TLV.</t>
        <t indent="0" pn="section-3.6-4">Implementations <bcp14>MUST</bcp14> support at least two sequential Inner Methods,
which allows both machine and user authentication to be performed.
Implementations <bcp14>SHOULD</bcp14> also limit the number of sequential inner
authentications, as there is no reason to perform a large number of inner
authentications in one TEAP conversation.</t>
        <t indent="0" pn="section-3.6-5">Implementations wishing to use their own proprietary authentication
method may substitute the EAP-Payload or Basic-Password-Auth-Req TLV
for the Vendor-Specific TLV, which carries another authentication
method.  Any vendor-specific authentication method <bcp14>MUST</bcp14> support
calculation of the Crypto-Binding TLV and <bcp14>MUST</bcp14> use
Intermediate-Result TLV and Result TLV as is done with other
authentication methods.</t>
        <section anchor="inner-method-ordering" numbered="true" removeInRFC="false" toc="include" pn="section-3.6.1">
          <name slugifiedName="name-inner-method-ordering">Inner Method Ordering</name>
          <t indent="0" pn="section-3.6.1-1">Due to issues noted in <xref target="limitations" format="default" sectionFormat="of" derivedContent="Section 5"/>, the order of Inner Methods has
implications for both security and interoperability.</t>
          <t indent="0" pn="section-3.6.1-2">Where the authentication is expected to use multiple Inner Methods,
implementations <bcp14>SHOULD</bcp14> order the methods so that a method that
derives an Extended Master Session Key (EMSK) is used first before any other method.  This ordering
helps to securely tie the Inner Method to the TLS session and therefore
can prevent attacks.</t>
          <t indent="0" pn="section-3.6.1-3">Implementations <bcp14>SHOULD</bcp14> support both EAP and basic password authentication for inner
methods.  Implementations that support multiple types of Inner Methods
(User and Machine) <bcp14>MUST</bcp14> support all of those methods in any order or
combination.  That is, it is explicitly permitted to "mix and match"
Inner Methods.</t>
          <t indent="0" pn="section-3.6.1-4">For example, a server can request user authentication from the peer
and have the peer return machine authentication (or vice versa).  If
the server is configured to accept machine authentication, it <bcp14>MUST</bcp14>
accept that response.  If that authentication succeeds, then depending
on local policy, the server <bcp14>SHOULD</bcp14> proceed with requesting user
authentication again.</t>
          <t indent="0" pn="section-3.6.1-5">Similarly, a peer that is configured to support multiple types of
Inner Methods (User and Machine) can return a method other than what
the server requested.  This action is usually taken by the peer so that it orders
Inner Methods for increased security.  See
<xref target="choosing-inner-methods" format="default" sectionFormat="of" derivedContent="Section 6.2.3"/> for further discussion of this issue.</t>
          <t indent="0" pn="section-3.6.1-6">However, the peer and server <bcp14>MUST NOT</bcp14> assume that either will skip
Inner Methods or other TLV exchanges, as the other peer might have
a different security policy.  The peer may have roamed to a network
that requires conformance with a different authentication policy, or
the peer may request the server take additional action (e.g., channel
binding) through the use of the Request-Action TLV as defined in
<xref target="request-action-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.9"/>.</t>
          <t indent="0" pn="section-3.6.1-7">The completion of each Inner Method is signaled by an
Intermediate-Result TLV.  Where the Intermediate-Result TLV indicates
failure, an Error TLV <bcp14>SHOULD</bcp14> also be included using the most descriptive error code possible.  The
Intermediate-Result TLV may be accompanied by another TLV indicating
that the server wishes to perform a subsequent authentication.  When
all Inner Methods have completed, the server <bcp14>MUST</bcp14> send a Result
TLV indicating success or failure instead of a TLV that carries an
Inner Method.</t>
        </section>
        <section anchor="inner-eap" numbered="true" removeInRFC="false" toc="include" pn="section-3.6.2">
          <name slugifiedName="name-inner-eap-authentication">Inner EAP Authentication</name>
          <t indent="0" pn="section-3.6.2-1">EAP <xref target="RFC3748" format="default" sectionFormat="of" derivedContent="RFC3748"/> prohibits use of multiple authentication methods within
a single EAP conversation in order to limit vulnerabilities to on-path
attacks.  TEAP addresses on-path attacks
through support for cryptographic protection of the inner EAP
exchange and cryptographic binding of the inner EAP
method(s) to the protected tunnel.  Inner Methods are executed serially
in a sequence.  This version of TEAP does not support initiating
multiple Inner Methods simultaneously in parallel.  The Inner Methods need
not be distinct.  For example, EAP-TLS (<xref target="RFC5216" format="default" sectionFormat="of" derivedContent="RFC5216"/> and <xref target="RFC9190" format="default" sectionFormat="of" derivedContent="RFC9190"/>) could be run twice as an inner
method, first using machine credentials, followed by a second instance
using user credentials.</t>
          <t indent="0" pn="section-3.6.2-2">When EAP is used as an Inner Method, the EAP messages are carried within EAP-Payload TLVs defined in
<xref target="eap-payload-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.10"/>.  Note that in this use case, TEAP is simply a
carrier for EAP, much as RADIUS is a carrier for EAP.  The full EAP
state machine runs  as normal and is carried over the EAP-Payload
TLV.  Each distinct EAP authentication <bcp14>MUST</bcp14> be managed as a separate
EAP state machine.</t>
          <t indent="0" pn="section-3.6.2-3">A TEAP server therefore <bcp14>MUST</bcp14> begin an EAP authentication with an
EAP-Request/Identity (carried in an EAP-Payload TLV).  However, a TEAP
server <bcp14>MUST NOT</bcp14> finish the EAP conversation with an EAP Success or EAP
Failure packet; the Intermediate-Result TLV is used instead.</t>
          <t indent="0" pn="section-3.6.2-4">Upon completion of each EAP authentication in the tunnel, the server <bcp14>MUST</bcp14> send
an Intermediate-Result TLV indicating the result of that authentication.  When the result indicates success, it <bcp14>MUST</bcp14> be accompanied by a Crypto-Binding TLV. 

The peer <bcp14>MUST</bcp14> respond to the Intermediate-Result TLV indicating its own result. Similarly, upon success, the peer <bcp14>MUST</bcp14> accompany the TLV with its own Crypto-Binding TLV.

The peer <bcp14>MUST</bcp14> respond to the Intermediate-Result TLV indicating its own result and similarly on success <bcp14>MUST</bcp14> accompany the TLV with its own Crypto-Binding TLV.
The Crypto-Binding TLV is
further discussed in Sections <xref target="crypto-binding-tlv" format="counter" sectionFormat="of" derivedContent="4.2.13"/> and
<xref target="computing-compound-mac" format="counter" sectionFormat="of" derivedContent="6.3"/>.  The Intermediate-Result TLVs can be
included with other TLVs that indicate a subsequent authentication or with the Result TLV used in the protected termination
exchange.</t>
          <t indent="0" pn="section-3.6.2-5">If both peer and server indicate success, then the authentication is
considered successful.  If either indicates failure, then the authentication is
considered failed.  The result of failure of an EAP authentication does not
always imply a failure of the overall authentication.  If one
Inner Method fails, the server may attempt to authenticate
the peer with a different method (EAP or password).</t>
        </section>
        <section anchor="inner-password" numbered="true" removeInRFC="false" toc="include" pn="section-3.6.3">
          <name slugifiedName="name-inner-password-authenticati">Inner Password Authentication</name>
          <t indent="0" pn="section-3.6.3-1">The authentication server (AS) initiates password
authentication by sending a Basic-Password-Auth-Req TLV defined in
<xref target="bp-auth-req-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.14"/>.  If the peer wishes to participate in password
authentication, then it responds with a Basic-Password-Auth-Resp TLV that contains the username and password as defined in <xref target="bp-auth-resp-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.15"/>.
If it does not wish to perform password authentication, then it
responds with a Negative Acknowledgment (NAK) TLV indicating the rejection of the Basic-Password-Auth-Req TLV.</t>
          <t indent="0" pn="section-3.6.3-2">The basic password authentication defined here is similar in functionality to that used by EAP-TTLS <xref target="RFC5281" format="default" sectionFormat="of" derivedContent="RFC5281"/> with inner password authentication.  It shares a similar security and risk analysis.</t>
          <t indent="0" pn="section-3.6.3-3">Multiple round trips of password authentication requests and responses
<bcp14>MAY</bcp14> be used to support some "housekeeping" functions such as a
password or pin change before a user is considered to be
authenticated.  Multiple rounds <bcp14>MAY</bcp14> also be used to communicate a
user's password and, separately, a one-time password such as Time-Based One-Time Passwords (TOTPs) <xref target="RFC6238" format="default" sectionFormat="of" derivedContent="RFC6238"/>.</t>
          <t indent="0" pn="section-3.6.3-4">Implementations <bcp14>MUST</bcp14> limit the number of round trips for password
authentication.  It is reasonable to use one or two round trips.
Further round trips are likely to be problematic and <bcp14>SHOULD</bcp14> be
avoided.</t>
          <t indent="0" pn="section-3.6.3-5">The first Basic-Password-Auth-Req TLV received in a session <bcp14>MUST</bcp14>
include a prompt, which the peer displays to the user.  Subsequent
authentication rounds <bcp14>SHOULD</bcp14> include a prompt, but it is not always
necessary.</t>
          <t indent="0" pn="section-3.6.3-6">When the peer first receives a Basic-Password-Auth-Req TLV, it should
allow the user to enter both a username and a password, which are then
placed in the Basic-Password-Auth-Resp TLV.  If the peer receives
subsequent Basic-Password-Auth-Req TLVs in the same authentication
session, it <bcp14>MUST NOT</bcp14> prompt for a username and <bcp14>MUST</bcp14> instead allow the user
to enter only a password.  The peer <bcp14>MUST</bcp14> copy the username used in the
first Basic-Password-Auth-Resp TLV into all subsequent
Basic-Password-Auth-Resp TLVs.</t>
          <t indent="0" pn="section-3.6.3-7">Servers <bcp14>MUST</bcp14> track the username across multiple password rounds and
reject authentication if the identity changes from one
Basic-Password-Auth-Resp TLV to the next.  There is no reason for a
user (or machine) to change identities in the middle of authentication.</t>
          <t indent="0" pn="section-3.6.3-8">Upon reception of a Basic-Password-Auth-Resp TLV in
the tunnel, the server <bcp14>MUST</bcp14> send an Intermediate-Result TLV
indicating the result.  The peer <bcp14>MUST</bcp14> respond
to the Intermediate-Result TLV indicating its result.  If the result
indicates success, the Intermediate-Result TLV <bcp14>MUST</bcp14> be accompanied by
a Crypto-Binding TLV.  The Crypto-Binding TLV is further discussed in Sections
<xref target="crypto-binding-tlv" format="counter" sectionFormat="of" derivedContent="4.2.13"/> and <xref target="computing-compound-mac" format="counter" sectionFormat="of" derivedContent="6.3"/>.</t>
          <t indent="0" pn="section-3.6.3-9">The Intermediate-Result TLVs can be included with other TLVs that
indicate a subsequent authentication or with the Result TLV used in
the protected termination exchange.</t>
          <t indent="0" pn="section-3.6.3-10">The use of EAP-FAST-GTC as defined in <xref target="RFC5421" format="default" sectionFormat="of" derivedContent="RFC5421"/> is <bcp14>NOT RECOMMENDED</bcp14> with TEAPv1 because EAP-FAST-GTC is not compliant with
EAP-GTC defined in <xref target="RFC3748" format="default" sectionFormat="of" derivedContent="RFC3748"/>.  Implementations should instead make
use of the password authentication TLVs defined in this
specification.</t>
        </section>
        <section anchor="eap-mschapv2" numbered="true" removeInRFC="false" toc="include" pn="section-3.6.4">
          <name slugifiedName="name-eap-mschapv2">EAP-MSCHAPv2</name>
          <t indent="0" pn="section-3.6.4-1">If using EAP-MSCHAPv2 <xref target="I-D.kamath-pppext-eap-mschapv2" format="default" sectionFormat="of" derivedContent="KAMATH"/> as an inner EAP method, the EAP-FAST-MSCHAPv2
variant defined in <xref section="3.2.3" sectionFormat="comma" target="RFC5422" format="default" derivedLink="https://rfc-editor.org/rfc/rfc5422#section-3.2.3" derivedContent="RFC5422"/> <bcp14>MUST</bcp14> be used instead of the derivation defined in <xref target="MSCHAP" format="default" sectionFormat="of" derivedContent="MSCHAP"/>.</t>
          <t indent="0" pn="section-3.6.4-2">The difference between EAP-MSCHAPv2 and EAP-FAST-MSCHAPv2 is that the
first and the second 16 octets of the EAP-MSCHAPv2 Master Session Key (MSK) are swapped when it
is used as the Inner Method Session Keys (IMSKs) for TEAP.</t>
        </section>
        <section anchor="inner-method-limitations" numbered="true" removeInRFC="false" toc="include" pn="section-3.6.5">
          <name slugifiedName="name-limitations-on-inner-method">Limitations on Inner Methods</name>
          <t indent="0" pn="section-3.6.5-1">Implementations <bcp14>SHOULD</bcp14> limit the permitted inner EAP methods to a
small set such as EAP-TLS and the EAP-FAST-MSCHAPv2 variant of
EAP-MSCHAPv2.  These EAP methods are the most commonly supported inner
methods in TEAP and are known to be interoperable among multiple
implementations.</t>
          <t indent="0" pn="section-3.6.5-2">Other EAP methods such as EAP-pwd, EAP-SIM, EAP-AKA, or EAP-AKA' can
be used within a TEAP tunnel.  Any EAP method that derives both MSK
and EMSK is likely to work as an Inner Method for TEAP, because
EAP-TLS has that behavior and it works.  EAP methods that derive
only MSK should work, as EAP-FAST-MSCHAPv2 has that behavior, and it
works.  Other EAP methods are untested and may or may not work.</t>
          <t indent="0" pn="section-3.6.5-3">Tunneled EAP methods such as PEAP <xref target="PEAP" format="default" sectionFormat="of" derivedContent="PEAP"/>, EAP-TTLS <xref target="RFC5281" format="default" sectionFormat="of" derivedContent="RFC5281"/>, and
EAP-FAST <xref target="RFC4851" format="default" sectionFormat="of" derivedContent="RFC4851"/> <bcp14>MUST NOT</bcp14> be used for inner EAP authentication.
There is no reason to have multiple layers of TLS in order to protect a
password exchange.</t>
          <t indent="0" pn="section-3.6.5-4">The EAP methods defined in <xref section="5" sectionFormat="comma" target="RFC3748" format="default" derivedLink="https://rfc-editor.org/rfc/rfc3748#section-5" derivedContent="RFC3748"/>, such as
MD5-Challenge, One-Time Password (OTP), and Generic Token Card (GTC),
do not derive an MSK or an EMSK and are vulnerable to on-path attacks.  The construction
of the OTP and GTC methods makes this attack less relevant, as the
information being sent is generally a one-time token. However, EAP-OTP
and EAP-GTC offer no benefit over the basic password authentication
defined in <xref target="inner-password" format="default" sectionFormat="of" derivedContent="Section 3.6.3"/>, which also does not perform crypto-binding of
the Inner Method to the TLS session.  These EAP methods are therefore
not useful as Phase 2 methods within TEAP.</t>
          <t indent="0" pn="section-3.6.5-5">Other EAP methods are less widely used and highly likely to not work
as the inner EAP method for TEAP.</t>
          <t indent="0" pn="section-3.6.5-6">In order to protect from on-path attacks, TEAP implementations <bcp14>MUST NOT</bcp14> permit the use of inner EAP methods that fail to perform
crypto-binding of the Inner Method to the TLS session.</t>
          <t indent="0" pn="section-3.6.5-7">Implementations <bcp14>MUST NOT</bcp14> permit resumption for the inner EAP methods
such as EAP-TLS.  If the user or machine needs to be authenticated, it
should use a method that provides full authentication.  If the user or machine needs
to do resumption, it can perform a full authentication once and then
rely on the outer TLS session for resumption.  This restriction
applies also to all TLS-based EAP methods that can tunnel other EAP
methods.  As a result, this document updates <xref target="RFC9427" format="default" sectionFormat="of" derivedContent="RFC9427"/>.</t>
          <t indent="0" pn="section-3.6.5-8">In general, the reason to use a non-TLS-based EAP method inside of a
TLS-based EAP method such as TEAP is for privacy.  Many previous EAP
methods may leak information about user identity, and those leaks are
prevented by running the method inside of a protected TLS tunnel.</t>
          <t indent="0" pn="section-3.6.5-9">EAP-TLS is permitted in Phase 2 for two use cases.  The first use case is when
TLS 1.2 is used, as the client certificate is not protected as with
TLS 1.3. It is therefore <bcp14>RECOMMENDED</bcp14> that when TLS 1.3 is used for
   the outer TEAP exchange, the client certificate is sent in Phase 1
   instead of doing EAP-TLS in Phase 2. This behavior will simplify the
   authentication exchange and use fewer round trips than doing EAP-TLS
   inside of TEAP.</t>
          <t indent="0" pn="section-3.6.5-10">The second use case for EAP-TLS in Phase 2 is where both the user and
machine use client certificates for authentication.  Since TLS permits
only one client certificate to be presented, only one certificate can
be used in Phase 1.  The second certificate is then presented via
EAP-TLS in Phase 2.</t>
          <t indent="0" pn="section-3.6.5-11">For basic password authentication, it is <bcp14>RECOMMENDED</bcp14> that this method
be only used for the exchange of one-time passwords.  The existence of
password-based EAP methods such as EAP-pwd (<xref target="RFC5931" format="default" sectionFormat="of" derivedContent="RFC5931"/> and
<xref target="RFC8146" format="default" sectionFormat="of" derivedContent="RFC8146"/>) makes most cleartext password exchanges unnecessary.
The updates to EAP-pwd in <xref target="RFC8146" format="default" sectionFormat="of" derivedContent="RFC8146"/> permit it to be used with
databases that store passwords in "salted" form, which greatly
increases security.</t>
          <t indent="0" pn="section-3.6.5-12">Where no Inner Method provides an EMSK, the Crypto-Binding TLV
offers little protection, as it cannot tie the inner EMSK to the TLS
session via the TLS-PRF.  As a result, the TEAP session will be
vulnerable to on-path active attacks.  Implementations and deployments
<bcp14>SHOULD</bcp14> adopt various mitigation strategies described in <xref section="3.2" sectionFormat="comma" target="RFC7029" format="default" derivedLink="https://rfc-editor.org/rfc/rfc7029#section-3.2" derivedContent="RFC7029"/>.  Implementations also need to implement the Inner Method
ordering described in <xref target="key-derivations" format="default" sectionFormat="of" derivedContent="Section 6.1"/> in order to fully prevent on-path attacks.</t>
        </section>
        <section anchor="protected-termination" numbered="true" removeInRFC="false" toc="include" pn="section-3.6.6">
          <name slugifiedName="name-protected-termination-and-a">Protected Termination and Acknowledged Result Indication</name>
          <t indent="0" pn="section-3.6.6-1">A successful TEAP Phase 2 conversation <bcp14>MUST</bcp14> always end in a
successful Crypto-Binding TLV and Result TLV exchange.  A TEAP server
may initiate the Crypto-Binding TLV and Result TLV exchange without
initiating any Inner Methods in TEAP Phase 2.  After the final
Result TLV exchange, the TLS tunnel is terminated, and a cleartext
EAP Success or EAP Failure is sent by the server.  Peers implementing
TEAP <bcp14>MUST NOT</bcp14> accept a cleartext EAP Success or Failure packet prior
to the peer and server reaching synchronized protected result
indication.</t>
          <t indent="0" pn="section-3.6.6-2">The Crypto-Binding TLV exchange is used to prove that both the peer
and server participated in the tunnel establishment and sequence of
authentications.  It also provides verification of the TEAP type,
version negotiated, and Outer TLVs exchanged before the TLS tunnel
establishment.  Except as noted below, the Crypto-Binding TLV <bcp14>MUST</bcp14> be exchanged and verified
before the final Result TLV exchange, regardless of whether or not
there is an Inner Method.  The Crypto-Binding TLV
and Intermediate-Result TLV <bcp14>MUST</bcp14> be included to perform cryptographic
binding after each successful authentication in a sequence of one or more
Inner Methods.  The server may send the final Result TLV along with an
Intermediate-Result TLV and a Crypto-Binding TLV to indicate its
intention to end the conversation.  If the peer requires nothing more
from the server, it will respond with a Result TLV indicating success
accompanied by a Crypto-Binding TLV and Intermediate-Result TLV if
necessary.  The server then tears down the tunnel and sends a
cleartext EAP Success or EAP Failure.</t>
          <t indent="0" pn="section-3.6.6-3">If the peer receives a Result TLV indicating success from the server,
but its authentication policies are not satisfied (for example, it
requires a particular authentication mechanism to be run), it may request further action from the server using
the Request-Action TLV.  The Request-Action TLV is sent with a Status
field indicating what EAP Success/Failure result the peer would
expect if the requested action is not granted.  The value of the
Action field indicates what the peer would like to do next.  The
format and values for the Request-Action TLV are defined in
<xref target="request-action-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.9"/>.</t>
          <t indent="0" pn="section-3.6.6-4">Upon receiving the Request-Action TLV, the server may process the
request or ignore it, based on its policy.  If the server ignores the
request, it proceeds with termination of the tunnel and sends the
cleartext EAP Success or Failure message based on the Status field of
the peer's Request-Action TLV.  If the server honors and processes
the request, it continues with the requested action.  The
conversation completes with a Result TLV exchange.  The Result TLV
may be included with the TLV that completes the requested action.</t>
          <t indent="0" pn="section-3.6.6-5">Error handling for Phase 2 is discussed in <xref target="phase-2-errors" format="default" sectionFormat="of" derivedContent="Section 3.9.3"/>.</t>
        </section>
      </section>
      <section anchor="determining-peer-id-and-server-id" numbered="true" removeInRFC="false" toc="include" pn="section-3.7">
        <name slugifiedName="name-determining-peer-id-and-ser">Determining Peer-Id and Server-Id</name>
        <t indent="0" pn="section-3.7-1">The Peer-Id and Server-Id <xref target="RFC5247" format="default" sectionFormat="of" derivedContent="RFC5247"/> may be determined based on the
types of credentials used during either the TEAP tunnel creation or
authentication.  In the case of multiple peer authentications, all
authenticated peer identities and their corresponding identity types
(<xref target="identity-type-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.3"/>) need to be exported.  In the case of multiple server
authentications, all authenticated server identities need to be
exported.</t>
        <t indent="0" pn="section-3.7-2">When X.509 certificates are used for peer authentication, the Peer-Id
is determined by the subject and subjectAltName fields in the peer
certificate.  As noted in <xref target="RFC5280" format="default" sectionFormat="of" derivedContent="RFC5280"/>:</t>
        <blockquote pn="section-3.7-3">
          <t indent="0" pn="section-3.7-3.1">
The subject field identifies the entity associated with the public
key stored in the subject public key field.  The subject name <bcp14>MAY</bcp14>
be carried in the subject field and/or the subjectAltName
extension. . . . If subject naming information is present only in
the subjectAltName extension (e.g., a key bound only to an email
address or URI), then the subject name <bcp14>MUST</bcp14> be an empty sequence
and the subjectAltName extension <bcp14>MUST</bcp14> be critical.</t>
          <t indent="0" pn="section-3.7-3.2">Where it is non-empty, the subject field <bcp14>MUST</bcp14> contain an X.500
distinguished name (DN).</t>
        </blockquote>
        <t indent="0" pn="section-3.7-4">If an inner EAP authentication method is run, then the Peer-Id is obtained from that
inner EAP authentication method.</t>
        <t indent="0" pn="section-3.7-5">When the server uses an X.509 certificate to establish the TLS
tunnel, the Server-Id is determined in a similar fashion as stated
above for the Peer-Id, e.g., the subject and subjectAltName fields in
the server certificate define the Server-Id.</t>
      </section>
      <section anchor="teap-session-identifier" numbered="true" removeInRFC="false" toc="include" pn="section-3.8">
        <name slugifiedName="name-teap-session-identifier">TEAP Session Identifier</name>
        <t indent="0" pn="section-3.8-1">For TLS 1.2 and earlier, the EAP session identifier <xref target="RFC5247" format="default" sectionFormat="of" derivedContent="RFC5247"/> is constructed using the tls-unique
from the Phase 1 outer tunnel at the beginning of Phase 2 as
defined by <xref target="RFC5929" section="3.1" format="default" sectionFormat="of" derivedLink="https://rfc-editor.org/rfc/rfc5929#section-3.1" derivedContent="RFC5929"/>.  The Session-Id is defined as
follows:</t>
        <artwork align="left" pn="section-3.8-2">
   Session-Id = teap_type | tls-unique</artwork>
        <t indent="0" pn="section-3.8-3">Where:</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-3.8-4">
          <li pn="section-3.8-4.1">| denotes concatenation,</li>
          <li pn="section-3.8-4.2">teap_type is the EAP Type assigned to TEAP, and</li>
          <li pn="section-3.8-4.3">tls-unique = tls-unique from the Phase 1 outer tunnel at the
          beginning of Phase 2 as defined by <xref target="RFC5929" section="3.1" format="default" sectionFormat="of" derivedLink="https://rfc-editor.org/rfc/rfc5929#section-3.1" derivedContent="RFC5929"/>.</li>
        </ul>
        <t indent="0" pn="section-3.8-5">The Session-Id derivation for TLS 1.3 is given in <xref section="2.1" sectionFormat="comma" target="RFC9427" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9427#section-2.1" derivedContent="RFC9427"/></t>
      </section>
      <section anchor="error-handling" numbered="true" removeInRFC="false" toc="include" pn="section-3.9">
        <name slugifiedName="name-error-handling">Error Handling</name>
        <t indent="0" pn="section-3.9-1">TEAP uses the error-handling rules summarized below:</t>
        <ol spacing="normal" type="1" indent="adaptive" start="1" pn="section-3.9-2"><li pn="section-3.9-2.1" derivedCounter="1.">
            <t indent="0" pn="section-3.9-2.1.1">Errors in the outer EAP packet layer are handled as defined in
<xref target="outer-layer-errors" format="default" sectionFormat="of" derivedContent="Section 3.9.1"/>.</t>
          </li>
          <li pn="section-3.9-2.2" derivedCounter="2.">
            <t indent="0" pn="section-3.9-2.2.1">Errors in the TLS layer are communicated via TLS alert messages
in both phases of TEAP.</t>
          </li>
          <li pn="section-3.9-2.3" derivedCounter="3.">
            <t indent="0" pn="section-3.9-2.3.1">The Intermediate-Result TLVs carry success or failure indications
of the individual Inner Methods in TEAP Phase 2.  Errors within an
EAP conversation in Phase 2 are expected to be handled by the
individual EAP authentication methods.</t>
          </li>
          <li pn="section-3.9-2.4" derivedCounter="4.">
            <t indent="0" pn="section-3.9-2.4.1">Violations of the Inner TLV rules are handled using Result TLVs
together with Error TLVs.</t>
          </li>
          <li pn="section-3.9-2.5" derivedCounter="5.">
            <t indent="0" pn="section-3.9-2.5.1">Tunnel-compromised errors (errors caused by a failed or missing
Crypto-Binding) are handled using Result TLVs and Error TLVs.</t>
          </li>
        </ol>
        <section anchor="outer-layer-errors" numbered="true" removeInRFC="false" toc="include" pn="section-3.9.1">
          <name slugifiedName="name-outer-layer-errors">Outer-Layer Errors</name>
          <t indent="0" pn="section-3.9.1-1">Errors on the TEAP outer-packet layer are handled in the following
ways:</t>
          <ol spacing="normal" type="1" indent="adaptive" start="1" pn="section-3.9.1-2"><li pn="section-3.9.1-2.1" derivedCounter="1.">
              <t indent="0" pn="section-3.9.1-2.1.1">If Outer TLVs are invalid or contain unknown values, they will be
ignored.</t>
            </li>
            <li pn="section-3.9.1-2.2" derivedCounter="2.">
              <t indent="0" pn="section-3.9.1-2.2.1">The entire TEAP packet will be ignored if other fields (version,
length, flags, etc.) are inconsistent with this specification.</t>
            </li>
          </ol>
        </section>
        <section anchor="tls-layer-errors" numbered="true" removeInRFC="false" toc="include" pn="section-3.9.2">
          <name slugifiedName="name-tls-layer-errors">TLS Layer Errors</name>
          <t indent="0" pn="section-3.9.2-1">If the TEAP server detects an error at any point in the TLS handshake
or the TLS layer, the server <bcp14>SHOULD</bcp14> send a TEAP request encapsulating
a TLS record containing the appropriate TLS alert message rather than
immediately terminating the TEAP exchange so as to allow the peer to
inform the user of the cause of the failure.  The TEAP peer <bcp14>MUST</bcp14> send a TEAP response to
an alert message.  The EAP-Response packet sent by the peer <bcp14>SHOULD</bcp14> contain a TEAP response with a zero-length message.
The server <bcp14>MUST</bcp14> terminate the TEAP exchange with an EAP Failure
packet no matter what the client says.</t>
          <t indent="0" pn="section-3.9.2-2">If the TEAP peer detects an error at any point in the TLS layer, the
TEAP peer <bcp14>SHOULD</bcp14> send a TEAP response encapsulating a TLS record
containing the appropriate TLS alert message, which contains a zero-length message.  The server then <bcp14>MUST</bcp14> terminate the conversation with an EAP failure as discussed in the previous paragraph.</t>
          <t indent="0" pn="section-3.9.2-3">While TLS 1.3 <xref target="RFC8446" format="default" sectionFormat="of" derivedContent="RFC8446"/> allows for the TLS conversation to be restarted, it is not clear when that would be useful (or used) for TEAP.  Fatal TLS errors will cause the TLS conversation to fail.  Non-fatal TLS errors can likely be ignored entirely.  As a result, TEAP implementations <bcp14>MUST NOT</bcp14> permit TLS restarts.</t>
        </section>
        <section anchor="phase-2-errors" numbered="true" removeInRFC="false" toc="include" pn="section-3.9.3">
          <name slugifiedName="name-phase-2-errors">Phase 2 Errors</name>
          <t indent="0" pn="section-3.9.3-1">There are a large number of situations where errors can occur during
Phase 2 processing.  This section describes both errors and the
recommended processing of them.</t>
          <t indent="0" pn="section-3.9.3-2">When the server receives a Result TLV with a fatal Error TLV from the
peer, it <bcp14>MUST</bcp14> terminate the TLS tunnel and reply with an EAP Failure.</t>
          <t indent="0" pn="section-3.9.3-3">When the peer receives a Result TLV with a fatal Error TLV from the
server, it <bcp14>MUST</bcp14>  respond with a Result TLV indicating failure.
The server <bcp14>MUST</bcp14> discard any data it receives from the peer and reply
with an EAP Failure.  The final message from the peer is required by
the EAP state machine and serves only to allow the server to reply
to the peer with the EAP Failure.</t>
          <t indent="0" pn="section-3.9.3-4">The following items describe specific errors and processing in more
detail.</t>
          <dl spacing="normal" newline="true" indent="3" pn="section-3.9.3-5">
            <dt pn="section-3.9.3-5.1">Fatal Error processing a TLV:</dt>
            <dd pn="section-3.9.3-5.2">Any time the peer or the server finds a fatal error outside of the TLS
  layer during Phase 2 TLV processing, it <bcp14>MUST</bcp14> send a Result
  TLV of failure and an Error TLV using the most descriptive error code
  possible.</dd>
            <dt pn="section-3.9.3-5.3">Fatal Error during TLV Exchanges:</dt>
            <dd pn="section-3.9.3-5.4">For errors involving the processing of the sequence of exchanges, such
  as a violation of TLV rules (e.g., multiple EAP-Payload TLVs), the error
  code is Unexpected TLVs Exchanged.</dd>
            <dt pn="section-3.9.3-5.5">Fatal Error due to tunnel compromise:</dt>
            <dd pn="section-3.9.3-5.6">For errors involving a tunnel compromise, such as when the Crypto-Binding
  TLV fails validation, the error code is Tunnel Compromise Error.</dd>
            <dt pn="section-3.9.3-5.7">Non-Fatal Error due to Inner Method:</dt>
            <dd pn="section-3.9.3-5.8">
              <t indent="0" pn="section-3.9.3-5.8.1">If there is a non-fatal error while running the Inner Method, the
  receiving side <bcp14>SHOULD NOT</bcp14> silently drop the Inner Method
  exchange.  Instead, it <bcp14>SHOULD</bcp14> reply with an Error TLV
  using the most descriptive error code possible.</t>
              <t indent="0" pn="section-3.9.3-5.8.2">If there is no error code that matches the particular issue, then the
  value Inner Method Error (1001) <bcp14>SHOULD</bcp14> be used. This response
  is a positive indication that there was an error processing the current
  Inner Method.  The side receiving a non-fatal Error TLV <bcp14>MAY</bcp14>
  decide to start a new and different Inner Method instead or send back a
  Result TLV to terminate the TEAP authentication session.</t>
            </dd>
          </dl>
        </section>
      </section>
      <section anchor="fragmentation" numbered="true" removeInRFC="false" toc="include" pn="section-3.10">
        <name slugifiedName="name-fragmentation">Fragmentation</name>
        <t indent="0" pn="section-3.10-1">Fragmentation of EAP packets is discussed in <xref section="2.1.5" sectionFormat="comma" target="RFC5216" format="default" derivedLink="https://rfc-editor.org/rfc/rfc5216#section-2.1.5" derivedContent="RFC5216"/>.
There is no special handling of fragments for TEAP.</t>
      </section>
      <section anchor="services-requested-by-the-peer" numbered="true" removeInRFC="false" toc="include" pn="section-3.11">
        <name slugifiedName="name-services-requested-by-the-p">Services Requested by the Peer</name>
        <t indent="0" pn="section-3.11-1">Several TEAP operations, including server unauthenticated
provisioning, certificate provisioning, and channel binding, depend on
the peer trusting the TEAP server. If the peer trusts the provided
server certificate, then the server is authenticated.</t>
        <t indent="0" pn="section-3.11-2">Typically, this authentication process involves the peer
validating the certificate to a trust anchor by verifying that the server presenting the certificate holds the private key and confirming that the
entity named by the certificate is the intended server.  Server
authentication also occurs when the procedures in <xref target="phase1" format="default" sectionFormat="of" derivedContent="Section 3.2"/> are used
to resume a session where the peer and server were previously mutually
authenticated.  Alternatively, the server is deemed to be
authenticated if an inner EAP method provides mutual authentication
along with an MSK and/or EMSK.  The Inner Method <bcp14>MUST</bcp14> also provide for cryptographic
binding via the Compound Message Authentication Code (MAC), as
discussed in <xref target="crypto-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.13"/>.  This issue is further described in
<xref target="unauth-provisioning" format="default" sectionFormat="of" derivedContent="Section 3.11.3"/>.</t>
        <t indent="0" pn="section-3.11-3">TEAP peers <bcp14>MUST</bcp14> track whether or not server authentication has taken
place. When the server cannot be authenticated, the peer <bcp14>MUST NOT</bcp14>
request any services such as certificate provisioning (<xref target="cert-provisioning" format="default" sectionFormat="of" derivedContent="Section 3.11.1"/>) from it.</t>
        <t indent="0" pn="section-3.11-4">Unless the peer requests server unauthenticated provisioning, it <bcp14>MUST</bcp14>
authenticate the server and fail the current authentication
session. The authentication session fails if the server cannot be authenticated.</t>
        <t indent="0" pn="section-3.11-5">An additional complication arises when an Inner Method authenticates
multiple parties, such as authenticating both the peer machine and the
peer user to the EAP server.  Depending on how authentication is
achieved, only some of these parties may have confidence in it.  For
example, if a strong shared secret is used to mutually authenticate
the user and the EAP server, the machine may not have confidence that
the EAP server is the authenticated party if the machine cannot trust
the user not to disclose the shared secret to an attacker.  In these
cases, the parties who participate in the authentication need to be
considered when evaluating whether the peer should request these
services or whether the server should provide them.</t>
        <t indent="0" pn="section-3.11-6">The server <bcp14>MUST</bcp14> also authenticate the peer before providing these
services.  The alternative is to send provisioning data to
unauthenticated and potentially malicious peers, which can have
negative impacts on security.</t>
        <t indent="0" pn="section-3.11-7">When a device is provisioned via TEAP, any subsequent authorization
<bcp14>MUST</bcp14> be done on the authenticated credentials.  That is, there may be
no credentials (or anonymous credentials) passed in Phase 1, but there
will be credentials passed or provisioned in Phase 2.  If later
authorizations are done on the Phase 1 identity, then a device could
obtain the wrong authorization.  If authorization is done on
the authenticated credentials instead, then the device will obtain the correct
kind of network access.</t>
        <t indent="0" pn="section-3.11-8">The correct authorization must also be applied to any resumption, as
noted in <xref section="5.7" sectionFormat="comma" target="RFC9190" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9190#section-5.7" derivedContent="RFC9190"/>.  However, as it is possible in TEAP
for the credentials to change, the new credentials <bcp14>MUST</bcp14> be associated
with the session ticket.  If this association cannot be done, then the
server <bcp14>MUST</bcp14> invalidate any session tickets for the current session.
This invalidation will force a full re-authentication on any
subsequent connection; at which point, the correct authorization will
be associated with any session ticket.</t>
        <t indent="0" pn="section-3.11-9">Note that the act of re-provisioning a device is essentially
indistinguishable from any initial provisioning.  The device
authenticates and obtains new credentials via the standard
provisioning mechanisms.  The only caveat is that the device <bcp14>SHOULD NOT</bcp14> discard the old credentials unless either they are known to have
expired or the new credentials have been verified to work.</t>
        <section anchor="cert-provisioning" numbered="true" removeInRFC="false" toc="include" pn="section-3.11.1">
          <name slugifiedName="name-certificate-provisioning-wi">Certificate Provisioning Within the Tunnel</name>
          <t indent="0" pn="section-3.11.1-1">Provisioning of a peer's certificate is supported in TEAP by
          performing the Simple PKI Request/Response from <xref target="RFC5272" format="default" sectionFormat="of" derivedContent="RFC5272"/> using PKCS#10 and PKCS#7 TLVs, respectively.  A
          peer sends the Simple PKI Request using a PKCS#10 CertificationRequest
          <xref target="RFC2986" format="default" sectionFormat="of" derivedContent="RFC2986"/> encoded into the body of a PKCS#10 TLV (see
          <xref target="pkcs10-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.17"/>).  The TEAP server issues a Simple PKI
          Response using a PKCS#7 <xref target="RFC2315" format="default" sectionFormat="of" derivedContent="RFC2315"/> unsigned
          (i.e., degenerate) "Certificates Only" message encoded into the body
          of a PKCS#7 TLV (see <xref target="pkcs7-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.16"/>) only after an
          Inner Method has run and provided an identity proof on the peer
          prior to a certificate is being issued.</t>
          <t indent="0" pn="section-3.11.1-2">In order to provide linking identity and proof-of-possession by
including information specific to the current authenticated TLS
session within the signed certification request, the peer generating
the request <bcp14>SHOULD</bcp14> obtain the tls-unique value from the TLS subsystem
as defined in "Channel Bindings for TLS" <xref target="RFC5929" format="default" sectionFormat="of" derivedContent="RFC5929"/>.  The TEAP peer
operations between obtaining the tls-unique value through generation
of the Certification Signing Request (CSR) that contains the current
tls-unique value and the subsequent verification of this value by the
TEAP server are the "phases of the application protocol during which
application-layer authentication occurs" that are protected by the
synchronization interoperability mechanism described in the
interoperability note in "Channel Bindings for TLS" (<xref target="RFC5929" sectionFormat="comma" section="3.1" format="default" derivedLink="https://rfc-editor.org/rfc/rfc5929#section-3.1" derivedContent="RFC5929"/>).  When performing renegotiation, TLS
"secure_renegotiation" <xref target="RFC5746" format="default" sectionFormat="of" derivedContent="RFC5746"/> <bcp14>MUST</bcp14> be used.</t>
          <t indent="0" pn="section-3.11.1-3">The tls-unique value is base-64-encoded as specified in
<xref section="4" target="RFC4648" format="default" sectionFormat="of" derivedLink="https://rfc-editor.org/rfc/rfc4648#section-4" derivedContent="RFC4648"/>, and the resulting string is placed in the certification
request challengePassword field (<xref target="RFC2985" sectionFormat="comma" section="5.4.1" format="default" derivedLink="https://rfc-editor.org/rfc/rfc2985#section-5.4.1" derivedContent="RFC2985"/>).  The
challengePassword field is limited to 255 octets (<xref target="RFC5246" section="7.4.9" format="default" sectionFormat="of" derivedLink="https://rfc-editor.org/rfc/rfc5246#section-7.4.9" derivedContent="RFC5246"/> indicates that no existing cipher suite would result in an
issue with this limitation).  If tls-unique information is not
embedded within the certification request, the challengePassword
field <bcp14>MUST</bcp14> be empty to indicate that the peer did not include the
optional channel-binding information (any value submitted is verified
by the server as tls-unique information).</t>
          <t indent="0" pn="section-3.11.1-4">The server <bcp14>SHOULD</bcp14> verify the tls-unique information.  This ensures that the
signed certificate request is being presented by an authenticated TEAP peer
that is in possession of the private key.</t>
          <t indent="0" pn="section-3.11.1-5">The Simple PKI Request/Response generation and processing rules of
<xref target="RFC5272" format="default" sectionFormat="of" derivedContent="RFC5272"/> <bcp14>SHALL</bcp14> apply to TEAP, with the exception of error
conditions.  In the event of an error, the TEAP server <bcp14>SHOULD</bcp14> respond
with an Error TLV using the most descriptive error code possible; it
<bcp14>MAY</bcp14> ignore the PKCS#10 request that generated the error.</t>
        </section>
        <section anchor="certificate-content-and-uses" numbered="true" removeInRFC="false" toc="include" pn="section-3.11.2">
          <name slugifiedName="name-certificate-content-and-use">Certificate Content and Uses</name>
          <t indent="0" pn="section-3.11.2-1">It is not enough to verify that the CSR provided by the peer to the
authenticator is from an authenticated user.  The CSR itself should
also be examined by the authenticator or CA
before any certificate is issued.</t>
          <t indent="0" pn="section-3.11.2-2">The format of a CSR is complex and contains a substantial amount of
information.  That information could be incorrect, such as a user
claiming a wrong physical address, email address, etc.  It is <bcp14>RECOMMENDED</bcp14> that systems provisioning these certificates
validate that the CSR contains the expected data and that
it does not contain unexpected data.  For example, a CA could refuse
to issue the certificate if the CSR contained unknown fields or if a
known field contained an unexpected or invalid value.  The CA can modify or refuse a particular CSR to address these deficiencies for any
reasons, including local site policy.  We note that the "A" in "CA" means for "Authority", while the "R" in "CSR" means "Request".  There is no requirement for a CA to sign any and all CSRs that are presented to it.</t>
          <t indent="0" pn="section-3.11.2-3">Once an EAP peer receives the signed certificate, the peer could
potentially be (ab)used for in TLS contexts other than TEAP.  For example,
the certificate could be used with EAP-TLS, or even with HTTPS.  It is
<bcp14>NOT RECOMMENDED</bcp14> to use certificates provisioned via TEAP for
any non-TEAP.  One method of enforcing this
restriction is to have different CAs (or different intermediate CAs)
that issue certificates for different uses.  For example, TLS-based
EAP methods could share one CA, and even use different intermediary CAs for different TLS-based EAP methods.  HTTPS servers could use an
entirely different CA.  The different protocols could then be configured
to validate client certificates only from their preferred CA, which would prevent peers from using certificates outside of the intended use case.</t>
          <t indent="0" pn="section-3.11.2-4">Another method of limiting the uses of a certificate is to provision
it with an appropriate value for the Extended Key Purpose field
<xref target="RFC7299" format="default" sectionFormat="of" derivedContent="RFC7299"/>.  For example, the id-kp-eapOverLAN <xref target="RFC4334" format="default" sectionFormat="of" derivedContent="RFC4334"/> value
could be used to indicate that this certificate is intended for use
only with EAP.</t>
          <t indent="0" pn="section-3.11.2-5">It is difficult to give more detailed recommendations than the above.
Each CA or organization may have its own local policy as to what is
permitted or forbidden in a certificate.  All we can do in this
document is to highlight the issues and make the reader aware that
they have to be addressed.</t>
        </section>
        <section anchor="unauth-provisioning" numbered="true" removeInRFC="false" toc="include" pn="section-3.11.3">
          <name slugifiedName="name-server-unauthenticated-prov">Server Unauthenticated Provisioning Mode</name>
          <t indent="0" pn="section-3.11.3-1">In Server Unauthenticated Provisioning Mode, an unauthenticated
tunnel is established in Phase 1, and the peer and server negotiate
an Inner Method or methods in Phase 2.  This Inner Method <bcp14>MUST</bcp14> support mutual authentication, provide key
derivation, and be resistant to attacks such as on-path and
dictionary attacks.  In most cases, this Inner Method will be an EAP authentication method.  Example Inner Methods that satisfy these criteria include EAP-pwd <xref target="RFC5931" format="default" sectionFormat="of" derivedContent="RFC5931"/>
and EAP-EKE <xref target="RFC6124" format="default" sectionFormat="of" derivedContent="RFC6124"/> but not EAP-FAST-MSCHAPv2.</t>
          <t indent="0" pn="section-3.11.3-2">This provisioning mode enables the bootstrapping
of peers when the peer lacks the ability to authenticate the server
during Phase 1.  This includes both cases in which the cipher suite
negotiated does not provide authentication and in which the
cipher suite negotiated provides the authentication, but the peer is
unable to validate the identity of the server for some reason.</t>
          <t indent="0" pn="section-3.11.3-3">Upon successful completion of the Inner Method in Phase 2, the peer and
server exchange a Crypto-Binding TLV to bind the Inner Method with
the outer tunnel and ensure that an on-path attack has not
been attempted.</t>
          <t indent="0" pn="section-3.11.3-4">Support for the Server Unauthenticated Provisioning Mode is optional.
The cipher suite TLS_DH_anon_WITH_AES_128_CBC_SHA is <bcp14>RECOMMENDED</bcp14> when
using Server Unauthenticated Provisioning Mode, but other anonymous
cipher suites <bcp14>MAY</bcp14> be supported as long as the TLS pre-master secret is
generated from contribution from both peers.</t>
          <t indent="0" pn="section-3.11.3-5">When a strong Inner Method is not used with Server Unauthenticated
Provisioning Mode, it is possible for an attacker to perform an
on-path attack.  In effect, Server Unauthenticated
Provisioning Mode has similar security issues as just running the
Inner Method in the open without the protection of TLS.  All of the
information in the tunnel should be assumed to be visible to, and
modifiable by, an attacker.</t>
          <t indent="0" pn="section-3.11.3-6">Implementations <bcp14>SHOULD</bcp14> exchange minimal data in Server
Unauthenticated Provisioning Mode.  Instead, they should use that mode
to set up a secure/authenticated tunnel and then use that tunnel to
perform any needed data exchange.</t>
          <t indent="0" pn="section-3.11.3-7">It is <bcp14>RECOMMENDED</bcp14> that client implementations and deployments
authenticate TEAP servers if at all possible.  Authenticating the
server means that a client can be provisioned securely with no chance of
an attacker eaves-dropping on the connection.</t>
          <t indent="0" pn="section-3.11.3-8">Note that server unauthenticated provisioning can only use anonymous
cipher suites in TLS 1.2 and earlier.  These cipher suites have been
deprecated in TLS 1.3 (<xref section="C.5" sectionFormat="comma" target="RFC8446" format="default" derivedLink="https://rfc-editor.org/rfc/rfc8446#appendix-C.5" derivedContent="RFC8446"/>).  For TLS 1.3, the
server <bcp14>MUST</bcp14> provide a certificate, and the peer performs server
unauthenticated provisioning by not validating the certificate chain
or any of its contents.</t>
        </section>
        <section anchor="channel-binding" numbered="true" removeInRFC="false" toc="include" pn="section-3.11.4">
          <name slugifiedName="name-channel-binding">Channel Binding</name>
          <t indent="0" pn="section-3.11.4-1"><xref target="RFC6677" format="default" sectionFormat="of" derivedContent="RFC6677"/> defines channel bindings for EAP that solve the "lying NAS" and
the "lying provider" problems, using a process in which the EAP peer
gives information about the characteristics of the service provided
by the authenticator to the Authentication, Authorization, and
Accounting (AAA) server protected within the EAP authentication method.  This allows
the server to verify the authenticator is providing information to
the peer that is consistent with the information received from this
authenticator as well as the information stored about this
authenticator.</t>
          <t indent="0" pn="section-3.11.4-2">TEAP supports EAP channel binding using the Channel-Binding TLV
defined in <xref target="channel-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.7"/>.  If the TEAP server wants to request the
channel-binding information from the peer, it sends an empty
Channel-Binding TLV to indicate the request.  The peer responds to the
request by sending a Channel-Binding TLV containing a channel-binding
message as defined in <xref target="RFC6677" format="default" sectionFormat="of" derivedContent="RFC6677"/>.  The server validates the
channel-binding message and sends back a Channel-Binding TLV with a result
code.  If the server did not initiate the channel-binding request and
the peer still wants to send the channel-binding information to the
server, it can do that by using the Request-Action TLV along with the
Channel-Binding TLV.  The peer <bcp14>MUST</bcp14> only send channel-binding
information after it has successfully authenticated the server and
established the protected tunnel.</t>
        </section>
      </section>
    </section>
    <section anchor="message-formats" numbered="true" removeInRFC="false" toc="include" pn="section-4">
      <name slugifiedName="name-message-formats">Message Formats</name>
      <t indent="0" pn="section-4-1">The following sections describe the message formats used in TEAP.
The fields are transmitted from left to right in network byte order.</t>
      <section anchor="teap-message-format" numbered="true" removeInRFC="false" toc="include" pn="section-4.1">
        <name slugifiedName="name-teap-message-format">TEAP Message Format</name>
        <t indent="0" pn="section-4.1-1">A summary of the TEAP Request/Response packet format is shown below.</t>
        <artwork align="left" pn="section-4.1-2">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Code      |   Identifier  |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Type      |   Flags | Ver |        Message Length         :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
:         Message Length        |         Outer TLV Length
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
:     Outer TLV Length          |         TLS Data...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       Outer TLVs...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
        <dl spacing="normal" newline="true" indent="3" pn="section-4.1-3">
          <dt pn="section-4.1-3.1">Code</dt>
          <dd pn="section-4.1-3.2">
            <t indent="0" pn="section-4.1-3.2.1">The Code field is one octet in length and is defined as follows:</t>
            <dl spacing="normal" newline="false" indent="3" pn="section-4.1-3.2.2">
              <dt pn="section-4.1-3.2.2.1">1</dt>
              <dd pn="section-4.1-3.2.2.2">Request</dd>
              <dt pn="section-4.1-3.2.2.3">2</dt>
              <dd pn="section-4.1-3.2.2.4">Response</dd>
            </dl>
          </dd>
          <dt pn="section-4.1-3.3">Identifier</dt>
          <dd pn="section-4.1-3.4">The Identifier field is one octet and aids in matching responses with
  requests.  The Identifier field <bcp14>MUST</bcp14> be changed on each
  Request packet.  The Identifier field in the Response packet
  <bcp14>MUST</bcp14> match the Identifier field from the corresponding
  request.</dd>
          <dt pn="section-4.1-3.5">Length</dt>
          <dd pn="section-4.1-3.6">The Length field is two octets and indicates the length of the EAP
  packet including the Code, Identifier, Length, Type, Flags, Ver, Message
  Length, TLS Data, and Outer TLVs fields.  Octets outside the range of the
  Length field should be treated as Data Link Layer padding and should be
  ignored on reception.</dd>
          <dt pn="section-4.1-3.7">Type</dt>
          <dd pn="section-4.1-3.8">55 for TEAP</dd>
          <dt pn="section-4.1-3.9">Flags</dt>
          <dd pn="section-4.1-3.10">
            <artwork align="left" pn="section-4.1-3.10.1">
 0 1 2 3 4
+-+-+-+-+-+
|L M S O R|
+-+-+-+-+-+</artwork>
            <dl spacing="normal" newline="false" indent="3" pn="section-4.1-3.10.2">
              <dt pn="section-4.1-3.10.2.1">L</dt>
              <dd pn="section-4.1-3.10.2.2">Length included; set to indicate the presence of the four-octet
    Message Length field.  It <bcp14>MUST</bcp14> be present for the first
    fragment of a fragmented message.  It <bcp14>MUST NOT</bcp14> be present
    for any other message.</dd>
              <dt pn="section-4.1-3.10.2.3">M</dt>
              <dd pn="section-4.1-3.10.2.4">More fragments; set on all but the last fragment.</dd>
              <dt pn="section-4.1-3.10.2.5">S</dt>
              <dd pn="section-4.1-3.10.2.6">TEAP start; set in a TEAP Start message sent from the server to the
    peer.</dd>
              <dt pn="section-4.1-3.10.2.7">O</dt>
              <dd pn="section-4.1-3.10.2.8">Outer TLV length included; set to indicate the presence of the
    four-octet Outer TLV Length field.  It <bcp14>MUST</bcp14> be present only
    in the initial request and response messages.  If the initial message is
    fragmented, then it <bcp14>MUST</bcp14> be present only on the first
    fragment.</dd>
              <dt pn="section-4.1-3.10.2.9">R</dt>
              <dd pn="section-4.1-3.10.2.10">Reserved (<bcp14>MUST</bcp14> be zero and ignored upon receipt)</dd>
            </dl>
          </dd>
          <dt pn="section-4.1-3.11">Ver</dt>
          <dd pn="section-4.1-3.12">This field contains the version of the protocol.  This document
  describes version 1 (001 in binary) of TEAP.</dd>
          <dt pn="section-4.1-3.13">Message Length</dt>
          <dd pn="section-4.1-3.14">The Message Length field is four octets and is present only if the L bit
  is set.  This field provides the total length of the message that may be
  fragmented over the data fields of multiple packets.</dd>
          <dt pn="section-4.1-3.15">Outer TLV Length</dt>
          <dd pn="section-4.1-3.16">The Outer TLV Length field is four octets and is present only if the O
  bit is set.  This field provides the total length of the Outer TLVs if
  present.</dd>
          <dt pn="section-4.1-3.17">TLS Data</dt>
          <dd pn="section-4.1-3.18">When the TLS Data field is present, it consists of an encapsulated TLS
  packet in TLS record format.  A TEAP packet with Flags and Version fields,
  but with zero length TLS Data field, is used to indicate TEAP acknowledgment
  for either a fragmented message, a TLS Alert message, or a TLS Finished
  message.</dd>
          <dt pn="section-4.1-3.19">Outer TLVs</dt>
          <dd pn="section-4.1-3.20">The Outer TLVs consist of the optional data used to help establish the
  TLS tunnel in TLV format.  They are only allowed in the first two messages
  in the TEAP.  That is the first EAP-server-to-peer message and
  first peer-to-EAP-server message.  The start of the Outer TLVs can be
  derived from the EAP Length field and Outer TLV Length field.</dd>
        </dl>
      </section>
      <section anchor="teap-tlv-format" numbered="true" removeInRFC="false" toc="include" pn="section-4.2">
        <name slugifiedName="name-teap-tlv-format-and-support">TEAP TLV Format and Support</name>
        <t indent="0" pn="section-4.2-1">The TLVs defined here are TLV objects.  The TLV objects could be used
to carry arbitrary parameters between an EAP peer and EAP server
within the protected TLS tunnel.</t>
        <t indent="0" pn="section-4.2-2">The EAP peer may not necessarily implement all the TLVs supported by
the EAP server.  To allow for interoperability, TLVs are designed to
allow an EAP server to discover if a TLV is supported by the EAP peer
using the NAK TLV.  The mandatory bit in a TLV indicates whether
support of the TLV is required.  If the peer or server does not
support a TLV marked mandatory, then it <bcp14>MUST</bcp14> send a NAK TLV in the
response, and all the other TLVs in the message <bcp14>MUST</bcp14> be ignored.  If
an EAP peer or server finds an unsupported TLV that is marked as
optional, it can ignore the unsupported TLV.  It <bcp14>MUST</bcp14> only send a NAK
TLV for a TLV that is marked mandatory but is not understood and <bcp14>MUST NOT</bcp14> otherwise send a NAK TLV.  If all TLVs in a message
are marked optional and none are understood by the peer, then a Result TLV <bcp14>SHOULD</bcp14> be sent to the other side in order to
continue the conversation.  It is also possible to send a NAK TLV when all TLVs in a message are marked optional.</t>
        <t indent="0" pn="section-4.2-3">Note that a peer or server may support a TLV with the mandatory bit
set but may not understand the contents.  The appropriate response to
a supported TLV with content that is not understood is defined by the
individual TLV specification.</t>
        <t indent="0" pn="section-4.2-4">EAP implementations compliant with this specification <bcp14>MUST</bcp14> support
TLV exchanges as well as the processing of mandatory/optional
settings on the TLV.  Implementations conforming to this
specification <bcp14>MUST</bcp14> support the following TLVs:</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-4.2-5">
          <li pn="section-4.2-5.1">
            <t indent="0" pn="section-4.2-5.1.1">Authority-ID TLV</t>
          </li>
          <li pn="section-4.2-5.2">
            <t indent="0" pn="section-4.2-5.2.1">Identity-Type TLV</t>
          </li>
          <li pn="section-4.2-5.3">
            <t indent="0" pn="section-4.2-5.3.1">Result TLV</t>
          </li>
          <li pn="section-4.2-5.4">
            <t indent="0" pn="section-4.2-5.4.1">NAK TLV</t>
          </li>
          <li pn="section-4.2-5.5">
            <t indent="0" pn="section-4.2-5.5.1">Error TLV</t>
          </li>
          <li pn="section-4.2-5.6">
            <t indent="0" pn="section-4.2-5.6.1">Request-Action TLV</t>
          </li>
          <li pn="section-4.2-5.7">
            <t indent="0" pn="section-4.2-5.7.1">EAP-Payload TLV</t>
          </li>
          <li pn="section-4.2-5.8">
            <t indent="0" pn="section-4.2-5.8.1">Intermediate-Result TLV</t>
          </li>
          <li pn="section-4.2-5.9">
            <t indent="0" pn="section-4.2-5.9.1">Crypto-Binding TLV</t>
          </li>
          <li pn="section-4.2-5.10">
            <t indent="0" pn="section-4.2-5.10.1">Basic-Password-Auth-Req TLV</t>
          </li>
          <li pn="section-4.2-5.11">
            <t indent="0" pn="section-4.2-5.11.1">Basic-Password-Auth-Resp TLV</t>
          </li>
        </ul>
        <section anchor="general-tlv-format" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.1">
          <name slugifiedName="name-general-tlv-format">General TLV Format</name>
          <t indent="0" pn="section-4.2.1-1">TLVs are defined as described below.  The fields are transmitted from
left to right.</t>
          <t indent="0" pn="section-4.2.1-2">If a peer or server receives a TLV that is not of the correct format,
the TLV <bcp14>MUST</bcp14> be discarded.  It is generally useful to log an error or
debugging message that indicates which TLV had an issue and what the
problem is.  However, TLVs that are malformed are invalid and cannot
be used.</t>
          <artwork align="left" pn="section-4.2.1-3">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|            TLV Type       |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                              Value...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.1-4">
            <dt pn="section-4.2.1-4.1">M</dt>
            <dd pn="section-4.2.1-4.2">
              <dl spacing="normal" newline="false" indent="3" pn="section-4.2.1-4.2.1">
                <dt pn="section-4.2.1-4.2.1.1">0</dt>
                <dd pn="section-4.2.1-4.2.1.2">Optional TLV</dd>
                <dt pn="section-4.2.1-4.2.1.3">1</dt>
                <dd pn="section-4.2.1-4.2.1.4">Mandatory TLV</dd>
              </dl>
            </dd>
            <dt pn="section-4.2.1-4.3">R</dt>
            <dd pn="section-4.2.1-4.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.1-4.5">TLV Type</dt>
            <dd pn="section-4.2.1-4.6">
              <t indent="0" pn="section-4.2.1-4.6.1">A 14-bit field, denoting the TLV type.  Allocated types include:</t>
              <dl spacing="normal" newline="false" indent="3" pn="section-4.2.1-4.6.2">
                <dt pn="section-4.2.1-4.6.2.1">0</dt>
                <dd pn="section-4.2.1-4.6.2.2">Unassigned</dd>
                <dt pn="section-4.2.1-4.6.2.3">1</dt>
                <dd pn="section-4.2.1-4.6.2.4">Authority-ID TLV (<xref target="authority-id-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.2"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.5">2</dt>
                <dd pn="section-4.2.1-4.6.2.6">Identity-Type TLV (<xref target="identity-type-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.3"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.7">3</dt>
                <dd pn="section-4.2.1-4.6.2.8">Result TLV (<xref target="result-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.4"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.9">4</dt>
                <dd pn="section-4.2.1-4.6.2.10">NAK TLV (<xref target="nak-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.5"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.11">5</dt>
                <dd pn="section-4.2.1-4.6.2.12">Error TLV (<xref target="error-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.6"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.13">6</dt>
                <dd pn="section-4.2.1-4.6.2.14">Channel-Binding TLV (<xref target="channel-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.7"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.15">7</dt>
                <dd pn="section-4.2.1-4.6.2.16">Vendor-Specific TLV (<xref target="vendor-specific-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.8"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.17">8</dt>
                <dd pn="section-4.2.1-4.6.2.18">Request-Action TLV (<xref target="request-action-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.9"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.19">9</dt>
                <dd pn="section-4.2.1-4.6.2.20">EAP-Payload TLV (<xref target="eap-payload-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.10"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.21">10</dt>
                <dd pn="section-4.2.1-4.6.2.22">Intermediate-Result TLV (<xref target="intermediate-result-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.11"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.23">11</dt>
                <dd pn="section-4.2.1-4.6.2.24">PAC TLV (DEPRECATED)</dd>
                <dt pn="section-4.2.1-4.6.2.25">12</dt>
                <dd pn="section-4.2.1-4.6.2.26">Crypto-Binding TLV (<xref target="crypto-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.13"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.27">13</dt>
                <dd pn="section-4.2.1-4.6.2.28">Basic-Password-Auth-Req TLV (<xref target="bp-auth-req-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.14"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.29">14</dt>
                <dd pn="section-4.2.1-4.6.2.30">Basic-Password-Auth-Resp TLV (<xref target="bp-auth-resp-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.15"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.31">15</dt>
                <dd pn="section-4.2.1-4.6.2.32">PKCS#7 TLV (<xref target="pkcs7-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.16"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.33">16</dt>
                <dd pn="section-4.2.1-4.6.2.34">PKCS#10 TLV (<xref target="pkcs10-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.17"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.35">17</dt>
                <dd pn="section-4.2.1-4.6.2.36">Trusted-Server-Root TLV (<xref target="trusted-server-root-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.18"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.37">18</dt>
                <dd pn="section-4.2.1-4.6.2.38">CSR-Attributes TLV (<xref target="csr-attributes-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.19"/>)</dd>
                <dt pn="section-4.2.1-4.6.2.39">19</dt>
                <dd pn="section-4.2.1-4.6.2.40">Identity-Hint TLV (<xref target="identity-hint-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.20"/>)</dd>
              </dl>
            </dd>
            <dt pn="section-4.2.1-4.7">Length</dt>
            <dd pn="section-4.2.1-4.8">The length of the Value field in octets.</dd>
            <dt pn="section-4.2.1-4.9">Value</dt>
            <dd pn="section-4.2.1-4.10">The value of the TLV.</dd>
          </dl>
        </section>
        <section anchor="authority-id-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.2">
          <name slugifiedName="name-authority-id-tlv">Authority-ID TLV</name>
          <artwork align="left" pn="section-4.2.2-1">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                              ID...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.2-2">
            <dt pn="section-4.2.2-2.1">M</dt>
            <dd pn="section-4.2.2-2.2">0 - Optional TLV</dd>
            <dt pn="section-4.2.2-2.3">R</dt>
            <dd pn="section-4.2.2-2.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.2-2.5">TLV Type</dt>
            <dd pn="section-4.2.2-2.6">1 - Authority-ID</dd>
            <dt pn="section-4.2.2-2.7">Length</dt>
            <dd pn="section-4.2.2-2.8">The Length field is two octets and contains the length of the ID field
  in octets.</dd>
            <dt pn="section-4.2.2-2.9">ID</dt>
            <dd pn="section-4.2.2-2.10">Hint of the identity of the server to help the peer to match the
  credentials available for the server.  It should be unique across the
  deployment.</dd>
          </dl>
        </section>
        <section anchor="identity-type-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.3">
          <name slugifiedName="name-identity-type-tlv">Identity-Type TLV</name>
          <t indent="0" pn="section-4.2.3-1">The Identity-Type TLV allows an EAP server to send a hint to help the
EAP peer select the right type of identity, for example, user or
machine.  TEAPv1 implementations <bcp14>MUST</bcp14> support this TLV.  Only one
Identity-Type TLV <bcp14>SHOULD</bcp14> be present in the TEAP request or response
packet.</t>
          <t indent="0" pn="section-4.2.3-2">A server sending the Identity-Type TLV <bcp14>MUST</bcp14> also
include an EAP-Payload TLV or a Basic-Password-Auth-Resp TLV.  A
peer sending an Identity-Type TLV <bcp14>MUST</bcp14> also include
EAP-Payload TLV or a Basic-Password-Auth-Resp TLV.</t>
          <t indent="0" pn="section-4.2.3-3">An EAP peer receiving an Identity-Type request
<bcp14>SHOULD</bcp14> respond with an Identity-Type TLV with the requested type.  If
the Identity-Type field does not contain one of the known values, or
if the EAP peer does not have an identity corresponding to the
identity type requested, then the peer <bcp14>SHOULD</bcp14> respond with an
Identity-Type TLV with the one of available identity types.</t>
          <t indent="0" pn="section-4.2.3-4">A server receiving an Identity-Type in the response <bcp14>MUST</bcp14> check if the
value of the Identity-Type in the response matches the value of the
Identity-Type that was sent in the request.  A match means that the
server can proceed with authentication.</t>
          <t indent="0" pn="section-4.2.3-5">However, if the values do not match, the server can proceed with
authentication if and only if the following two conditions match.  If
either of the following two conditions does not match, the server <bcp14>MUST</bcp14>
respond with a Result TLV of Failure.</t>
          <ol spacing="normal" type="1" indent="adaptive" start="1" pn="section-4.2.3-6">
<li pn="section-4.2.3-6.1" derivedCounter="1.">
              <t indent="0" pn="section-4.2.3-6.1.1">The Identity-Type contains a value permitted by the server configuration.</t>
            </li>
            <li pn="section-4.2.3-6.2" derivedCounter="2.">
              <t indent="0" pn="section-4.2.3-6.2.1">The Identity-Type value was not previously used for a successful authentication.</t>
            </li>
          </ol>
          <t indent="0" pn="section-4.2.3-7">The first condition allows a server to be configured to permit only
user authentication, or else only machine authentication.  A server
could also use an Identity-Hint TLV sent in the response to permit
different types of authentication for different identities.  A server
could also permit or forbid different kinds of authentication based on
other information, such an outer EAP Identity, fields in an outer
EAP client certificate, or other fields received in a RADIUS or
Diameter packet along with the TEAP session.  There is no requirement
that a server has to support both user and machine authentication for
all TEAP sessions.</t>
          <t indent="0" pn="section-4.2.3-8">The second condition ensures that if a particular Inner Method
succeeds, the server does not attempt a subsequent Inner Method for
the same Identity-Type.  For example, if a user is authenticated via
an Inner Method of EAP-TLS, there is no benefit to also requesting
additional authentication via a different Inner Method.  Similarly,
there is no benefit to repeating an authentication sessions for the
same user; the result will not change.</t>
          <t indent="0" pn="section-4.2.3-9">This second condition also forbids multiple rounds of challenge/response authentication via the Basic-Password-Auth-Req TLV.  TEAPv1
supports only one round of Basic-Password-Auth-Req followed by
Basic-Password-Auth-Resp.  The result of that round <bcp14>MUST NOT</bcp14> be
another Basic-Password-Auth-Req TLV.</t>
          <t indent="0" pn="section-4.2.3-10">This second condition also means that a server <bcp14>MUST NOT</bcp14> send an
Identity-Hint TLV that has the same value as was previously used for
a successful authentication.</t>
          <t indent="0" pn="section-4.2.3-11">The Identity-Type TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.3-12">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Identity-Type         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.3-13">
            <dt pn="section-4.2.3-13.1">M</dt>
            <dd pn="section-4.2.3-13.2">Mandatory, set to one (1)</dd>
            <dt pn="section-4.2.3-13.3">R</dt>
            <dd pn="section-4.2.3-13.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.3-13.5">TLV Type</dt>
            <dd pn="section-4.2.3-13.6">2 - Identity-Type TLV</dd>
            <dt pn="section-4.2.3-13.7">Length</dt>
            <dd pn="section-4.2.3-13.8">2</dd>
            <dt pn="section-4.2.3-13.9">Identity-Type</dt>
            <dd pn="section-4.2.3-13.10">
              <t indent="0" pn="section-4.2.3-13.10.1">The Identity-Type field is two octets.  Values include:</t>
              <dl spacing="normal" newline="false" indent="3" pn="section-4.2.3-13.10.2">
                <dt pn="section-4.2.3-13.10.2.1">1</dt>
                <dd pn="section-4.2.3-13.10.2.2">User</dd>
                <dt pn="section-4.2.3-13.10.2.3">2</dt>
                <dd pn="section-4.2.3-13.10.2.4">Machine</dd>
              </dl>
            </dd>
          </dl>
        </section>
        <section anchor="result-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.4">
          <name slugifiedName="name-result-tlv">Result TLV</name>
          <t indent="0" pn="section-4.2.4-1">The Result TLV provides support for acknowledged success and failure
messages for protected termination within TEAP.  If the Status field
does not contain one of the known values, then the peer or EAP server
<bcp14>MUST</bcp14> treat this as a fatal error of Unexpected TLVs Exchanged.  The
behavior of the Result TLV is further discussed in Sections <xref target="protected-termination" format="counter" sectionFormat="of" derivedContent="3.6.6"/> and
	  <xref target="phase-2-errors" format="counter" sectionFormat="of" derivedContent="3.9.3"/>.</t>
          <t indent="0" pn="section-4.2.4-2">A Result TLV indicating failure <bcp14>MUST NOT</bcp14> be accompanied by
the following TLVs: NAK, EAP-Payload, or Crypto-Binding.</t>
          <t indent="0" pn="section-4.2.4-3">A Result TLV indicating success <bcp14>MUST</bcp14> be accompanied by a Crypto-Binding TLV.</t>
          <t indent="0" pn="section-4.2.4-4">The Result TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.4-5">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|             Status            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.4-6">
            <dt pn="section-4.2.4-6.1">M</dt>
            <dd pn="section-4.2.4-6.2">Mandatory, set to one (1)</dd>
            <dt pn="section-4.2.4-6.3">R</dt>
            <dd pn="section-4.2.4-6.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.4-6.5">TLV Type</dt>
            <dd pn="section-4.2.4-6.6">3 - Result TLV</dd>
            <dt pn="section-4.2.4-6.7">Length</dt>
            <dd pn="section-4.2.4-6.8">2</dd>
            <dt pn="section-4.2.4-6.9">Status</dt>
            <dd pn="section-4.2.4-6.10">
              <t indent="0" pn="section-4.2.4-6.10.1">The Status field is two octets.  Values include:</t>
              <dl spacing="normal" newline="false" indent="3" pn="section-4.2.4-6.10.2">
                <dt pn="section-4.2.4-6.10.2.1">1</dt>
                <dd pn="section-4.2.4-6.10.2.2">Success</dd>
                <dt pn="section-4.2.4-6.10.2.3">2</dt>
                <dd pn="section-4.2.4-6.10.2.4">Failure</dd>
              </dl>
            </dd>
          </dl>
        </section>
        <section anchor="nak-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.5">
          <name slugifiedName="name-nak-tlv">NAK TLV</name>
          <t indent="0" pn="section-4.2.5-1">The NAK TLV allows a peer to detect TLVs that are not supported by
 the other peer.  A TEAP packet can contain 0 or more NAK TLVs.  A NAK
 TLV should not be accompanied by other TLVs.  A NAK TLV <bcp14>MUST NOT</bcp14> be
 sent in response to a message containing a Result TLV, instead a
 Result TLV of failure should be sent indicating failure and an Error
 TLV of Unexpected TLVs Exchanged.  The NAK TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.5-2">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                          Vendor-Id                            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|            NAK-Type           |           TLVs...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.5-3">
            <dt pn="section-4.2.5-3.1">M</dt>
            <dd pn="section-4.2.5-3.2">Mandatory, set to one (1)</dd>
            <dt pn="section-4.2.5-3.3">R</dt>
            <dd pn="section-4.2.5-3.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.5-3.5">TLV Type</dt>
            <dd pn="section-4.2.5-3.6">4 - NAK TLV</dd>
            <dt pn="section-4.2.5-3.7">Length</dt>
            <dd pn="section-4.2.5-3.8">&gt;=6</dd>
            <dt pn="section-4.2.5-3.9">Vendor-Id</dt>
            <dd pn="section-4.2.5-3.10">The Vendor-Id field is four octets and contains the Vendor-Id of the TLV
  that was not supported.  The high-order octet is 0, and the low-order three
  octets are the Structure of Management Information (SMI) Network Management
  Private Enterprise Number of the Vendor in network byte order.  The
  Vendor-Id field <bcp14>MUST</bcp14> be zero for TLVs that are not
  Vendor-Specific TLVs.</dd>
            <dt pn="section-4.2.5-3.11">NAK-Type</dt>
            <dd pn="section-4.2.5-3.12">The NAK-Type field is two octets.  The field contains the type of the
  TLV that was not supported.  A TLV of this type <bcp14>MUST</bcp14> have
  been included in the previous packet.</dd>
            <dt pn="section-4.2.5-3.13">TLVs</dt>
            <dd pn="section-4.2.5-3.14">This field contains a list of zero or more TLVs, each of which
  <bcp14>MUST NOT</bcp14> have the mandatory bit set.  These optional TLVs are
  for future extensibility to communicate why the offending TLV was determined
  to be unsupported.</dd>
          </dl>
        </section>
        <section anchor="error-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.6">
          <name slugifiedName="name-error-tlv">Error TLV</name>
          <t indent="0" pn="section-4.2.6-1">The Error TLV allows an EAP peer or server to indicate errors to the
other party.  A TEAP packet can contain 0 or more Error TLVs.  The
Error-Code field describes the type of error.  Error codes 1-999
represent successful outcomes (informative messages), 1000-1999
represent warnings, and 2000-2999 represent fatal errors.  A fatal
Error TLV <bcp14>MUST</bcp14> be accompanied by a Result TLV indicating failure, and
the conversation is terminated as described in <xref target="phase-2-errors" format="default" sectionFormat="of" derivedContent="Section 3.9.3"/>.</t>
          <t indent="0" pn="section-4.2.6-2">Many of the error codes below refer to errors in Inner Method
processing that may be retrieved if made available by the inner
method.  Implementations <bcp14>MUST</bcp14> take care that error messages do not
reveal too much information to an attacker.  For example, the usage
of error message 1031 (User account credentials incorrect) is
<bcp14>NOT RECOMMENDED</bcp14>, because it allows an attacker to determine valid
usernames by differentiating this response from other responses.  It
should only be used for troubleshooting purposes.</t>
          <t indent="0" pn="section-4.2.6-3">The Error TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.6-4">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                           Error-Code                          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.6-5">
            <dt pn="section-4.2.6-5.1">M</dt>
            <dd pn="section-4.2.6-5.2">Mandatory, set to one (1)</dd>
            <dt pn="section-4.2.6-5.3">R</dt>
            <dd pn="section-4.2.6-5.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.6-5.5">TLV Type</dt>
            <dd pn="section-4.2.6-5.6">5 - Error TLV</dd>
            <dt pn="section-4.2.6-5.7">Length</dt>
            <dd pn="section-4.2.6-5.8">4</dd>
            <dt pn="section-4.2.6-5.9">Error-Code</dt>
            <dd pn="section-4.2.6-5.10">
              <t indent="0" pn="section-4.2.6-5.10.1">The Error-Code field is four octets.  Currently defined values for
    Error-Code include:</t>
              <dl spacing="normal" newline="false" indent="3" pn="section-4.2.6-5.10.2">
                <dt pn="section-4.2.6-5.10.2.1">1</dt>
                <dd pn="section-4.2.6-5.10.2.2">User account expires soon</dd>
                <dt pn="section-4.2.6-5.10.2.3">2</dt>
                <dd pn="section-4.2.6-5.10.2.4">User account credential expires soon</dd>
                <dt pn="section-4.2.6-5.10.2.5">3</dt>
                <dd pn="section-4.2.6-5.10.2.6">User account authorizations change soon</dd>
                <dt pn="section-4.2.6-5.10.2.7">4</dt>
                <dd pn="section-4.2.6-5.10.2.8">Clock skew detected</dd>
                <dt pn="section-4.2.6-5.10.2.9">5</dt>
                <dd pn="section-4.2.6-5.10.2.10">Contact administrator</dd>
                <dt pn="section-4.2.6-5.10.2.11">6</dt>
                <dd pn="section-4.2.6-5.10.2.12">User account credentials change required</dd>
                <dt pn="section-4.2.6-5.10.2.13">1001</dt>
                <dd pn="section-4.2.6-5.10.2.14">Inner Method Error</dd>
                <dt pn="section-4.2.6-5.10.2.15">1002</dt>
                <dd pn="section-4.2.6-5.10.2.16">Unspecified authentication infrastructure problem</dd>
                <dt pn="section-4.2.6-5.10.2.17">1003</dt>
                <dd pn="section-4.2.6-5.10.2.18">  Unspecified authentication failure</dd>
                <dt pn="section-4.2.6-5.10.2.19">1004</dt>
                <dd pn="section-4.2.6-5.10.2.20">  Unspecified authorization failure</dd>
                <dt pn="section-4.2.6-5.10.2.21">1005</dt>
                <dd pn="section-4.2.6-5.10.2.22">  User account credentials unavailable</dd>
                <dt pn="section-4.2.6-5.10.2.23">1006</dt>
                <dd pn="section-4.2.6-5.10.2.24">  User account expired</dd>
                <dt pn="section-4.2.6-5.10.2.25">1007</dt>
                <dd pn="section-4.2.6-5.10.2.26">  User account locked: try again later</dd>
                <dt pn="section-4.2.6-5.10.2.27">1008</dt>
                <dd pn="section-4.2.6-5.10.2.28">  User account locked: admin intervention required</dd>
                <dt pn="section-4.2.6-5.10.2.29">1009</dt>
                <dd pn="section-4.2.6-5.10.2.30">  Authentication infrastructure unavailable</dd>
                <dt pn="section-4.2.6-5.10.2.31">1010</dt>
                <dd pn="section-4.2.6-5.10.2.32">  Authentication infrastructure not trusted</dd>
                <dt pn="section-4.2.6-5.10.2.33">1011</dt>
                <dd pn="section-4.2.6-5.10.2.34">  Clock skew too great</dd>
                <dt pn="section-4.2.6-5.10.2.35">1012</dt>
                <dd pn="section-4.2.6-5.10.2.36">  Invalid inner realm</dd>
                <dt pn="section-4.2.6-5.10.2.37">1013</dt>
                <dd pn="section-4.2.6-5.10.2.38">  Token out of sync: administrator intervention required</dd>
                <dt pn="section-4.2.6-5.10.2.39">1014</dt>
                <dd pn="section-4.2.6-5.10.2.40">  Token out of sync: PIN change required</dd>
                <dt pn="section-4.2.6-5.10.2.41">1015</dt>
                <dd pn="section-4.2.6-5.10.2.42">  Token revoked</dd>
                <dt pn="section-4.2.6-5.10.2.43">1016</dt>
                <dd pn="section-4.2.6-5.10.2.44">  Tokens exhausted</dd>
                <dt pn="section-4.2.6-5.10.2.45">1017</dt>
                <dd pn="section-4.2.6-5.10.2.46">  Challenge expired</dd>
                <dt pn="section-4.2.6-5.10.2.47">1018</dt>
                <dd pn="section-4.2.6-5.10.2.48">  Challenge algorithm mismatch</dd>
                <dt pn="section-4.2.6-5.10.2.49">1019</dt>
                <dd pn="section-4.2.6-5.10.2.50">  Client certificate not supplied</dd>
                <dt pn="section-4.2.6-5.10.2.51">1020</dt>
                <dd pn="section-4.2.6-5.10.2.52">  Client certificate rejected</dd>
                <dt pn="section-4.2.6-5.10.2.53">1021</dt>
                <dd pn="section-4.2.6-5.10.2.54">  Realm mismatch between inner and outer identity</dd>
                <dt pn="section-4.2.6-5.10.2.55">1022</dt>
                <dd pn="section-4.2.6-5.10.2.56">  Unsupported Algorithm In Certificate Signing Request</dd>
                <dt pn="section-4.2.6-5.10.2.57">1023</dt>
                <dd pn="section-4.2.6-5.10.2.58">  Unsupported Extension In Certificate Signing Request</dd>
                <dt pn="section-4.2.6-5.10.2.59">1024</dt>
                <dd pn="section-4.2.6-5.10.2.60">  Bad Identity In Certificate Signing Request</dd>
                <dt pn="section-4.2.6-5.10.2.61">1025</dt>
                <dd pn="section-4.2.6-5.10.2.62">  Bad Certificate Signing Request</dd>
                <dt pn="section-4.2.6-5.10.2.63">1026</dt>
                <dd pn="section-4.2.6-5.10.2.64">  Internal CA Error</dd>
                <dt pn="section-4.2.6-5.10.2.65">1027</dt>
                <dd pn="section-4.2.6-5.10.2.66">  General PKI Error</dd>
                <dt pn="section-4.2.6-5.10.2.67">1028</dt>
                <dd pn="section-4.2.6-5.10.2.68">  Inner Method's channel-binding data required but not
      supplied</dd>
                <dt pn="section-4.2.6-5.10.2.69">1029</dt>
                <dd pn="section-4.2.6-5.10.2.70"> Inner Method's channel-binding data did not include
      required information</dd>
                <dt pn="section-4.2.6-5.10.2.71">1030</dt>
                <dd pn="section-4.2.6-5.10.2.72">  Inner Method's channel binding failed</dd>
                <dt pn="section-4.2.6-5.10.2.73">1031</dt>
                <dd pn="section-4.2.6-5.10.2.74">  User account credentials incorrect [USAGE <bcp14>NOT RECOMMENDED</bcp14>]</dd>
                <dt pn="section-4.2.6-5.10.2.75">1032</dt>
                <dd pn="section-4.2.6-5.10.2.76">  Inner Method not supported</dd>
                <dt pn="section-4.2.6-5.10.2.77">2001</dt>
                <dd pn="section-4.2.6-5.10.2.78">  Tunnel Compromise Error</dd>
                <dt pn="section-4.2.6-5.10.2.79">2002</dt>
                <dd pn="section-4.2.6-5.10.2.80">  Unexpected TLVs Exchanged</dd>
                <dt pn="section-4.2.6-5.10.2.81">2003</dt>
                <dd pn="section-4.2.6-5.10.2.82">  The Crypto-Binding TLV is invalid (Version, Received-Ver, or Sub-Type)</dd>
                <dt pn="section-4.2.6-5.10.2.83">2004</dt>
                <dd pn="section-4.2.6-5.10.2.84">  The first Inner Method did not derive EMSK</dd>
                <dt pn="section-4.2.6-5.10.2.85">2005</dt>
                <dd pn="section-4.2.6-5.10.2.86">  The Crypto-Binding TLV did not include a required MSK Compound MAC</dd>
                <dt pn="section-4.2.6-5.10.2.87">2006</dt>
                <dd pn="section-4.2.6-5.10.2.88">  The MSK Compound MAC fails verification</dd>
                <dt pn="section-4.2.6-5.10.2.89">2007</dt>
                <dd pn="section-4.2.6-5.10.2.90">  The Crypto-Binding TLV did not include a required EMSK Compound MAC</dd>
                <dt pn="section-4.2.6-5.10.2.91">2008</dt>
                <dd pn="section-4.2.6-5.10.2.92">  The EMSK Compound MAC fails verification</dd>
                <dt pn="section-4.2.6-5.10.2.93">2009</dt>
                <dd pn="section-4.2.6-5.10.2.94">  The EMSK Compound MAC exists, but the Inner Method did not derive EMSK</dd>
              </dl>
            </dd>
          </dl>
        </section>
        <section anchor="channel-binding-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.7">
          <name slugifiedName="name-channel-binding-tlv">Channel-Binding TLV</name>
          <t indent="0" pn="section-4.2.7-1">The Channel-Binding TLV provides a mechanism for carrying
channel-binding data from the peer to the EAP server and a channel-binding
response from the EAP server to the peer as described in <xref target="RFC6677" format="default" sectionFormat="of" derivedContent="RFC6677"/>.
TEAPv1 implementations <bcp14>MAY</bcp14> support this TLV, which cannot be
responded to with a NAK TLV.  If the Channel-Binding data field does
not contain one of the known values or if the EAP server does not
support this TLV, then the server <bcp14>MUST</bcp14> ignore the value.  The
Channel-Binding TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.7-2">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|            Data ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.7-3">
            <dt pn="section-4.2.7-3.1">M</dt>
            <dd pn="section-4.2.7-3.2">0 - Optional TLV</dd>
            <dt pn="section-4.2.7-3.3">R</dt>
            <dd pn="section-4.2.7-3.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.7-3.5">TLV Type</dt>
            <dd pn="section-4.2.7-3.6">6 - Channel-Binding TLV</dd>
            <dt pn="section-4.2.7-3.7">Length</dt>
            <dd pn="section-4.2.7-3.8">variable</dd>
            <dt pn="section-4.2.7-3.9">Data</dt>
            <dd pn="section-4.2.7-3.10">The data field contains a channel-binding message as defined in 
  <xref target="RFC6677" section="5.3" format="default" sectionFormat="of" derivedLink="https://rfc-editor.org/rfc/rfc6677#section-5.3" derivedContent="RFC6677"/>.</dd>
          </dl>
        </section>
        <section anchor="vendor-specific-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.8">
          <name slugifiedName="name-vendor-specific-tlv">Vendor-Specific TLV</name>
          <t indent="0" pn="section-4.2.8-1">The Vendor-Specific TLV is available to allow vendors to support
their own extended attributes not suitable for general usage.  A
Vendor-Specific TLV attribute can contain one or more TLVs, referred
to as Vendor TLVs.  The TLV type of a particular Vendor TLV is defined by the
vendor.  All the Vendor TLVs inside a single Vendor-Specific TLV
belong to the same vendor.  There can be multiple Vendor-Specific
TLVs from different vendors in the same message.  Error handling in
the Vendor TLV could use the vendor's own specific error-handling
mechanism or use the standard TEAP error codes defined.</t>
          <t indent="0" pn="section-4.2.8-2">Vendor TLVs may be optional or mandatory.  Vendor TLVs sent with
Result TLVs <bcp14>MUST</bcp14> be marked as optional.  If the Vendor-Specific TLV
is marked as mandatory, then it is expected that the receiving side
needs to recognize the vendor ID, parse all Vendor TLVs within, and
deal with error handling within the Vendor-Specific TLV as defined by
the vendor.</t>
          <t indent="0" pn="section-4.2.8-3">Where a Vendor-Specific TLV carries an authentication protocol in the
Inner Method, it <bcp14>MUST</bcp14> define values for MSK and EMSK.  Where these
values cannot be derived from cryptographic primitives, they <bcp14>MUST</bcp14> be
set to zero, as happens when Basic-Password-Auth-Req is used.</t>
          <t indent="0" pn="section-4.2.8-4">The Vendor-Specific TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.8-5">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                          Vendor-Id                            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                         Vendor TLVs....
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.8-6">
            <dt pn="section-4.2.8-6.1">M</dt>
            <dd pn="section-4.2.8-6.2">0 or 1</dd>
            <dt pn="section-4.2.8-6.3">R</dt>
            <dd pn="section-4.2.8-6.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.8-6.5">TLV Type</dt>
            <dd pn="section-4.2.8-6.6">7 - Vendor-Specific TLV</dd>
            <dt pn="section-4.2.8-6.7">Length</dt>
            <dd pn="section-4.2.8-6.8">4 + cumulative length of all included Vendor TLVs</dd>
            <dt pn="section-4.2.8-6.9">Vendor-Id</dt>
            <dd pn="section-4.2.8-6.10">The Vendor-Id field is four octets and contains the Vendor-Id of the
  TLV.  The high-order octet is 0, and the low-order 3 octets are the SMI
  Network Management Private Enterprise Number of the Vendor in network byte
  order.</dd>
            <dt pn="section-4.2.8-6.11">Vendor TLVs</dt>
            <dd pn="section-4.2.8-6.12">This field is of indefinite length.  It contains Vendor-Specific TLVs,
  in a format defined by the vendor.</dd>
          </dl>
        </section>
        <section anchor="request-action-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.9">
          <name slugifiedName="name-request-action-tlv">Request-Action TLV</name>
          <t indent="0" pn="section-4.2.9-1">The Request-Action TLV <bcp14>MAY</bcp14> be sent at any time.  The Request-Action
TLV allows the peer or server to request that the other side negotiates
additional Inner Methods or process TLVs that are passed inside of
the Request-Action TLV.</t>
          <t indent="0" pn="section-4.2.9-2">The receiving side <bcp14>MUST</bcp14> process this TLV.  The processing for the TLV
is as follows:</t>
          <t indent="3" pn="section-4.2.9-3">The receiving entity <bcp14>MAY</bcp14> choose to process any of the TLVs that
are included in the message.</t>
          <t indent="3" pn="section-4.2.9-4">If the receiving entity chooses NOT to process any TLV in the
list, then it sends back a Result TLV with the same code in the
Status field of the Request-Action TLV.</t>
          <t indent="3" pn="section-4.2.9-5">If multiple Request-Action TLVs are in the request, the session
can continue if any of the TLVs in any Request-Action TLV are
processed.</t>
          <t indent="3" pn="section-4.2.9-6">If multiple Request-Action TLVs are in the request and none of
them is processed, then the most fatal status should be used in
the Result TLV returned.  If a status code in the Request-Action
TLV is not understood by the receiving entity, then it <bcp14>SHOULD</bcp14> be
treated as a fatal error.  Otherwise, the receiving entity <bcp14>MAY</bcp14> send a Request-Action TLV containing an Error TLV of value 2002 (Unexpected TLVs Exchanged).</t>
          <t indent="3" pn="section-4.2.9-7">After processing the TLVs or Inner Method in the request, another
round of Result TLV exchange <bcp14>MUST</bcp14> occur to synchronize the final
status on both sides.</t>
          <t indent="0" pn="section-4.2.9-8">The peer or the server <bcp14>MAY</bcp14> send multiple Request-Action TLVs to the
other side.  Two Request-Action TLVs <bcp14>MUST NOT</bcp14> occur in the same TEAP
packet if they have the same Status value.  The order of processing
multiple Request-Action TLVs is implementation dependent.  If the
receiving side processes the optional (non-fatal) items first, it is
possible that the fatal items will disappear at a later time.  If the
receiving side processes the fatal items first, the communication
time will be shorter.</t>
          <t indent="0" pn="section-4.2.9-9">The peer or the server <bcp14>MAY</bcp14> return a new set of Request-Action TLVs
after one or more of the requested items have been processed and the
other side has signaled it wants to end the EAP conversation.</t>
          <t indent="0" pn="section-4.2.9-10">The Request-Action TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.9-11">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Status   |      Action    |                TLVs....
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+--+-+-+-+-+-+-+-+-+-+-+-+-</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.9-12">
            <dt pn="section-4.2.9-12.1">M</dt>
            <dd pn="section-4.2.9-12.2">Mandatory, set to one (1)</dd>
            <dt pn="section-4.2.9-12.3">R</dt>
            <dd pn="section-4.2.9-12.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.9-12.5">TLV Type</dt>
            <dd pn="section-4.2.9-12.6">8 - Request-Action TLV</dd>
            <dt pn="section-4.2.9-12.7">Length</dt>
            <dd pn="section-4.2.9-12.8">2 + cumulative length of all included TLVs</dd>
            <dt pn="section-4.2.9-12.9">Status</dt>
            <dd pn="section-4.2.9-12.10">
              <t indent="0" pn="section-4.2.9-12.10.1">The Status field is one octet.  This indicates the result if the party
  who receives this TLV does not process the action. Values include:</t>
              <dl spacing="normal" newline="false" indent="3" pn="section-4.2.9-12.10.2">
                <dt pn="section-4.2.9-12.10.2.1">1</dt>
                <dd pn="section-4.2.9-12.10.2.2">Success</dd>
                <dt pn="section-4.2.9-12.10.2.3">2</dt>
                <dd pn="section-4.2.9-12.10.2.4">Failure</dd>
              </dl>
            </dd>
            <dt pn="section-4.2.9-12.11">Action</dt>
            <dd pn="section-4.2.9-12.12">
              <t indent="0" pn="section-4.2.9-12.12.1">The Action field is one octet.  Values include:</t>
              <dl spacing="normal" newline="false" indent="3" pn="section-4.2.9-12.12.2">
                <dt pn="section-4.2.9-12.12.2.1">1</dt>
                <dd pn="section-4.2.9-12.12.2.2">Process-TLV</dd>
                <dt pn="section-4.2.9-12.12.2.3">2</dt>
                <dd pn="section-4.2.9-12.12.2.4">Negotiate-EAP</dd>
              </dl>
            </dd>
            <dt pn="section-4.2.9-12.13">TLVs</dt>
            <dd pn="section-4.2.9-12.14">This field is of indefinite length.  It contains TLVs that the peer
  wants the server to process.</dd>
          </dl>
        </section>
        <section anchor="eap-payload-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.10">
          <name slugifiedName="name-eap-payload-tlv">EAP-Payload TLV</name>
          <t indent="0" pn="section-4.2.10-1">To allow coalescing an EAP request or response with other TLVs, the
EAP-Payload TLV is defined, which includes an encapsulated EAP packet
and a list of optional TLVs.  The optional TLVs are provided for
future extensibility to provide hints about the current EAP
authentication.  Only one EAP-Payload TLV is allowed in a message.
The EAP-Payload TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.10-2">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                          EAP packet...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                             TLVs...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.10-3">
            <dt pn="section-4.2.10-3.1">M</dt>
            <dd pn="section-4.2.10-3.2">Mandatory, set to one (1)</dd>
            <dt pn="section-4.2.10-3.3">R</dt>
            <dd pn="section-4.2.10-3.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.10-3.5">TLV Type</dt>
            <dd pn="section-4.2.10-3.6">9 - EAP-Payload TLV</dd>
            <dt pn="section-4.2.10-3.7">Length</dt>
            <dd pn="section-4.2.10-3.8">length of embedded EAP packet + cumulative length of additional TLVs</dd>
            <dt pn="section-4.2.10-3.9">EAP packet</dt>
            <dd pn="section-4.2.10-3.10">This field contains a complete EAP packet, including the EAP header
  (Code, Identifier, Length, Type) fields.  The length of this field is
  determined by the Length field of the encapsulated EAP packet.</dd>
            <dt pn="section-4.2.10-3.11">TLVs</dt>
            <dd pn="section-4.2.10-3.12">This (optional) field contains a list of TLVs associated with the EAP
  packet field.  The TLVs <bcp14>MUST NOT</bcp14> have the mandatory bit set.
  The total length of this field is equal to the Length field of the
  EAP-Payload TLV, minus the Length field in the EAP header of the EAP packet
  field.</dd>
          </dl>
        </section>
        <section anchor="intermediate-result-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.11">
          <name slugifiedName="name-intermediate-result-tlv">Intermediate-Result TLV</name>
          <t indent="0" pn="section-4.2.11-1">The Intermediate-Result TLV signals
intermediate Success and Failure messages for all inner
methods.  The Intermediate-Result TLV <bcp14>MUST</bcp14> be used for all Inner Methods.</t>
          <t indent="0" pn="section-4.2.11-2">An Intermediate-Result TLV indicating success
<bcp14>MUST</bcp14> be accompanied by a Crypto-Binding TLV.</t>
          <t indent="0" pn="section-4.2.11-3">An Intermediate-Result TLV indicating failure <bcp14>SHOULD</bcp14> be accompanied by an Error TLV that indicates why the authentication failed.</t>
          <t indent="0" pn="section-4.2.11-4">The optional TLVs
associated with this TLV are provided for future extensibility to
provide hints about the current result.  The Intermediate-Result TLV
is defined as follows:</t>
          <artwork align="left" pn="section-4.2.11-5">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|             Status            |        TLVs...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.11-6">
            <dt pn="section-4.2.11-6.1">M</dt>
            <dd pn="section-4.2.11-6.2">Mandatory, set to one (1)</dd>
            <dt pn="section-4.2.11-6.3">R</dt>
            <dd pn="section-4.2.11-6.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.11-6.5">TLV Type</dt>
            <dd pn="section-4.2.11-6.6">10 - Intermediate-Result TLV</dd>
            <dt pn="section-4.2.11-6.7">Length</dt>
            <dd pn="section-4.2.11-6.8">2 + cumulative length of the embedded associated TLVs</dd>
            <dt pn="section-4.2.11-6.9">Status</dt>
            <dd pn="section-4.2.11-6.10">
              <t indent="0" pn="section-4.2.11-6.10.1">The Status field is two octets.  Values include:</t>
              <dl newline="false" spacing="normal" indent="3" pn="section-4.2.11-6.10.2">
                <dt pn="section-4.2.11-6.10.2.1">1</dt>
                <dd pn="section-4.2.11-6.10.2.2">Success</dd>
                <dt pn="section-4.2.11-6.10.2.3">2</dt>
                <dd pn="section-4.2.11-6.10.2.4">Failure</dd>
              </dl>
            </dd>
            <dt pn="section-4.2.11-6.11">TLVs</dt>
            <dd pn="section-4.2.11-6.12">This field is of indeterminate length and contains zero or more of the
  TLVs associated with the Intermediate Result TLV.  The TLVs in this field
  <bcp14>MUST NOT</bcp14> have the mandatory bit set.</dd>
          </dl>
        </section>
        <section anchor="pac-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.12">
          <name slugifiedName="name-pac-tlv">PAC TLV</name>
          <t indent="0" pn="section-4.2.12-1"><xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/> defined a Protected Access Credential (PAC) to mirror
EAP-FAST <xref target="RFC4851" format="default" sectionFormat="of" derivedContent="RFC4851"/>.  However, implementation experience and analysis
determined that the PAC was not necessary.  Instead, TEAP performs
session resumption using the NewSessionTicket message as defined in Sections 
<xref section="2.1.2" sectionFormat="bare" target="RFC9190" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9190#section-2.1.2" derivedContent="RFC9190"/> and <xref section="2.1.3" sectionFormat="bare" target="RFC9190" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9190#section-2.1.3" derivedContent="RFC9190"/> of <xref target="RFC9190" format="default" sectionFormat="of" derivedContent="RFC9190"/>.  As such, the PAC TLV
has been deprecated.</t>
          <t indent="0" pn="section-4.2.12-2">As the PAC TLV is deprecated, an entity receiving it <bcp14>SHOULD</bcp14> send a
Result TLV indicating failure and an Error TLV of Unexpected TLVs
Exchanged.</t>
        </section>
        <section anchor="crypto-binding-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.13">
          <name slugifiedName="name-crypto-binding-tlv">Crypto-Binding TLV</name>
          <t indent="0" pn="section-4.2.13-1">The Crypto-Binding TLV is used to prove that both the peer and server
participated in the tunnel establishment and sequence of
authentications.  It also provides verification of the TEAP type,
version negotiated, and Outer TLVs exchanged before the TLS tunnel
establishment.</t>
          <t indent="0" pn="section-4.2.13-2">A Crypto-Binding <bcp14>MUST</bcp14> be accompanied by an Intermediate-Result TLV
indicating success.</t>
          <t indent="0" pn="section-4.2.13-3">The Crypto-Binding TLV <bcp14>MUST</bcp14> be exchanged and validated before any
Intermediate-Result or Result TLV value is examined, regardless of
whether there is an Inner Method or not.  It <bcp14>MUST</bcp14> be
included with the Intermediate-Result TLV to perform cryptographic
binding after each successful Inner Method in a sequence of inner
methods, before proceeding with another Inner Method.  If no MSK or
EMSK has been generated and a Crypto-Binding TLV is required, then the
MSK Compound MAC field contains the MAC using keys generated according
to <xref target="computing-compound-mac" format="default" sectionFormat="of" derivedContent="Section 6.3"/>.</t>
          <t indent="0" pn="section-4.2.13-4">The Crypto-Binding TLV is valid only if the following checks pass on
its contents:</t>
          <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-4.2.13-5">
            <li pn="section-4.2.13-5.1">
              <t indent="0" pn="section-4.2.13-5.1.1">The Version field contain a known value.</t>
            </li>
            <li pn="section-4.2.13-5.2">
              <t indent="0" pn="section-4.2.13-5.2.1">The Received-Ver field matches the TEAP version sent by the receiver during the EAP version negotiation.</t>
            </li>
            <li pn="section-4.2.13-5.3">
              <t indent="0" pn="section-4.2.13-5.3.1">The Sub-Type field is set to the correct value for this exchange.</t>
            </li>
            <li pn="section-4.2.13-5.4">
              <t indent="0" pn="section-4.2.13-5.4.1">The Flags field is set to a known value.</t>
            </li>
            <li pn="section-4.2.13-5.5">
              <t indent="0" pn="section-4.2.13-5.5.1">The Compound MAC(s) verify correctly.</t>
            </li>
          </ul>
          <t indent="0" pn="section-4.2.13-6">If any of the above checks fails, then the TLV is invalid.  An
invalid Crypto-Binding TLV is a fatal error and is handled as
described in <xref target="phase-2-errors" format="default" sectionFormat="of" derivedContent="Section 3.9.3"/></t>
          <t indent="0" pn="section-4.2.13-7">See <xref target="cryptographic-calculations" format="default" sectionFormat="of" derivedContent="Section 6"/> for a more detailed discussion of
how the Compound MAC fields are constructed and verified.</t>
          <t indent="0" pn="section-4.2.13-8">The Crypto-Binding TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.13-9">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Reserved   |    Version    |  Received-Ver.| Flags|Sub-Type|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
~                             Nonce                             ~
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
~                   EMSK Compound MAC                           ~
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
~                    MSK Compound MAC                           ~
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.13-10">
            <dt pn="section-4.2.13-10.1">M</dt>
            <dd pn="section-4.2.13-10.2">Mandatory, set to one (1)</dd>
            <dt pn="section-4.2.13-10.3">R</dt>
            <dd pn="section-4.2.13-10.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.13-10.5">TLV Type</dt>
            <dd pn="section-4.2.13-10.6">12 - Crypto-Binding TLV</dd>
            <dt pn="section-4.2.13-10.7">Length</dt>
            <dd pn="section-4.2.13-10.8">76</dd>
            <dt pn="section-4.2.13-10.9">Reserved</dt>
            <dd pn="section-4.2.13-10.10">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.13-10.11">Version</dt>
            <dd pn="section-4.2.13-10.12">The Version field is a single octet, which is set to the version of
  Crypto-Binding TLV the TEAP method is using.  For an implementation
  compliant with TEAPv1, the version number <bcp14>MUST</bcp14> be set to one
  (1).</dd>
            <dt pn="section-4.2.13-10.13">Received-Ver</dt>
            <dd pn="section-4.2.13-10.14">
              <t indent="0" pn="section-4.2.13-10.14.1">The Received-Ver field is a single octet and <bcp14>MUST</bcp14> be set
  to the TEAP version number received during version negotiation.  Note that
  this field only provides protection against downgrade attacks, where a
  version of EAP requiring support for this TLV is required on both sides.</t>
              <t indent="0" pn="section-4.2.13-10.14.2">For TEAPv1, this version number <bcp14>MUST</bcp14> be set to one (1).</t>
            </dd>
            <dt pn="section-4.2.13-10.15">Flags</dt>
            <dd pn="section-4.2.13-10.16">
              <t indent="0" pn="section-4.2.13-10.16.1">The Flags field is four bits.  Defined values include:</t>
              <dl spacing="normal" newline="false" indent="3" pn="section-4.2.13-10.16.2">
                <dt pn="section-4.2.13-10.16.2.1">1</dt>
                <dd pn="section-4.2.13-10.16.2.2">EMSK Compound MAC is present</dd>
                <dt pn="section-4.2.13-10.16.2.3">2</dt>
                <dd pn="section-4.2.13-10.16.2.4">MSK Compound MAC is present</dd>
                <dt pn="section-4.2.13-10.16.2.5">3</dt>
                <dd pn="section-4.2.13-10.16.2.6">Both EMSK and MSK Compound MAC are present</dd>
              </dl>
              <t indent="0" pn="section-4.2.13-10.16.3">All other values of the Flags field are invalid.</t>
            </dd>
            <dt pn="section-4.2.13-10.17">Sub-Type</dt>
            <dd pn="section-4.2.13-10.18">
              <t indent="0" pn="section-4.2.13-10.18.1">The Sub-Type field is four bits.  Defined values include:</t>
              <dl spacing="normal" newline="false" indent="3" pn="section-4.2.13-10.18.2">
                <dt pn="section-4.2.13-10.18.2.1">0</dt>
                <dd pn="section-4.2.13-10.18.2.2">Binding Request</dd>
                <dt pn="section-4.2.13-10.18.2.3">1</dt>
                <dd pn="section-4.2.13-10.18.2.4">Binding Response</dd>
              </dl>
              <t indent="0" pn="section-4.2.13-10.18.3">All other values of the Sub-Type field are invalid.</t>
            </dd>
            <dt pn="section-4.2.13-10.19">Nonce</dt>
            <dd pn="section-4.2.13-10.20">The Nonce field is 32 octets.  It contains a 256-bit nonce that is
  temporally unique, used for Compound MAC key derivation at each end.  The
  nonce in a request <bcp14>MUST</bcp14> have its least significant bit set to
  zero (0), and the nonce in a response <bcp14>MUST</bcp14> have the same
  value as the request nonce except the least significant bit
  <bcp14>MUST</bcp14> be set to one (1).</dd>
            <dt pn="section-4.2.13-10.21">EMSK Compound MAC</dt>
            <dd pn="section-4.2.13-10.22">
              <t indent="0" pn="section-4.2.13-10.22.1">The EMSK Compound MAC field is 20 octets.  This can be the Server MAC
  (B1_MAC) or the Client MAC (B2_MAC).  The computation of the MAC is
  described in <xref target="computing-compound-mac" format="default" sectionFormat="of" derivedContent="Section 6.3"/>.</t>
              <t indent="0" pn="section-4.2.13-10.22.2">Note that this field is always 20 octets in length.  Any larger MAC is
  simply truncated.  All validations or comparisons <bcp14>MUST</bcp14> be
  done on the truncated value.</t>
            </dd>
            <dt pn="section-4.2.13-10.23">MSK Compound MAC</dt>
            <dd pn="section-4.2.13-10.24">
              <t indent="0" pn="section-4.2.13-10.24.1">The MSK Compound MAC field is 20 octets.  This can be the Server MAC
  (B1_MAC) or the Client MAC (B2_MAC).  The computation of the MAC is
  described in <xref target="computing-compound-mac" format="default" sectionFormat="of" derivedContent="Section 6.3"/>.</t>
              <t indent="0" pn="section-4.2.13-10.24.2">Note that this field is always 20 octets in length.  Any larger MAC is
  simply truncated.  All validations or comparisons <bcp14>MUST</bcp14> be
  done on the truncated value.</t>
            </dd>
          </dl>
        </section>
        <section anchor="bp-auth-req-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.14">
          <name slugifiedName="name-basic-password-auth-req-tlv">Basic-Password-Auth-Req TLV</name>
          <t indent="0" pn="section-4.2.14-1">The Basic-Password-Auth-Req TLV is used by the authentication server
to request a username and password from the peer.  It contains an
optional user prompt message for the request.  The peer is expected to
obtain the username and password and send them in a Basic-Password-Auth-Resp TLV.</t>
          <t indent="0" pn="section-4.2.14-2">The Basic-Password-Auth-Req TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.14-3">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   Prompt ....
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.14-4">
            <dt pn="section-4.2.14-4.1">M</dt>
            <dd pn="section-4.2.14-4.2">Mandatory, set to one (1)</dd>
            <dt pn="section-4.2.14-4.3">R</dt>
            <dd pn="section-4.2.14-4.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.14-4.5">TLV Type</dt>
            <dd pn="section-4.2.14-4.6">13 - Basic-Password-Auth-Req TLV</dd>
            <dt pn="section-4.2.14-4.7">Length</dt>
            <dd pn="section-4.2.14-4.8">variable</dd>
            <dt pn="section-4.2.14-4.9">Prompt</dt>
            <dd pn="section-4.2.14-4.10">optional user prompt message in UTF-8 <xref target="RFC3629" format="default" sectionFormat="of" derivedContent="RFC3629"/> format</dd>
          </dl>
        </section>
        <section anchor="bp-auth-resp-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.15">
          <name slugifiedName="name-basic-password-auth-resp-tl">Basic-Password-Auth-Resp TLV</name>
          <t indent="0" pn="section-4.2.15-1">The Basic-Password-Auth-Resp TLV is used by the peer to respond to a
Basic-Password-Auth-Req TLV with a username and password.  The TLV
contains a username and password.  The username and password are in
UTF-8 <xref target="RFC3629" format="default" sectionFormat="of" derivedContent="RFC3629"/> format.</t>
          <t indent="0" pn="section-4.2.15-2">The Basic-Password-Auth-Resp TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.15-3">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   Userlen     |             Username
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      ...     Username    ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   Passlen     |             Password
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      ...     Password    ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.15-4">
            <dt pn="section-4.2.15-4.1">M</dt>
            <dd pn="section-4.2.15-4.2">Mandatory, set to one (1)</dd>
            <dt pn="section-4.2.15-4.3">R</dt>
            <dd pn="section-4.2.15-4.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.15-4.5">TLV Type</dt>
            <dd pn="section-4.2.15-4.6">14 - Basic-Password-Auth-Resp TLV</dd>
            <dt pn="section-4.2.15-4.7">Length</dt>
            <dd pn="section-4.2.15-4.8">variable</dd>
            <dt pn="section-4.2.15-4.9">Userlen</dt>
            <dd pn="section-4.2.15-4.10">
              <t indent="0" pn="section-4.2.15-4.10.1">Length of Username field in octets.</t>
              <t indent="0" pn="section-4.2.15-4.10.2">The value of Userlen <bcp14>MUST NOT</bcp14> be zero.</t>
            </dd>
            <dt pn="section-4.2.15-4.11">Username</dt>
            <dd pn="section-4.2.15-4.12">
              <t indent="0" pn="section-4.2.15-4.12.1">Username in UTF-8 <xref target="RFC3629" format="default" sectionFormat="of" derivedContent="RFC3629"/> format.</t>
              <t indent="0" pn="section-4.2.15-4.12.2">The content of Username <bcp14>SHOULD</bcp14> follow the guidelines set
  in <xref section="3.1" sectionFormat="comma" target="RFC9427" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9427#section-3.1" derivedContent="RFC9427"/>.</t>
            </dd>
            <dt pn="section-4.2.15-4.13">Passlen</dt>
            <dd pn="section-4.2.15-4.14">
              <t indent="0" pn="section-4.2.15-4.14.1">Length of Password field in octets.</t>
              <t indent="0" pn="section-4.2.15-4.14.2">The value of Passlen <bcp14>MUST NOT</bcp14> be zero.</t>
            </dd>
            <dt pn="section-4.2.15-4.15">Password</dt>
            <dd pn="section-4.2.15-4.16">
              <t indent="0" pn="section-4.2.15-4.16.1">Password in UTF-8 <xref target="RFC3629" format="default" sectionFormat="of" derivedContent="RFC3629"/> format.</t>
              <t indent="0" pn="section-4.2.15-4.16.2">Note that there is no requirement that passwords be humanly readable.
    Octets in a passwords may have values less than 0x20, including 0x00.</t>
            </dd>
          </dl>
        </section>
        <section anchor="pkcs7-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.16">
          <name slugifiedName="name-pkcs7-tlv">PKCS#7 TLV</name>
          <t indent="0" pn="section-4.2.16-1">The PKCS#7 TLV is used by the EAP server to deliver certificate(s) to
the peer.  The format consists of a certificate or certificate chain
in binary DER encoding <xref target="X.690" format="default" sectionFormat="of" derivedContent="X.690"/> in a degenerate Certificates Only
PKCS#7 SignedData Content as defined in <xref target="RFC5652" format="default" sectionFormat="of" derivedContent="RFC5652"/>.</t>
          <t indent="0" pn="section-4.2.16-2">When used in response to a Trusted-Server-Root TLV request from the
peer, the EAP server <bcp14>MUST</bcp14> send the PKCS#7 TLV inside a
Trusted-Server-Root TLV.  When used in response to a PKCS#10 certificate
enrollment request from the peer, the EAP server <bcp14>MUST</bcp14> send the PKCS#7
TLV without a Trusted-Server-Root TLV.  The PKCS#7 TLV is always
marked as optional, which cannot be responded to with a NAK TLV.
TEAP implementations that support the Trusted-Server-Root TLV or the
PKCS#10 TLV <bcp14>MUST</bcp14> support this TLV.  Peers <bcp14>MUST NOT</bcp14> assume that the
certificates in a PKCS#7 TLV are in any order.</t>
          <t indent="0" pn="section-4.2.16-3">TEAP servers <bcp14>MAY</bcp14> return self-signed certificates.  Peers that handle
self-signed certificates or trust anchors <bcp14>MUST NOT</bcp14> implicitly trust
these certificates merely due to their presence in the certificate
bag.  Note: Peers are advised to take great care in deciding whether
to use a received certificate as a trust anchor.  The authenticated
nature of the tunnel in which a PKCS#7 bag is received can provide a
level of authenticity to the certificates contained therein.  Peers
are advised to take into account the implied authority of the EAP
server and to constrain the trust it can achieve through the trust
anchor received in a PKCS#7 TLV.</t>
          <t indent="0" pn="section-4.2.16-4">The PKCS#7 TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.16-5">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           PKCS#7 Data...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.16-6">
            <dt pn="section-4.2.16-6.1">M</dt>
            <dd pn="section-4.2.16-6.2">0 - Optional TLV</dd>
            <dt pn="section-4.2.16-6.3">R</dt>
            <dd pn="section-4.2.16-6.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.16-6.5">TLV Type</dt>
            <dd pn="section-4.2.16-6.6">15 - PKCS#7 TLV</dd>
            <dt pn="section-4.2.16-6.7">Length</dt>
            <dd pn="section-4.2.16-6.8">The length of the PKCS#7 Data field.</dd>
            <dt pn="section-4.2.16-6.9">PKCS#7 Data</dt>
            <dd pn="section-4.2.16-6.10">This field contains the DER-encoded X.509 certificate or certificate
  chain in a Certificates-Only PKCS#7 SignedData message.</dd>
          </dl>
        </section>
        <section anchor="pkcs10-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.17">
          <name slugifiedName="name-pkcs10-tlv">PKCS#10 TLV</name>
          <t indent="0" pn="section-4.2.17-1">The PKCS#10 TLV is used by the peer to initiate the "Simple PKI"
Request/Response from <xref target="RFC5272" format="default" sectionFormat="of" derivedContent="RFC5272"/>.  The format of the request is as
specified in <xref target="RFC4945" section="6.4" format="default" sectionFormat="of" derivedLink="https://rfc-editor.org/rfc/rfc4945#section-6.4" derivedContent="RFC4945"/>.  The PKCS#10 TLV is always
marked as optional, which cannot be responded to with a NAK TLV.</t>
          <t indent="0" pn="section-4.2.17-2">The PKCS#10 TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.17-3">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           PKCS#10 Data...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.17-4">
            <dt pn="section-4.2.17-4.1">M</dt>
            <dd pn="section-4.2.17-4.2">0 - Optional TLV</dd>
            <dt pn="section-4.2.17-4.3">R</dt>
            <dd pn="section-4.2.17-4.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.17-4.5">TLV Type</dt>
            <dd pn="section-4.2.17-4.6">16 - PKCS#10 TLV</dd>
            <dt pn="section-4.2.17-4.7">Length</dt>
            <dd pn="section-4.2.17-4.8">The length of the PKCS#10 Data field.</dd>
            <dt pn="section-4.2.17-4.9">PKCS#10 Data</dt>
            <dd pn="section-4.2.17-4.10">This field contains the DER-encoded PKCS#10 certificate request.</dd>
          </dl>
        </section>
        <section anchor="trusted-server-root-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.18">
          <name slugifiedName="name-trusted-server-root-tlv">Trusted-Server-Root TLV</name>
          <t indent="0" pn="section-4.2.18-1">Trusted-Server-Root TLV facilitates the request and delivery of a
trusted server root certificate.  The Trusted-Server-Root TLV can be
exchanged in regular TEAP authentication mode or provisioning mode.
The Trusted-Server-Root TLV is always marked as optional and cannot
be responded to with a NAK TLV.  The
Trusted-Server-Root TLV <bcp14>MUST</bcp14> only be sent as an Inner TLV (inside the
protection of the tunnel).</t>
          <t indent="0" pn="section-4.2.18-2">After the peer has determined that it has successfully authenticated
the EAP server and validated the Crypto-Binding TLV, it <bcp14>MAY</bcp14> send one
or more Trusted-Server-Root TLVs (marked as optional) to request the
trusted server root certificates from the EAP server.  The EAP server
<bcp14>MAY</bcp14> send one or more root certificates with a Public Key
Cryptographic System #7 (PKCS#7) TLV inside the Trusted-Server-Root
TLV.  The EAP server <bcp14>MAY</bcp14> also choose not to honor the request.</t>
          <t indent="0" pn="section-4.2.18-3">The Trusted-Server-Root TLV allows the peer to send a request to the
EAP server for a list of trusted roots.  The server may respond with
one or more root certificates in PKCS#7 <xref target="RFC2315" format="default" sectionFormat="of" derivedContent="RFC2315"/> format.</t>
          <t indent="0" pn="section-4.2.18-4">If the EAP server sets the credential format to
PKCS#7-Server-Certificate-Root, then the Trusted-Server-Root TLV should contain the
root of the certificate chain of the certificate issued to the EAP
server packaged in a PKCS#7 TLV.  If the server certificate is a
self-signed certificate, then the root is the self-signed
certificate.</t>
          <t indent="0" pn="section-4.2.18-5">If the Trusted-Server-Root TLV credential format contains a value
unknown to the peer, then the EAP peer should ignore the TLV.</t>
          <t indent="0" pn="section-4.2.18-6">The Trusted-Server-Root TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.18-7">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           Credential-Format   |     Cred TLVs...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.18-8">
            <dt pn="section-4.2.18-8.1">M</dt>
            <dd pn="section-4.2.18-8.2">0 - Optional TLV</dd>
            <dt pn="section-4.2.18-8.3">R</dt>
            <dd pn="section-4.2.18-8.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.18-8.5">TLV Type</dt>
            <dd pn="section-4.2.18-8.6">17 - Trusted-Server-Root TLV</dd>
            <dt pn="section-4.2.18-8.7">Length</dt>
            <dd pn="section-4.2.18-8.8">&gt;=2 octets</dd>
            <dt pn="section-4.2.18-8.9">Credential-Format</dt>
            <dd pn="section-4.2.18-8.10">
              <t indent="0" pn="section-4.2.18-8.10.1">The Credential-Format field is two octets.  Values include:</t>
              <t indent="0" pn="section-4.2.18-8.10.2">1 - PKCS#7-Server-Certificate-Root</t>
            </dd>
            <dt pn="section-4.2.18-8.11">Cred TLVs</dt>
            <dd pn="section-4.2.18-8.12">This field is of indefinite length.  It contains TLVs associated with
  the credential format.  The peer may leave this field empty when using this
  TLV to request server trust roots.</dd>
          </dl>
        </section>
        <section anchor="csr-attributes-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.19">
          <name slugifiedName="name-csr-attributes-tlv">CSR-Attributes TLV</name>
          <t indent="0" pn="section-4.2.19-1">The CSR-Attributes TLV provides information from the server to the
peer on how certificate signing requests should be formed.  The
purpose of CSR attributes is described in <xref target="RFC7030" section="4.5" format="default" sectionFormat="of" derivedLink="https://rfc-editor.org/rfc/rfc7030#section-4.5" derivedContent="RFC7030"/>.
Servers <bcp14>MAY</bcp14> send the CSR-Attributes TLV directly after the TLS session has
been established.  A server <bcp14>MAY</bcp14> also send in the same message a
Request-Action frame for a PKCS#10 TLV.  This is an indication to the
peer that the server would like the peer to renew its certificate
using the parameters provided in this TLV.  Servers shall construct
the contents of the CSR-Attributes TLV as specified in <xref section="4.5.2" sectionFormat="comma" target="RFC7030" format="default" derivedLink="https://rfc-editor.org/rfc/rfc7030#section-4.5.2" derivedContent="RFC7030"/> with the
exception that the DER encoding <bcp14>MUST NOT</bcp14> be encoded in base64.  The base64 encoding is used in <xref target="RFC7030" format="default" sectionFormat="of" derivedContent="RFC7030"/> because the transport protocol used there requires textual encoding.  In contrast, TEAP attributes can transport arbitrary binary data.</t>
          <t indent="0" pn="section-4.2.19-2">Servers and peers <bcp14>MUST</bcp14> follow the guidance provided in
<xref target="RFC9908" format="default" sectionFormat="of" derivedContent="RFC9908"/> when creating the CSR-Attributes TLV. Peers <bcp14>MAY</bcp14> ignore the contents
of the TLV if they are unable to do so, but then servers may not
process PKCS#10 certificate requests for this or any other reason.</t>
          <t indent="0" pn="section-4.2.19-3">The CSR-Attributes TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.19-4">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                DER Encoded CSR Attributes                     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.19-5">
            <dt pn="section-4.2.19-5.1">M</dt>
            <dd pn="section-4.2.19-5.2">0 - Optional TLV</dd>
            <dt pn="section-4.2.19-5.3">R</dt>
            <dd pn="section-4.2.19-5.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.19-5.5">TLV Type</dt>
            <dd pn="section-4.2.19-5.6">18 - CSR-Attributes</dd>
            <dt pn="section-4.2.19-5.7">Length</dt>
            <dd pn="section-4.2.19-5.8">&gt;=2 octets</dd>
          </dl>
        </section>
        <section anchor="identity-hint-tlv" numbered="true" removeInRFC="false" toc="include" pn="section-4.2.20">
          <name slugifiedName="name-identity-hint-tlv">Identity-Hint TLV</name>
          <t indent="0" pn="section-4.2.20-1">The Identity-Hint TLV is an optional TLV that can be sent by the peer to the server at the beginning of the Phase 2 TEAP conversation.  The purpose of the TLV is to provide a "hint" as to the identity or identities that the peer will be using by subsequent Inner Methods.</t>
          <t indent="0" pn="section-4.2.20-2">The purpose of this TLV is to solve the "bootstrapping" problem for the server.  In order to perform authentication, the server must choose an Inner Method.  However, the server has no knowledge of what methods are supported by the peer.  Without an identity hint, the server needs to propose a method and then have the peer return a response indicating that the requested method is not available.  This negotiation increases the number of round trips required for TEAP to conclude with no additional benefit.</t>
          <t indent="0" pn="section-4.2.20-3">When the Identity-Hint is used, the peer can signal which identities it has available, which enables the server to choose an Inner Method that is appropriate for that identity.</t>
          <t indent="0" pn="section-4.2.20-4">The peer <bcp14>SHOULD</bcp14> send an Identity-Hint TLV for each Identity-Type that is available to it.  For example, if the peer can do both machine and user authentication, it can send two Identity-Hint TLVs with values "host/name.example.com" (for a machine with hostname "name.example.com") and "user@example.com" (for a person with identity "user@example.com").</t>
          <t indent="0" pn="section-4.2.20-5">The contents of the Identity-Hint TLV <bcp14>SHOULD</bcp14> be in the format of an NAI <xref target="RFC7542" format="default" sectionFormat="of" derivedContent="RFC7542"/>, but we note that as given in the example above, Machine identities might not follow that format.  As these identities are never used for AAA routing as discussed in <xref section="3" sectionFormat="comma" target="RFC7542" format="default" derivedLink="https://rfc-editor.org/rfc/rfc7542#section-3" derivedContent="RFC7542"/>, the format and definition of these identities are entirely site local.  Robust implementations <bcp14>MUST</bcp14> support arbitrary data in the content of this TLV, including binary octets.</t>
          <t indent="0" pn="section-4.2.20-6">As the Identity-Hint TLV is a "hint", server implementations are free to ignore the hints given and do whatever is required by site-local policies.</t>
          <t indent="0" pn="section-4.2.20-7">The Identity-Hint TLV is used only as a guide when selecting which Inner Methods to use.  This TLV has no other meaning, and it <bcp14>MUST NOT</bcp14> be used for any other purpose.  Specifically, server implementations <bcp14>MUST NOT</bcp14> compare the identities given this TLV to later identities given as part of the Inner Methods.  There is no issue with the hint(s) failing to match any subsequent identity that is used.</t>
          <t indent="0" pn="section-4.2.20-8">The Identity-Hint TLV <bcp14>MUST NOT</bcp14> be used for server unauthenticated provisioning.  This TLV is only used as a hint for normal authentication.</t>
          <t indent="0" pn="section-4.2.20-9">The Identity-Hint TLV is defined as follows:</t>
          <artwork align="left" pn="section-4.2.20-10">
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|R|         TLV Type          |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Identity Hint                           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-</artwork>
          <dl spacing="normal" newline="true" indent="3" pn="section-4.2.20-11">
            <dt pn="section-4.2.20-11.1">M</dt>
            <dd pn="section-4.2.20-11.2">0 - Optional TLV</dd>
            <dt pn="section-4.2.20-11.3">R</dt>
            <dd pn="section-4.2.20-11.4">Reserved, set to zero (0)</dd>
            <dt pn="section-4.2.20-11.5">TLV Type</dt>
            <dd pn="section-4.2.20-11.6">19 - Identity-Hint</dd>
            <dt pn="section-4.2.20-11.7">Length</dt>
            <dd pn="section-4.2.20-11.8">&gt;=2 octets</dd>
          </dl>
        </section>
      </section>
      <section anchor="tlv-rules" numbered="true" removeInRFC="false" toc="include" pn="section-4.3">
        <name slugifiedName="name-tlv-rules">TLV Rules</name>
        <t indent="0" pn="section-4.3-1">To save round trips, multiple TLVs can be sent in a single TEAP
packet.  However, multiple EAP Payload TLVs, multiple Basic Password
Authentication TLVs, or an EAP Payload TLV with a Basic Password
Authentication TLV within one single TEAP packet is not supported in
this version and <bcp14>MUST NOT</bcp14> be sent.  If the peer or EAP server
receives multiple EAP Payload TLVs, then it <bcp14>MUST</bcp14> terminate the
connection with the Result TLV.  The order in which TLVs are encoded in a TEAP packet does not
matter. However, there is an order in which TLVs in a packet must be processed:</t>
        <ol spacing="normal" type="1" indent="adaptive" start="1" pn="section-4.3-2"><li pn="section-4.3-2.1" derivedCounter="1.">
            <t indent="0" pn="section-4.3-2.1.1">Crypto-Binding TLV</t>
          </li>
          <li pn="section-4.3-2.2" derivedCounter="2.">
            <t indent="0" pn="section-4.3-2.2.1">Intermediate-Result TLV</t>
          </li>
          <li pn="section-4.3-2.3" derivedCounter="3.">
            <t indent="0" pn="section-4.3-2.3.1">Result TLV or Request-Action TLV</t>
          </li>
          <li pn="section-4.3-2.4" derivedCounter="4.">
            <t indent="0" pn="section-4.3-2.4.1">Identity-Type TLV</t>
          </li>
          <li pn="section-4.3-2.5" derivedCounter="5.">
            <t indent="0" pn="section-4.3-2.5.1">EAP-Payload TLV (Identity-Request) or Basic-Password-Auth-Req TLV</t>
          </li>
          <li pn="section-4.3-2.6" derivedCounter="6.">
            <t indent="0" pn="section-4.3-2.6.1">Other TLVs</t>
          </li>
        </ol>
        <t indent="0" pn="section-4.3-3">That is, cryptographic binding is checked before any result is used
and identities are checked before proposing an Inner Method, as the
identity may influence the chosen Inner Method.</t>
        <t indent="0" pn="section-4.3-4">The following define the meaning of the table entries in the sections
below:</t>
        <dl spacing="normal" newline="false" indent="3" pn="section-4.3-5">
          <dt pn="section-4.3-5.1">0</dt>
          <dd pn="section-4.3-5.2"> This TLV <bcp14>MUST NOT</bcp14> be present in the
  message.</dd>
          <dt pn="section-4.3-5.3">0+</dt>
          <dd pn="section-4.3-5.4"> Zero or more instances of this TLV <bcp14>MAY</bcp14> be
  present in the message.</dd>
          <dt pn="section-4.3-5.5">0-1</dt>
          <dd pn="section-4.3-5.6">Zero or one instance of this TLV <bcp14>MAY</bcp14> be present in the message.</dd>
          <dt pn="section-4.3-5.7">1</dt>
          <dd pn="section-4.3-5.8">Exactly one instance of this TLV <bcp14>MUST</bcp14> be
  present in the message.</dd>
        </dl>
        <section anchor="outer-tlvs" numbered="true" removeInRFC="false" toc="include" pn="section-4.3.1">
          <name slugifiedName="name-outer-tlvs">Outer TLVs</name>
          <t indent="0" pn="section-4.3.1-1">The following table provides a guide to which TLVs may be included in
the TEAP packet outside the TLS channel, in which kind of packets, and
in what quantity:</t>
          <table align="center" pn="table-1">
            <thead>
              <tr>
                <th align="left" colspan="1" rowspan="1">Request</th>
                <th align="left" colspan="1" rowspan="1">Response</th>
                <th align="left" colspan="1" rowspan="1">Success</th>
                <th align="left" colspan="1" rowspan="1">Failure</th>
                <th align="left" colspan="1" rowspan="1">TLVs</th>
              </tr>
            </thead>
            <tbody>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">Authority-ID</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">Identity-Type</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">Vendor-Specific</td>
              </tr>
            </tbody>
          </table>
          <t indent="0" pn="section-4.3.1-3">Outer TLVs <bcp14>MUST</bcp14> be marked as optional.  Vendor TLVs inside of a
Vendor-Specific TLV <bcp14>MUST</bcp14> be marked as optional when included in Outer TLVs.
Outer TLVs <bcp14>MUST NOT</bcp14> be included in messages after the first two TEAP
messages sent by peer and EAP-server, respectively.  That is, the first
EAP-server-to-peer message and first peer-to-EAP-server message.  If
the message is fragmented, the whole set of messages is counted as
one message.  If Outer TLVs are included in messages after the first
two TEAP messages, they <bcp14>MUST</bcp14> be ignored.</t>
        </section>
        <section anchor="inner-tlvs" numbered="true" removeInRFC="false" toc="include" pn="section-4.3.2">
          <name slugifiedName="name-inner-tlvs">Inner TLVs</name>
          <t indent="0" pn="section-4.3.2-1">The following table provides a guide to which Inner TLVs may be
encapsulated in TLS in TEAP Phase 2, in which kind of packets, and in
what quantity.  The messages are as follows: Request is a TEAP
Request, Response is a TEAP Response, Success is a message containing
a successful Result TLV, and Failure is a message containing a failed
Result TLV.</t>
          <table align="center" pn="table-2">
            <thead>
              <tr>
                <th align="left" colspan="1" rowspan="1">Request</th>
                <th align="left" colspan="1" rowspan="1">Response</th>
                <th align="left" colspan="1" rowspan="1">Success</th>
                <th align="left" colspan="1" rowspan="1">Failure</th>
                <th align="left" colspan="1" rowspan="1">TLVs</th>
              </tr>
            </thead>
            <tbody>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">Identity-Type</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">1</td>
                <td align="left" colspan="1" rowspan="1">1</td>
                <td align="left" colspan="1" rowspan="1">Result</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">NAK</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">Error</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">Channel-Binding</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">Vendor-Specific</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">Request-Action</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">EAP-Payload</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">Intermediate-Result</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">Crypto-Binding</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">Basic-Password-Auth-Req</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">Basic-Password-Auth-Resp</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">PKCS#7</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">PKCS#10</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">Trusted-Server-Root</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0-1</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">CSR-Attributes TLV</td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0+</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">0</td>
                <td align="left" colspan="1" rowspan="1">Identity-Hint TLV</td>
              </tr>
            </tbody>
          </table>
          <t indent="0" pn="section-4.3.2-3">NOTE: Vendor TLVs (included in Vendor-Specific TLVs) sent with a
Result TLV <bcp14>MUST</bcp14> be marked as optional.  Also, the CSR-Attributes TLV
is never transmitted by the peer, and so is treated as a request
in this table.</t>
        </section>
      </section>
    </section>
    <section anchor="limitations" numbered="true" removeInRFC="false" toc="include" pn="section-5">
      <name slugifiedName="name-limitations-of-teapv1">Limitations of TEAPv1</name>
      <t indent="0" pn="section-5-1">As noted in <xref target="interoperability" format="default" sectionFormat="of" derivedContent="Section 1.1"/>, TEAPv1 implementations are limited
in functionality as compared to what the protocol is theoretically
capable of.  These limitations mean that only a small number of inner
methods are fully supported by existing TEAPv1 implementations.</t>
      <t indent="0" pn="section-5-2">While <xref target="cryptographic-calculations" format="default" sectionFormat="of" derivedContent="Section 6"/> defines the
cryptographic calculations used for key derivation and crypto-binding,
this section documents which Inner Methods are known to work and why
those methods work.  Other Inner Methods may work, but those results
are likely to be implementation-specific.</t>
      <t indent="0" pn="section-5-3">We discuss the issues here without naming particular implementations
or making any negative inference about them.  The implementations work
well enough together in limited situations.  Any interoperability
issues are due to the complexity and incompleteness of the definitions
given in <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/> and are not due to issues with any particular
implementation.</t>
      <t indent="0" pn="section-5-4">The interoperability issues are limited to the use and derivation of
the Compound MAC(s), which are derived from the inner MSK and EMSK.
In short, implementations are known to derive different values for the
Compound MAC(s) when more than one Inner Method provides an EMSK.</t>
      <section anchor="interoperable-inner-methods" numbered="true" removeInRFC="false" toc="include" pn="section-5.1">
        <name slugifiedName="name-interoperable-inner-methods">Interoperable Inner Methods</name>
        <t indent="0" pn="section-5.1-1">The following Inner Methods are known to work.  These methods work for
both User and Machine credentials.</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-5.1-2">
          <li pn="section-5.1-2.1">
            <t indent="0" pn="section-5.1-2.1.1">EAP-MSCHAPv2</t>
          </li>
          <li pn="section-5.1-2.2">
            <t indent="0" pn="section-5.1-2.2.1">EAP-TLS</t>
          </li>
        </ul>
        <t indent="0" pn="section-5.1-3">The following combinations of Inner Methods are known to work.  These
methods work for any order of User and Machine credentials.</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-5.1-4">
          <li pn="section-5.1-4.1">
            <t indent="0" pn="section-5.1-4.1.1">EAP-MSCHAPv2 followed by EAP-MSCHAPv2</t>
          </li>
          <li pn="section-5.1-4.2">
            <t indent="0" pn="section-5.1-4.2.1">EAP-TLS followed by EAP-MSCHAPv2</t>
          </li>
        </ul>
        <t indent="0" pn="section-5.1-5">The following combinations of Inner Methods are known to work when
both the supplicant and authenticator ignore the EMSK Compound MAC field
of the Crypto-Binding TLV.  These methods work for any order of User
and Machine credentials.</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-5.1-6">
          <li pn="section-5.1-6.1">
            <t indent="0" pn="section-5.1-6.1.1">EAP-MSCHAPv2 followed by EAP-TLS</t>
          </li>
          <li pn="section-5.1-6.2">
            <t indent="0" pn="section-5.1-6.2.1">EAP-TLS followed by EAP-TLS</t>
          </li>
        </ul>
      </section>
      <section anchor="explanation-and-background" numbered="true" removeInRFC="false" toc="include" pn="section-5.2">
        <name slugifiedName="name-explanation-and-background">Explanation and Background</name>
        <t indent="0" pn="section-5.2-1">The main reason for the limited set of Inner Methods is that the most
well-known TEAP supplicant supports only EAP-MSCHAPv2 and EAP-TLS for
the Inner Methods.  Further, this implementation does not encode the
EMSK Compound MAC field in all of the Crypto-Binding TLVs that it
sends and ignores that field in all of the Crypto-Binding TLVs that
it receives.</t>
        <t indent="0" pn="section-5.2-2">The known authenticator implementations support this client, but any other
combination of Inner Methods was not tested. As a result, each authenticator
implemented entirely different derivations of the EMSK Compound MAC field of
the Crypto-Binding TLV due to both the complexity of the cryptographic
derivations and the lack of interoperability testing. This difference was
discovered only after multiple implementations had been shipping for
years.</t>
      </section>
      <section anchor="next-steps" numbered="true" removeInRFC="false" toc="include" pn="section-5.3">
        <name slugifiedName="name-next-steps">Next Steps</name>
        <t indent="0" pn="section-5.3-1">Any attempt to change TEAPv1 to address these issues would likely
result in one or more implementations being non-compliant with the
updated specification.  Even worse, updates to this specification
would result in multiple incompatible versions of TEAPv1.</t>
        <t indent="0" pn="section-5.3-2">That approach is not acceptable.</t>
        <t indent="0" pn="section-5.3-3">In the interest of maintaining known interoperability, this
specification simply documents these issues rather than trying to
correct the problem.  Since the TEAP and the Crypto-Binding
TLV both contain a Version field, the better path forward is to
publish this specification while documenting the large caveats for
TEAPv1.  Any changes to the TEAP can then be done in a future
TEAPv2 specification.</t>
      </section>
    </section>
    <section anchor="cryptographic-calculations" numbered="true" removeInRFC="false" toc="include" pn="section-6">
      <name slugifiedName="name-cryptographic-calculations">Cryptographic Calculations</name>
      <t indent="0" pn="section-6-1">The definitions given in this section are known to work with all
implementations but only for a few Inner Methods, as described above
in <xref target="limitations" format="default" sectionFormat="of" derivedContent="Section 5"/>.  In the interest of avoiding additional
complexity in an already complex process, those definitions are given
as if they work for all possible Inner Methods.</t>
      <t indent="0" pn="section-6-2">We note that some interoperable implementations have been written
based on these definitions, which support Inner Methods other than
EAP-MSCHAPv2 and EAP-TLS.  It is therefore useful to document the full
operation of TEAPv1 despite the known issues.  We only caution
implementors that Inner Methods that are not listed above in
<xref target="limitations" format="default" sectionFormat="of" derivedContent="Section 5"/> are likely to work with only a subset of existing
TEAPv1 implementations.</t>
      <t indent="0" pn="section-6-3">For key derivation and crypto-binding, TEAP uses the Pseudorandom
Function (PRF) and MAC algorithms negotiated in the underlying TLS
session.  Since these algorithms depend on the TLS version and
cipher suite, TEAP implementations need a mechanism to determine the
version and cipher suite in use for a particular session.  The
implementation can then use this information to determine which PRF
and MAC algorithm to use.</t>
      <section anchor="key-derivations" numbered="true" removeInRFC="false" toc="include" pn="section-6.1">
        <name slugifiedName="name-teap-authentication-phase-1-">TEAP Authentication Phase 1: Key Derivations</name>
        <t indent="0" pn="section-6.1-1">With TEAPv1, the TLS master secret is generated as specified in TLS.
If session resumption is used, then the master secret is obtained as described in
<xref target="RFC5077" format="default" sectionFormat="of" derivedContent="RFC5077"/>.</t>
        <t indent="0" pn="section-6.1-2">TEAPv1 makes use of the TLS Keying Material Exporters defined in
<xref target="RFC5705" format="default" sectionFormat="of" derivedContent="RFC5705"/> to derive the session_key_seed as follows:</t>
        <artwork align="left" pn="section-6.1-3">
   session_key_seed = TLS-Exporter(
                      "EXPORTER: teap session key seed",, 40)</artwork>
        <t indent="0" pn="section-6.1-4">No context data is used in the export process.</t>
        <t indent="0" pn="section-6.1-5">The session_key_seed is used by the TEAP authentication Phase 2
conversation to both cryptographically bind the Inner Method(s) to
the tunnel as well as generate the resulting TEAP session keys.  The
other TLS keying materials are derived and used as defined in
<xref target="RFC8446" format="default" sectionFormat="of" derivedContent="RFC8446"/>.</t>
      </section>
      <section anchor="intermediate-compound-key" numbered="true" removeInRFC="false" toc="include" pn="section-6.2">
        <name slugifiedName="name-intermediate-compound-key-d">Intermediate Compound Key Derivations</name>
        <t indent="0" pn="section-6.2-1">As TEAP can run multiple Inner Methods, there needs to be a way to
cryptographically bind each Inner Method to the TLS tunnel and to
cryptographically bind each method to the previous one.  This binding
is done by deriving a number of intermediate keys and exchanging that
information in the Crypto-Binding TLV.</t>
        <t indent="0" pn="section-6.2-2">The key derivation is complicated by a number of factors.  An inner
method can derive an MSK or (as with basic passwords) not derive an MSK.
An Inner Method can derive an EMSK or perhaps not derive an EMSK, or
some EAP types may derive different EMSKs for the peer and the server.
All of these cases must be accounted for and have recommendations made for
how peers and servers can interoperate.</t>
        <t indent="0" pn="section-6.2-3">There are a number of intermediate keys used to calculate the final
MSK and EMSK for TEAP.  We give a brief overview here in order to
clarify the detailed definitions and derivations given below.  As
each Inner Method can derive an MSK (or not) and an EMSK (or
not), there need to be separate intermediate key calculations for MSK
and for EMSK.  For the purposes of this overview, we just describe the
derivations at a high level and state that the MSK/EMSK issue is
addressed in the more detailed text below.</t>
        <t indent="0" pn="section-6.2-4">For each Inner Method, we derive an IMSK.
This key depends on the inner key (MSK or EMSK).  This IMSK is then
tied to the TLS session via the TLS-PRF to derive an Inner Method
Compound Key (IMCK).  The IMCK is used to generate a Compound MAC key
(CMK).  The CMK is mixed with various data from the TEAP
negotiation to create Compound MAC field of the Crypto-Binding
attribute.  This TLV cryptographically binds the Inner Method to the
protected tunnel and to the other fields that have been negotiated.
The cryptographic binding prevents on-path attacks.</t>
        <t indent="0" pn="section-6.2-5">The IMCK for this Inner Method is then mixed with keys from previous
Inner Methods, beginning with the TEAP Phase 2 session_key_seed
derived above, to yield a Secure IMCK (S-IMCK) for this round.  The
S-IMCK from the final is then used to derive the MSK and EMSK for
TEAP.</t>
        <t indent="0" pn="section-6.2-6">We differentiate keys for Inner Methods by counting Inner Methods
starting from 0 and use an index "j" to refer to an arbitrary inner
method. For example, IMCK[0] is the IMCK for the first, or "0" Inner Method.
While TEAPv1 is currently limited to one or two Inner Methods (j=0 or
j=0,1), further updates could allow for more Inner Method exchanges.</t>
        <section anchor="generating-the-inner-method-session-key" numbered="true" removeInRFC="false" toc="include" pn="section-6.2.1">
          <name slugifiedName="name-generating-the-inner-method">Generating the Inner Method Session Key</name>
          <t indent="0" pn="section-6.2.1-1">Each Inner Method generates an IMSK that depends on the EMSK (preferred) or the MSK if it exists, or else it is
all zeros.  We refer to the IMSK for Inner Method "j" as IMSK[j].</t>
          <t indent="0" pn="section-6.2.1-2">If an Inner Method supports export of an EMSK, then the IMSK <bcp14>SHOULD</bcp14> be derived from the EMSK, which is defined in
<xref target="RFC5295" format="default" sectionFormat="of" derivedContent="RFC5295"/>.  The optional data parameter is not used in the derivation.</t>
          <t indent="0" pn="section-6.2.1-3">The above derivation is not a requirement, as some peer
implementations of TEAP are also known to not derive IMSK from EMSK
and to only derive IMSK from MSK.  In order to be compatible with
those implementations, the use of EMSK here is not made mandatory.</t>
          <t indent="0" pn="section-6.2.1-4">Some EAP methods may also have the peer and server derive different
EMSKs.  Mandating an EMSK-based derivation there would prevent
interoperability, as the Crypto-Binding TLV contents that depend on
EMSK could not then be validated by either side.  Those methods <bcp14>SHOULD NOT</bcp14> derive IMSK from EMSK unless the method has a way to negotiate how
the EMSK is derived, along with a way to signal that both the peer and server
have derived the same EMSK.</t>
          <t indent="0" pn="section-6.2.1-5">It is <bcp14>RECOMMENDED</bcp14> that for those EAP methods, implementations take the
simpler approach of ignoring EMSK and always derive IMSK from MSK.
This approach is less secure, as IMSK no longer cryptographically
binds the Inner Method to the TLS tunnel.  A better solution is to
suggest that deployments of TEAP <bcp14>SHOULD</bcp14> avoid such methods.</t>
          <t indent="0" pn="section-6.2.1-6">The derivation of IMSK[j] from the j'th EMSK is given as follows:</t>
          <artwork align="left" pn="section-6.2.1-7">
   IMSK[j] = First 32 octets of TLS-PRF(
          EMSK[j],
          "TEAPbindkey@ietf.org",
          0x00 | 0x00 | 0x40)</artwork>
          <t indent="0" pn="section-6.2.1-8">Where:</t>
          <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.1-9">
            <li pn="section-6.2.1-9.1">"|" denotes concatenation</li>
            <li pn="section-6.2.1-9.2">
              <t indent="0" pn="section-6.2.1-9.2.1">The TLS-PRF is defined in <xref target="RFC5246" format="default" sectionFormat="of" derivedContent="RFC5246"/> as:</t>
              <artwork align="left" pn="section-6.2.1-9.2.2">
   PRF(secret, label, seed) = P_&lt;hash&gt;(secret, label | seed)</artwork>
            </li>
            <li pn="section-6.2.1-9.3">The secret is the EMSK from the j'th Inner Method, the usage label used is
"TEAPbindkey@ietf.org" consisting of the ASCII value for the
label "TEAPbindkey@ietf.org" (without quotes), and the seed
consists of the "\0" null delimiter (0x00) and 2-octet unsigned
integer length of 64 octets in network byte order (0x00 | 0x40) specified
in <xref target="RFC5295" format="default" sectionFormat="of" derivedContent="RFC5295"/>.</li>
          </ul>
          <t indent="0" pn="section-6.2.1-10">If an Inner Method does not support the export of EMSK but does export
MSK, then the IMSK is copied from the MSK of the Inner Method.  If the
MSK is longer than 32 octets, the IMSK is copied from the first 32
octets and the rest of MSK is ignored.  If the MSK is shorter than 32
octets, then the ISMK is copied from MSK and the remaining data in
IMSK is padded with zeros to a length of 32 octets.  IMSK[j] is then
this derived value.</t>
          <t indent="0" pn="section-6.2.1-11">If the Inner Method does not provide either MSK or EMSK, such as when
basic password authentication is used or when no Inner Method has been
run, then both MSK and IMSK[j] are set to all zeroes (i.e., IMSK[j] =
MSK = 32 octets of 0x00s).</t>
          <t indent="0" pn="section-6.2.1-12">Note that using an MSK of all zeroes opens up TEAP to on-path
attacks as discussed in <xref target="separation-p1-p2" format="default" sectionFormat="of" derivedContent="Section 8.3"/>.  It is therefore
<bcp14>NOT RECOMMENDED</bcp14> to use Inner Methods that fail to generate an MSK or
EMSK.  These methods should only be used in conjunction with another
Inner Method that does provide for MSK or EMSK generation.</t>
          <t indent="0" pn="section-6.2.1-13">It is also <bcp14>RECOMMENDED</bcp14> that TEAP peers order Inner Methods such that
methods that  generate EMSKs are performed before methods that do not
generate EMSKs.  Ordering Inner Methods in this manner ensures that
the first Inner Method detects any on-path attackers, and any
subsequent Inner Method used is therefore secure.</t>
          <t indent="0" pn="section-6.2.1-14">For example, Phase 2 could perform both machine authentication using
EAP-TLS, followed by user authentication via the Basic Password
Authentication TLVs.  In that case, the use of EAP-TLS would allow an
attacker to be detected before the users' password was sent.</t>
          <t indent="0" pn="section-6.2.1-15">However, it is possible that the peer and server sides might not have
the same capability to export EMSK.  In order to maintain maximum
flexibility while prevent downgrading attack, the following mechanism
is in place.</t>
        </section>
        <section anchor="generating-s-imck" numbered="true" removeInRFC="false" toc="include" pn="section-6.2.2">
          <name slugifiedName="name-generating-s-imck">Generating S-IMCK</name>
          <t indent="0" pn="section-6.2.2-1">Once IMSK[j] has been determined, it is mixed via the TLS-PRF with
the key S-IMCK[j-1] from a previous round.  That mixing derives a
new key IMCK[j].  This key is then used to derive both S-IMCK[j] for
this round and CMK[j] for this round.</t>
          <t indent="0" pn="section-6.2.2-2">The derivation of S-IMCK is as follows:</t>
          <artwork align="left" pn="section-6.2.2-3">
   S-IMCK[0] = session_key_seed
   For j = 1 to n-1 do
        IMCK[j] = the first 60 octets of TLS-PRF(S-IMCK[j-1],
             "Inner Methods Compound Keys",
             IMSK[j])
        S-IMCK[j] = first 40 octets of IMCK[j]
        CMK[j] = last 20 octets of IMCK[j]</artwork>
          <t indent="0" pn="section-6.2.2-4">where TLS-PRF is the PRF (described above) negotiated as
part of TLS handshake <xref target="RFC5246" format="default" sectionFormat="of" derivedContent="RFC5246"/>.  The value j refers to a
corresponding Inner Method 1 through n.  The special value of
S-IMCK[0] is used to bootstrap the calculations and can be done as
soon as the TLS connection is established and before any inner
methods are run.</t>
          <t indent="0" pn="section-6.2.2-5">In practice, the requirement to use either MSK or EMSK means that an
implementation <bcp14>MUST</bcp14> track two independent derivations of IMCK[j], one that
depends on the MSK and another that depends on EMSK.  That is, we
have both values derived from MSK:</t>
          <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.2-6">
            <li pn="section-6.2.2-6.1">IMSK_MSK[j]</li>
            <li pn="section-6.2.2-6.2">S-IMCK_MSK[j]</li>
            <li pn="section-6.2.2-6.3">CMK_MSK[j]</li>
          </ul>
          <t indent="0" pn="section-6.2.2-7">and then also values derived from EMSK:</t>
          <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.2-8">
            <li pn="section-6.2.2-8.1">IMSK_EMSK[j]</li>
            <li pn="section-6.2.2-8.2">S-IMCK_EMSK[j]</li>
            <li pn="section-6.2.2-8.3">CMK_EMSK[j]</li>
          </ul>
          <t indent="0" pn="section-6.2.2-9">At the conclusion of a successful exchange of Crypto-Binding TLVs, a
single S-IMCK[j] is selected based on which Compound MAC value was
included in the Crypto-Binding TLV from the client. If EMSK Compound MAC
was included, S-IMCK[j] is taken from S-IMCK_EMSK[j].  Otherwise,
S-IMCK[j] is taken from S-IMCK_MSK[j].</t>
        </section>
        <section anchor="choosing-inner-methods" numbered="true" removeInRFC="false" toc="include" pn="section-6.2.3">
          <name slugifiedName="name-choosing-inner-methods-secu">Choosing Inner Methods Securely</name>
          <t indent="0" pn="section-6.2.3-1">In order to further secure TEAP, implementations can take steps to
increase their security by carefully ordering Inner Methods.  Where
multiple Inner Methods are used, implementations <bcp14>SHOULD</bcp14> choose an
ordering so that the first Inner Method used is one that derives
EMSK.</t>
          <t indent="0" pn="section-6.2.3-2">For an EAP server, it can select the first Inner Method to be one
that derives EMSK. Since ordering of Inner Methods is not otherwise
important in EAP, any chosen order is supported by the peer that
receives this request.</t>
          <t indent="0" pn="section-6.2.3-3">For an EAP peer, it can choose its response to a server's request for
a particular type of authentication.  The peer can ignore that
request and return an Inner Method that derives EMSK.  Again, since
the ordering of Inner Methods is not otherwise important in EAP, any
chosen order is supported by the server that receives this response.
Once the more secure authentication has succeed, the server then
requests the other type of authentication and the peer can respond
with the chosen type of authentication.</t>
          <t indent="0" pn="section-6.2.3-4">Implementations can also provide configuration flags, policies, or
documented recommendations that control the type of Inner Methods
used or verify their order.  These configurations allow
implementations and administrators to control their security exposure
to on-path attackers.</t>
          <t indent="0" pn="section-6.2.3-5">Implementations can permit administrators to configure TEAP so that the
following security checks are enforced:</t>
          <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.3-6">
            <li pn="section-6.2.3-6.1">
              <t indent="0" pn="section-6.2.3-6.1.1">Verifying that the first Inner Method used is one that derives EMSK.
If this is not done, a fatal error can be returned.</t>
            </li>
            <li pn="section-6.2.3-6.2">
              <t indent="0" pn="section-6.2.3-6.2.1">Verifying that if any Inner Method derives EMSK, the received
Crypto-Binding TLV for that method contains an EMSK Compound MAC.
If an EMSK has been derived and no EMSK Compound MAC is seen, a
fatal error can be returned.</t>
            </li>
          </ul>
          <t indent="0" pn="section-6.2.3-7">The goal of these suggestions is to enforce the use of the EMSK
Compound MAC to protect the TEAP session from on-path attackers.  If
these suggestions are not enforced, then the TEAP session is
vulnerable.</t>
          <t indent="0" pn="section-6.2.3-8">Most of these suggestions are not normative, as some existing
implementations are known to not follow them.  Instead, these
suggestions are here to inform new implementors, along with
administrators, of the issues surrounding this subject.</t>
        </section>
        <section anchor="managing-and-computing-crypto-binding" numbered="true" removeInRFC="false" toc="include" pn="section-6.2.4">
          <name slugifiedName="name-managing-and-computing-cryp">Managing and Computing Crypto-Binding</name>
          <t indent="0" pn="section-6.2.4-1">After an Inner Method has been completed successfully and the inner
keys have been derived, the server sends a Crypto-Binding TLV to the peer.  If
the Inner Method has failed, the server does not send a Crypto-Binding
TLV.</t>
          <t indent="0" pn="section-6.2.4-2">The peer verifies the Crypto-Binding TLV by applying the rules defined
in <xref target="crypto-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.13"/>.  If verification passes, the peer responds
with its own Crypto-Binding TLV, which the server in turn verifies.
If at any point verification fails, the party that makes this
determination terminates the session.</t>
          <t indent="0" pn="section-6.2.4-3">The Crypto-Binding TLV is normally sent in conjunction with other TLVs that indicate intermediate or final results or that begin
negotiation of a new Inner Method. This negotiation does not otherwise
affect the Crypto-Binding TLV.</t>
          <t indent="0" pn="section-6.2.4-4">While <xref target="crypto-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.13"/> defines that the Compound MAC fields
exist in the Crypto-Binding TLV, it does not describe the derivation
and management of those fields.  This derivation is complex and
is therefore located here along with the other key derivations.</t>
          <t indent="0" pn="section-6.2.4-5">The following text defines how the server and peer compute, send, and
then verify the Compound MAC fields Crypto-Binding TLV.  Depending on
the Inner Method and site policy, the Crypto-Binding TLV can contain only
an MSK Compound MAC (Flags=2), only the EMSK
Compound MAC (Flags=2), or both Compound MACs
(Flags=3).  Each party to the TEAP session follows its own set of
procedures to compute and verify the Compound MAC fields.</t>
          <t indent="0" pn="section-6.2.4-6">The determination of the contents of the Crypto-Binding TLV is done
separately for each Inner Method.  If at any point the verification of
a Compound MAC fails, the determining party returns a fatal error as
	  described in <xref target="phase-2-errors" format="default" sectionFormat="of" derivedContent="Section 3.9.3"/>.</t>
          <t indent="0" pn="section-6.2.4-7">We presume that each peer and server have site policies that may or may
not require the use of the MSK Compound MAC and/or the EMSK Compound MAC.
These policies can be enforced globally for all Inner Methods, or they can be
enforced separately on each Inner Method.  These policies could be enabled
automatically when the EAP method is known to always generate an EMSK and
could otherwise be configurable.</t>
          <t indent="0" pn="section-6.2.4-8">The server initiates crypto-binding by determining which
Compound MAC(s) to use, computing their value(s), placing the
resulting Compound MAC(s) into the Crypto-Binding TLV, and then sending
it to the peer.</t>
          <t indent="0" pn="section-6.2.4-9">Then, the steps taken by the server are as follows:</t>
          <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-10">
            <li pn="section-6.2.4-10.1">
              <t indent="0" pn="section-6.2.4-10.1.1">If the Inner Method is known to generate only MSK, or if
            the server's policy is to not use EMSK Compound MACs:</t>
              <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-10.1.2">
                <li pn="section-6.2.4-10.1.2.1">The server computes the MSK Compound MAC using the MSK
                of the Inner Method.  The server does not use the EMSK
                Compound MAC field (Flags=2).</li>
              </ul>
              <t indent="0" pn="section-6.2.4-10.1.3">Otherwise, the EMSK is available.</t>
            </li>
            <li pn="section-6.2.4-10.2">
              <t indent="0" pn="section-6.2.4-10.2.1">If the server's policy permits the use of the MSK Compound MAC:</t>
              <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-10.2.2">
                <li pn="section-6.2.4-10.2.2.1">The sender computes the MSK Compound MAC along with
                the EMSK Compound MAC (Flags=3).</li>
              </ul>
              <t indent="0" pn="section-6.2.4-10.2.3">Otherwise, the server's policy does not allow the use of the
              MSK Compound MAC:</t>
              <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-10.2.4">
                <li pn="section-6.2.4-10.2.4.1">The server computes only the EMSK Compound MAC (Flags=1).</li>
              </ul>
            </li>
          </ul>
          <t indent="0" pn="section-6.2.4-11">The peer verifies the Crypto-Binding TLV it receives from the server.
It then replies with its own crypto-binding response by determining
which Compound MAC(s) to use, computing their value(s), placing the
resulting Compound MAC(s) into the Crypto-Binding TLV, and then sending
it to the server.  The result of this process is either a fatal error
or one or more Compound MACs that are placed in the Crypto-Binding
TLV and sent to the server.</t>
          <t indent="0" pn="section-6.2.4-12">Then, the steps taken by the peer are as follows:</t>
          <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-13">
            <li pn="section-6.2.4-13.1">
              <t indent="0" pn="section-6.2.4-13.1.1">If the peer site policy requires the use of the EMSK
            Compound MAC:</t>
              <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-13.1.2">
                <li pn="section-6.2.4-13.1.2.1">The peer checks if the Flags field indicates the presence
                of the EMSK Compound MAC (Flags=1 or 3).  If the Flags field
                has any other value, the peer returns a fatal error.</li>
                <li pn="section-6.2.4-13.1.2.2">The peer checks if the Inner Method has derived an EMSK.
                If not, the peer returns a fatal error.</li>
              </ul>
              <t indent="0" pn="section-6.2.4-13.1.3">Otherwise, the peer site policy does not require the use of the
            EMSK Compound MAC and the EMSK may or may not exist.</t>
            </li>
            <li pn="section-6.2.4-13.2">
              <t indent="0" pn="section-6.2.4-13.2.1">If the Inner Method is known to generate only MSK and not EMSK:</t>
              <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-13.2.2">
                <li pn="section-6.2.4-13.2.2.1">The peer checks if the Flags field indicates that only the
		MSK Compound MAC exists (Flags=2).  If the Flags field has any
		other value, the peer returns a fatal error.</li>
              </ul>
              <t indent="0" pn="section-6.2.4-13.2.3">Otherwise, the MSK exists, the EMSK may or may not exist, and
              the peer allows the use of the EMSK Compound MAC.  The peer may
              have received one or two Compound MACs (Flags=1,2,3).  Any
              Compound MAC that is present is verified.  No further action is
              taken by the peer if a particular Compound MAC is not present.
              No further action is taken by the peer if an unexpected
              Compound MAC is present.</t>
              <t indent="0" pn="section-6.2.4-13.2.4">Note that due to earlier validation of the Flags field (<xref target="crypto-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.13"/>), at least one Compound MAC must
              now exist (Flags=1,2,3).</t>
            </li>
            <li pn="section-6.2.4-13.3">If the peer has received an MSK Compound MAC, it verifies
              it and returns a fatal error if verification fails.</li>
            <li pn="section-6.2.4-13.4">If EMSK is available and the peer has received an EMSK
              Compound MAC, it verifies it and returns a fatal error if
              verification fails.</li>
          </ul>
          <t indent="0" pn="section-6.2.4-14">The peer creates a crypto-binding response by determining which
Compound MAC(s) to use, computing their value(s), placing the
resulting Compound MAC(s) into the Crypto-Binding TLV, and then sending
it to the server.</t>
          <t indent="0" pn="section-6.2.4-15">The steps taken by the peer are then as follows.</t>
          <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-16">
            <li pn="section-6.2.4-16.1">
              <t indent="0" pn="section-6.2.4-16.1.1">If the peer received an MSK Compound MAC from the
            server:</t>
              <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-16.1.2">
                <li pn="section-6.2.4-16.1.2.1">Since the MSK always exists, this step is always
                possible. The peer computes the MSK Compound MAC for the
                response (Flags=2).</li>
              </ul>
            </li>
            <li pn="section-6.2.4-16.2">
              <t indent="0" pn="section-6.2.4-16.2.1">If the peer site policy requires the use of the EMSK Compound MAC:</t>
              <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-16.2.2">
                <li pn="section-6.2.4-16.2.2.1">The preceding steps taken by the peer ensures that the
                EMSK exists and the server had sent an EMSK Compound MAC.
                The peer computes the EMSK Compound MAC for the response.  The
                Flags field is updated (Flags=1,3).</li>
              </ul>
              <t indent="0" pn="section-6.2.4-16.2.3">Otherwise, if the EMSK exists:</t>
              <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-16.2.4">
                <li pn="section-6.2.4-16.2.4.1">The peer computes the EMSK Compound MAC for the
                response. The Flags field is updated (Flags=1,3).</li>
              </ul>
            </li>
          </ul>
          <t indent="0" pn="section-6.2.4-17">The server processes the response from the peer via the following steps:</t>
          <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-18">
            <li pn="section-6.2.4-18.1">
              <t indent="0" pn="section-6.2.4-18.1.1">If the server site policy requires the use of the EMSK Compound MAC:</t>
              <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-18.1.2">
                <li pn="section-6.2.4-18.1.2.1">The server checks if the Flags field indicates the
                presence of the EMSK Compound MAC (Flags=1 or 3).  If the
                Flags field has any other value, the server returns a fatal
                error.</li>
                <li pn="section-6.2.4-18.1.2.2">The server checks if the Inner Method has derived an EMSK.
                If not, the server returns a fatal error.</li>
              </ul>
            </li>
            <li pn="section-6.2.4-18.2">
              <t indent="0" pn="section-6.2.4-18.2.1">If the Inner Method is known to generate only MSK and not EMSK:</t>
              <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.2.4-18.2.2">
                <li pn="section-6.2.4-18.2.2.1">The server checks if the Flags field indicates that only
		the MSK Compound MAC exists (Flags=2).  If the Flags field has
		any other value, the server returns a fatal error.</li>
              </ul>
              <t indent="0" pn="section-6.2.4-18.2.3">Otherwise, the MSK exists and the EMSK may or may not exist.
	      The server may have received one or two Compound MACs
	      (Flags=1,2,3).  Any Compound MAC that is present is verified.
	      No further action is taken by the server if a particular
	      Compound MAC is not present.  No further action is taken by the
	      server if an unexpected Compound MAC is present.</t>
            </li>
            <li pn="section-6.2.4-18.3">If the server has received an MSK Compound MAC, it verifies
              it and returns a fatal error if verification fails.</li>
            <li pn="section-6.2.4-18.4">If EMSK is available and the server has received an EMSK
              Compound MAC, it verifies it and returns a fatal error if
              verification fails.</li>
          </ul>
          <t indent="0" pn="section-6.2.4-19">Once the above steps have concluded, the server either continues
authentication with another Inner Method or it returns a Result TLV.</t>
        </section>
        <section anchor="oops" numbered="true" removeInRFC="false" toc="include" pn="section-6.2.5">
          <name slugifiedName="name-unintended-side-effects">Unintended Side Effects</name>
          <t indent="0" pn="section-6.2.5-1">In earlier drafts of this document, the descriptions of the key
derivations had issues that were only discovered after TEAP had been
widely implemented.  These issues need to be documented in order to
enable interoperable implementations.</t>
          <t indent="0" pn="section-6.2.5-2">As noted above, some inner EAP methods derive MSK but do not derive
EMSK.  When there is no EMSK, it is therefore not possible to derive
IMCK_EMSK[j] from it.  The choice of multiple implementations was
then to simply define:</t>
          <artwork align="left" pn="section-6.2.5-3">
    IMCK_EMSK[j] = IMCK_EMSK[j - 1]</artwork>
          <t indent="0" pn="section-6.2.5-4">This definition can be trivially implemented by simply keeping a
cached copy of IMCK_EMSK in a data structure.  If EMSK is available,
IMCK_EMCK is updated from it via the TLS-PRF function as defined
above.  If EMSK is not available, then the IMCK_EMSK value is
unmodified.</t>
          <t indent="0" pn="section-6.2.5-5">This behavior was not explicitly anticipated by earlier drafts of this
document.  It instead appears to be an accidental outcome of
implementing the derivations above with the limitation of a missing
EMSK.  This behavior is explicitly called out here in the interest of
fully documenting TEAP.</t>
          <t indent="0" pn="section-6.2.5-6">Another unintended consequence is in the calculation of the
Crypto-Binding TLV.  That TLV includes compound MACs that depend on
the MSK and EMSK of the current authentication method.  Where the
current method does not provide an EMSK, the Crypto-Binding TLV does
not include a compound MAC that depends on the EMSK.  Where the
current method does not provide an MSK, the Crypto-Binding TLV
includes a compound MAC that depends on a special "all zero" IMSK as
discussed earlier.</t>
          <t indent="0" pn="section-6.2.5-7">The result of this definition is that the final Crypto-Binding TLV in
an inner TEAP exchange may not include a compound MAC that depends on
EMSK, even if earlier EAP methods in the Phase 2 exchange provided an
EMSK.  This result likely has negative effects on security, though the
	  full impact is unknown at the time of writing this document.</t>
          <t indent="0" pn="section-6.2.5-8">These design flaws have nonetheless resulted in multiple interoperable
implementations.  We note that these implementations seem to support
only EAP-TLS and the EAP-FAST-MSCHAPv2 variant of EAP-MSCHAPv2.  Other
inner EAP methods may work by accident but are not likely to work by
design.  For this document, we can only ensure that the behavior of
TEAPv1 is fully documented, even if that behavior was an unintended
consequence of unclear text in earlier versions of this specification.</t>
          <t indent="0" pn="section-6.2.5-9">We expect that these issues will be addressed in a future revision of
TEAP.</t>
        </section>
      </section>
      <section anchor="computing-compound-mac" numbered="true" removeInRFC="false" toc="include" pn="section-6.3">
        <name slugifiedName="name-computing-the-compound-mac">Computing the Compound MAC</name>
        <t indent="0" pn="section-6.3-1">For Inner Methods that generate keying material, further protection
        against on-path attacks is provided through cryptographically binding
        keying material established by both TEAP Phase 1 and TEAP Phase 2
        conversations. After each successful inner EAP authentication, EAP
        EMSK and/or MSKs are cryptographically combined with key material from
        TEAP Phase 1 to generate a CMK. The CMK is used to calculate the
        Compound MAC as part of the Crypto-Binding TLV described in <xref target="crypto-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.13"/>, which helps provide assurance that the
        same entities are involved in all communications in TEAP.  During the
        calculation of the Compound MAC, the MAC field is filled with
        zeros.</t>
        <t indent="0" pn="section-6.3-2">The Compound MAC computation is as follows:</t>
        <artwork align="left" pn="section-6.3-3">
   Compound MAC = the first 20 octets of MAC( CMK[n], BUFFER )</artwork>
        <t indent="0" pn="section-6.3-4">where n is the number of the last successfully executed inner
method, MAC is the MAC function negotiated in TLS (e.g., TLS 1.2 in <xref target="RFC5246" format="default" sectionFormat="of" derivedContent="RFC5246"/>), and
BUFFER is created after concatenating these fields in the following
	order:</t>
        <ol spacing="normal" type="1" indent="adaptive" start="1" pn="section-6.3-5"><li pn="section-6.3-5.1" derivedCounter="1.">
            <t indent="0" pn="section-6.3-5.1.1">The entire Crypto-Binding TLV attribute with both the EMSK and MSK
 Compound MAC fields zeroed out.</t>
          </li>
          <li pn="section-6.3-5.2" derivedCounter="2.">
            <t indent="0" pn="section-6.3-5.2.1">The EAP Type sent by the other party in the first TEAP message,
which <bcp14>MUST</bcp14> be TEAP, encoded as one octet of 0x37.</t>
          </li>
          <li pn="section-6.3-5.3" derivedCounter="3.">
            <t indent="0" pn="section-6.3-5.3.1">All the Outer TLVs from the first TEAP message sent by the EAP server
to the peer.  If a single TEAP message is fragmented into multiple
TEAP packets, then the Outer TLVs in all the fragments of that
message <bcp14>MUST</bcp14> be included.</t>
          </li>
          <li pn="section-6.3-5.4" derivedCounter="4.">
            <t indent="0" pn="section-6.3-5.4.1">All the Outer TLVs from the first TEAP message sent by the peer to
the EAP server.  If a single TEAP message is fragmented into
multiple TEAP packets, then the Outer TLVs in all the fragments of
that message <bcp14>MUST</bcp14> be included.</t>
          </li>
        </ol>
        <t indent="0" pn="section-6.3-6">If no Inner Method is run, then no MSK or EMSK
will be generated.  If an IMSK needs to be generated, then the MSK
and therefore the IMSK is set to all zeroes (i.e., IMSK = MSK = 32 octets of 0x00s).</t>
        <t indent="0" pn="section-6.3-7">Note that there is no boundary marker between the fields in steps (3)
and (4).  However, the server calculates the compound MAC using the
Outer TLVs it sent and the Outer TLVs it received from the peer.  On
the other side, the peer calculates the compound MAC using the outer
TLVs it sent and the Outer TLVs it received from the server.  As a
result, any modification in transit of the Outer TLVs will be detected
because the two sides will calculate different values for the compound
MAC.</t>
        <t indent="0" pn="section-6.3-8">If no key-generating Inner Method is run, then no MSK or EMSK will be
generated. If an IMSK needs to be generated, then the MSK and therefore
the IMSK is set to all zeroes (i.e., IMSK = MSK = 32 octets of 0x00s)</t>
      </section>
      <section anchor="eap-master-session-key-generation" numbered="true" removeInRFC="false" toc="include" pn="section-6.4">
        <name slugifiedName="name-eap-master-session-key-gene">EAP Master Session Key Generation</name>
        <t indent="0" pn="section-6.4-1">TEAP authentication assures the MSK and EMSK output from running TEAP are the combined result
of all Inner Methods by generating an IMCK.  The IMCK is mutually derived by the peer and
the server as described in <xref target="intermediate-compound-key" format="default" sectionFormat="of" derivedContent="Section 6.2"/> by combining the MSKs from
Inner Methods with key material from TEAP Phase 1.  The resulting
MSK and EMSK are generated from the final ("n"th) Inner Method, as part of the IMCK[n] key hierarchy via the
following derivation:</t>
        <artwork align="left" pn="section-6.4-2">
   MSK  = the first 64 octets of TLS-PRF(S-IMCK[n],
          "Session Key Generating Function")
   EMSK = the first 64 octets of TLS-PRF(S-IMCK[n],
          "Extended Session Key Generating Function")</artwork>
        <t indent="0" pn="section-6.4-3">The secret is S-IMCK[n], where n is the
number of the last generated
S-IMCK[j] from <xref target="intermediate-compound-key" format="default" sectionFormat="of" derivedContent="Section 6.2"/>.  The label is the ASCII
value for the string without quotes.  The seed is empty (0 length) and
is omitted from the derivation.</t>
        <t indent="0" pn="section-6.4-4">The EMSK is typically only known to the TEAP peer and server and is
not provided to a third party.  The derivation of additional keys and
transportation of these keys to a third party are outside the scope
of this document.</t>
        <t indent="0" pn="section-6.4-5">If no Inner Method has created an MSK or EMSK, the MSK
and EMSK will be generated directly from the session_key_seed meaning
S-IMCK[0] = session_key_seed.</t>
        <t indent="0" pn="section-6.4-6">As we noted above, not all Inner Methods generate both MSK and EMSK,
so we have to maintain two independent derivations of S-IMCK[j], one
for each of MSK[j] and EMSK[j].  The final derivation using
S-IMCK[n] must choose only one of these keys.</t>
        <t indent="0" pn="section-6.4-7">If the Crypto-Binding TLV contains an EMSK compound MAC, then the
derivation is taken from the S-IMCK_EMSK[n].  Otherwise, it is taken
from the S-IMCK_MSK[n].</t>
      </section>
    </section>
    <section anchor="iana-considerations" numbered="true" removeInRFC="false" toc="include" pn="section-7">
      <name slugifiedName="name-iana-considerations">IANA Considerations</name>
      <t indent="0" pn="section-7-1">This section provides guidance to the Internet Assigned Numbers
Authority (IANA) regarding registration of values related to the TEAP
protocol in accordance with <xref target="BCP26" format="default" sectionFormat="of" derivedContent="BCP26"/>.</t>
      <t indent="0" pn="section-7-2">Except as noted below, IANA has updated the "Tunnel
Extensible Authentication Protocol (TEAP) Parameters" registry to
change the Reference field in all tables from <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/> to RFC 9930.</t>
      <section anchor="teap-tlv-types" numbered="true" removeInRFC="false" toc="include" pn="section-7.1">
        <name slugifiedName="name-teap-tlv-types">TEAP TLV Types</name>
        <t indent="0" pn="section-7.1-1">IANA has updated the references in the "TEAP TLV Types"
registry from <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/> to RFC 9930 and added TLV 18 and TLV 19 to
the registry.  The Unassigned values then begin at 20 instead of at 18.</t>
        <table align="center" pn="table-3">
          <thead>
            <tr>
              <th align="left" colspan="1" rowspan="1">Value</th>
              <th align="left" colspan="1" rowspan="1">Description</th>
              <th align="left" colspan="1" rowspan="1">Reference</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td align="left" colspan="1" rowspan="1">18</td>
              <td align="left" colspan="1" rowspan="1">CSR-Attributes TLV</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">19</td>
              <td align="left" colspan="1" rowspan="1">Identity-Hint TLV</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">20-16383</td>
              <td colspan="2" align="left" rowspan="1">Unassigned</td>
            </tr>
          </tbody>
        </table>
        <t indent="0" pn="section-7.1-3">IANA has closed the "TEAP PAC TLV (value 11) PAC
Attribute Type Codes" and "TEAP PAC TLV (value 11) PAC-Type Type
Codes" registries to new registrations and updated those registries with the following note:</t>
        <blockquote pn="section-7.1-4">This registry has been closed. See RFC 9930.</blockquote>
      </section>
      <section anchor="teap-error-tlv-value-5-error-codes" numbered="true" removeInRFC="false" toc="include" pn="section-7.2">
        <name slugifiedName="name-teap-error-tlv-value-5-erro">TEAP Error TLV (value 5) Error Codes</name>
        <t indent="0" pn="section-7.2-1">IANA has updated the "TEAP Error TLV (value 5) Error Codes" registry to add the following entries:</t>
        <table align="center" pn="table-4">
          <thead>
            <tr>
              <th align="left" colspan="1" rowspan="1">Value</th>
              <th align="left" colspan="1" rowspan="1">Description</th>
              <th align="left" colspan="1" rowspan="1">Reference</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td align="left" colspan="1" rowspan="1">1032</td>
              <td align="left" colspan="1" rowspan="1">Inner Method not supported</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">2003</td>
              <td align="left" colspan="1" rowspan="1">The Crypto-Binding TLV is invalid (Version, or Received-Ver, or Sub-Type)</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">2004</td>
              <td align="left" colspan="1" rowspan="1">The first Inner Method did not derive EMSK</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">2005</td>
              <td align="left" colspan="1" rowspan="1">The Crypto-Binding TLV did not include a required MSK Compound MAC</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">2006</td>
              <td align="left" colspan="1" rowspan="1">The MSK Compound MAC fails verification</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">2007</td>
              <td align="left" colspan="1" rowspan="1">The Crypto-Binding TLV did not include a required EMSK Compound MAC</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">2008</td>
              <td align="left" colspan="1" rowspan="1">The EMSK Compound MAC fails verification</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">2009</td>
              <td align="left" colspan="1" rowspan="1">The EMSK Compound MAC exists, but the Inner Method did not derive EMSK</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
          </tbody>
        </table>
      </section>
      <section anchor="tls-exporter-labels" numbered="true" removeInRFC="false" toc="include" pn="section-7.3">
        <name slugifiedName="name-tls-exporter-labels">TLS Exporter Labels</name>
        <t indent="0" pn="section-7.3-1">IANA has updated the "TLS Exporter Labels" registry to change the Reference field for Value "EXPORTER: teap session key seed" as follows:</t>
        <table align="center" pn="table-5">
          <thead>
            <tr>
              <th align="left" colspan="1" rowspan="1">Value</th>
              <th align="left" colspan="1" rowspan="1">DTLS-OK</th>
              <th align="left" colspan="1" rowspan="1">Recommended</th>
              <th align="left" colspan="1" rowspan="1">Reference</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td align="left" colspan="1" rowspan="1">EXPORTER: teap session key seed</td>
              <td align="left" colspan="1" rowspan="1">N</td>
              <td align="left" colspan="1" rowspan="1">Y</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
          </tbody>
        </table>
      </section>
      <section anchor="extended-master-session-key-emsk-parameters" numbered="true" removeInRFC="false" toc="include" pn="section-7.4">
        <name slugifiedName="name-extended-master-session-key">Extended Master Session Key (EMSK) Parameters</name>
        <t indent="0" pn="section-7.4-1">IANA has updated the "User Specific Root Keys (USRK) Key Labels" registry to change the Reference field for Value "TEAPbindkey@ietf.org" as follows:</t>
        <table align="center" pn="table-6">
          <thead>
            <tr>
              <th align="left" colspan="1" rowspan="1">Label</th>
              <th align="left" colspan="1" rowspan="1">Description</th>
              <th align="left" colspan="1" rowspan="1">Reference</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td align="left" colspan="1" rowspan="1">TEAPbindkey@ietf.org</td>
              <td align="left" colspan="1" rowspan="1">TEAP binding usage label</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
          </tbody>
        </table>
      </section>
      <section anchor="extensible-authentication-protocol-eap-registry" numbered="true" removeInRFC="false" toc="include" pn="section-7.5">
        <name slugifiedName="name-extensible-authentication-p">Extensible Authentication Protocol (EAP) Registry</name>
        <t indent="0" pn="section-7.5-1">IANA has updated the "Method Types" registry to change the Reference field for Value "55" as follows:</t>
        <table align="center" pn="table-7">
          <thead>
            <tr>
              <th align="left" colspan="1" rowspan="1">Value</th>
              <th align="left" colspan="1" rowspan="1">Description</th>
              <th align="left" colspan="1" rowspan="1">Reference</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td align="left" colspan="1" rowspan="1">55</td>
              <td align="left" colspan="1" rowspan="1">TEAP</td>
              <td align="left" colspan="1" rowspan="1">RFC 9930</td>
            </tr>
          </tbody>
        </table>
      </section>
    </section>
    <section anchor="security-considerations" numbered="true" removeInRFC="false" toc="include" pn="section-8">
      <name slugifiedName="name-security-considerations">Security Considerations</name>
      <t indent="0" pn="section-8-1">TEAP is designed with a focus on wireless media, where the medium
itself is inherent to eavesdropping.  Whereas in wired media an
attacker would have to gain physical access to the wired medium,
wireless media enables anyone to capture information as it is
transmitted over the air, enabling passive attacks.  Thus, physical
security can not be assumed, and security vulnerabilities are far
greater.  The threat model used for the security evaluation of TEAP
is defined in EAP <xref target="RFC3748" format="default" sectionFormat="of" derivedContent="RFC3748"/>.</t>
      <section anchor="mutual-authentication-and-integrity-protection" numbered="true" removeInRFC="false" toc="include" pn="section-8.1">
        <name slugifiedName="name-mutual-authentication-and-i">Mutual Authentication and Integrity Protection</name>
        <t indent="0" pn="section-8.1-1">As a whole, TEAP provides message and integrity protection by
establishing a secure tunnel for protecting the inner
method(s).  The confidentiality and integrity protection is defined
by TLS and provides the same security strengths afforded by TLS
employing a strong entropy shared master secret.  The integrity of
the key generating Inner Methods executed within the TEAP
tunnel is verified through the calculation of the Crypto-Binding TLV.
This ensures that the tunnel endpoints are the same as the inner
method endpoints.</t>
        <t indent="0" pn="section-8.1-2">Where server unauthenticated provisioning is performed, TEAP requires
that the inner provisioning method provide for both peer and server authentication.</t>
      </section>
      <section anchor="method-negotiation" numbered="true" removeInRFC="false" toc="include" pn="section-8.2">
        <name slugifiedName="name-method-negotiation">Method Negotiation</name>
        <t indent="0" pn="section-8.2-1">As is true for any negotiated EAP, EAP NAK messages used to
suggest an alternate EAP authentication method are sent unprotected and,
as such, are subject to spoofing.  During unprotected EAP method
negotiation, NAK packets may be interjected as active attacks to
bid-down to a weaker form of authentication, such as EAP-MD5
(which only provides one-way authentication and does not derive a
key).  Both the peer and server should have a method selection policy
that prevents them from negotiating down to weaker methods.  Inner
method negotiation resists attacks because it is protected by the
mutually authenticated TLS tunnel established.  Selection of TEAP as
an authentication method does not limit the potential inner
methods, so TEAP should be selected when available.</t>
        <t indent="0" pn="section-8.2-2">An attacker cannot readily determine the Inner Method used,
except perhaps by traffic analysis.  It is also important that peer
implementations limit the use of credentials with an unauthenticated
or unauthorized server.</t>
      </section>
      <section anchor="separation-p1-p2" numbered="true" removeInRFC="false" toc="include" pn="section-8.3">
        <name slugifiedName="name-separation-of-phase-1-and-p">Separation of Phase 1 and Phase 2 Servers</name>
        <t indent="0" pn="section-8.3-1">Separation of the TEAP Phase 1 from the Phase 2 conversation is
	<bcp14>NOT RECOMMENDED</bcp14>.  Allowing the Phase 1 conversation to be terminated at a
different server than the Phase 2 conversation can introduce
vulnerabilities if there is not a proper trust relationship and
protection for the protocol between the two servers.  Some
vulnerabilities include:</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-8.3-2">
          <li pn="section-8.3-2.1">
            <t indent="0" pn="section-8.3-2.1.1">Loss of identity protection</t>
          </li>
          <li pn="section-8.3-2.2">
            <t indent="0" pn="section-8.3-2.2.1">Offline dictionary attacks</t>
          </li>
          <li pn="section-8.3-2.3">
            <t indent="0" pn="section-8.3-2.3.1">Lack of policy enforcement</t>
          </li>
          <li pn="section-8.3-2.4">
            <t indent="0" pn="section-8.3-2.4.1">On-path active attacks (as described in <xref target="RFC7029" format="default" sectionFormat="of" derivedContent="RFC7029"/>)</t>
          </li>
        </ul>
        <t indent="0" pn="section-8.3-3">There may be cases where a trust relationship exists between the
Phase 1 and Phase 2 servers, such as on a campus or between two
offices within the same company, where there is no danger in
revealing the inner identity and credentials of the peer to entities
between the two servers.  In these cases, using a proxy solution
without end-to-end protection of TEAP <bcp14>MAY</bcp14> be used.  The TEAP
encrypting/decrypting gateway <bcp14>MUST</bcp14>, at a minimum, provide support for
IPsec, TLS, or similar protection in order to provide confidentiality
for the portion of the conversation between the gateway and the EAP
server.  In addition, separation of the TEAP servers and Inner servers
allows for crypto-binding based on the Inner Method MSK to be
thwarted as described in <xref target="RFC7029" format="default" sectionFormat="of" derivedContent="RFC7029"/>.
If the Inner Method derives an EMSK, then this threat is mitigated as
TEAP uses the Crypto-Binding TLV to tie the inner EMSK to the TLS session via the TLS-PRF, as described above in <xref target="cryptographic-calculations" format="default" sectionFormat="of" derivedContent="Section 6"/>.</t>
        <t indent="0" pn="section-8.3-4">On the other hand, if the Inner Method is not deriving EMSK, as with
password authentication or unauthenticated provisioning, then this
threat still exists.  Implementations therefore need to limit the use of
Inner Methods as discussed above in <xref target="inner-method-limitations" format="default" sectionFormat="of" derivedContent="Section 3.6.5"/></t>
      </section>
      <section anchor="mitigation-of-known-vulnerabilities-and-protocol-deficiencies" numbered="true" removeInRFC="false" toc="include" pn="section-8.4">
        <name slugifiedName="name-mitigation-of-known-vulnera">Mitigation of Known Vulnerabilities and Protocol Deficiencies</name>
        <t indent="0" pn="section-8.4-1">TEAP addresses the known deficiencies and weaknesses in some EAP
authentication methods.  By employing a shared secret between the peer and server to
establish a secured tunnel, TEAP enables:</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-8.4-2">
          <li pn="section-8.4-2.1">
            <t indent="0" pn="section-8.4-2.1.1">Per-packet confidentiality and integrity protection</t>
          </li>
          <li pn="section-8.4-2.2">
            <t indent="0" pn="section-8.4-2.2.1">User identity protection</t>
          </li>
          <li pn="section-8.4-2.3">
            <t indent="0" pn="section-8.4-2.3.1">Better support for notification messages</t>
          </li>
          <li pn="section-8.4-2.4">
            <t indent="0" pn="section-8.4-2.4.1">Protected Inner Method negotiation, including EAP methods</t>
          </li>
          <li pn="section-8.4-2.5">
            <t indent="0" pn="section-8.4-2.5.1">Sequencing of Inner Methods, including EAP methods</t>
          </li>
          <li pn="section-8.4-2.6">
            <t indent="0" pn="section-8.4-2.6.1">Strong mutually derived MSKs</t>
          </li>
          <li pn="section-8.4-2.7">
            <t indent="0" pn="section-8.4-2.7.1">Acknowledged success/failure indication</t>
          </li>
          <li pn="section-8.4-2.8">
            <t indent="0" pn="section-8.4-2.8.1">Faster re-authentications through session resumption</t>
          </li>
          <li pn="section-8.4-2.9">
            <t indent="0" pn="section-8.4-2.9.1">Mitigation of offline dictionary attacks</t>
          </li>
          <li pn="section-8.4-2.10">
            <t indent="0" pn="section-8.4-2.10.1">Mitigation of on-path attacks</t>
          </li>
          <li pn="section-8.4-2.11">
            <t indent="0" pn="section-8.4-2.11.1">Mitigation of some denial-of-service attacks</t>
          </li>
        </ul>
        <t indent="0" pn="section-8.4-3">It should be noted that in TEAP, as in many other authentication
protocols, a denial-of-service attack can be mounted by adversaries
sending erroneous traffic to disrupt the protocol.  This is a problem
in many authentication or key agreement protocols and is therefore
noted for TEAP as well.</t>
        <t indent="0" pn="section-8.4-4">TEAP was designed with a focus on protected Inner Methods
that typically rely on weak credentials, such as password-based
secrets.  To that extent, the TEAP authentication mitigates several
vulnerabilities, such as offline dictionary attacks, by protecting the weak
credential-based Inner Method.  The protection is based on
strong cryptographic algorithms in TLS to provide message
confidentiality and integrity.  The keys derived for the protection
relies on strong random challenges provided by both peer and server
as well as an established key with strong entropy.  Implementations
should follow the recommendation in <xref target="RFC4086" format="default" sectionFormat="of" derivedContent="RFC4086"/> when generating random
numbers.</t>
        <section anchor="user-identity-protection-and-verification" numbered="true" removeInRFC="false" toc="include" pn="section-8.4.1">
          <name slugifiedName="name-user-identity-protection-an">User Identity Protection and Verification</name>
          <t indent="0" pn="section-8.4.1-1">The initial identity request response exchange is sent in cleartext
outside the protection of TEAP.  Typically, the NAI <xref target="RFC7542" format="default" sectionFormat="of" derivedContent="RFC7542"/> in the identity response is useful only
for the realm of information that is used to route the authentication
requests to the right EAP server.  This means that the identity
response may contain an anonymous identity and just contain realm
information.  In other cases, the identity exchange may be eliminated
altogether if there are other means for establishing the destination
realm of the request.  In no case should an intermediary place any
trust in the identity information in the identity response since it
is unauthenticated and may not have any relevance to the
authenticated identity.  TEAP implementations should not attempt to
compare any identity disclosed in the initial cleartext EAP Identity
response packet with those Identities authenticated in Phase 2.</t>
          <t indent="0" pn="section-8.4.1-2">When the server is authenticated, identity request/response exchanges
sent after the TEAP tunnel is established are protected from
modification and eavesdropping by attackers.  For server
unauthenticated provisioning, the outer TLS session provides little
security, and the provisioning method must provide this
protection instead.</t>
          <t indent="0" pn="section-8.4.1-3">When a client certificate is sent outside of the TLS tunnel in Phase
1, the peer <bcp14>MUST</bcp14> include Identity-Type as an Outer TLV in order to
signal the type of identity which that client certificate is for.
Further, when a client certificate is sent outside of the TLS tunnel,
the server <bcp14>MUST</bcp14> proceed with Phase 2.  If there is no Phase 2 data,
then the EAP server <bcp14>MUST</bcp14> reject the session.</t>
          <t indent="0" pn="section-8.4.1-4">Issues related to confidentiality of a client certificate are
discussed above in <xref target="client-certs-phase1" format="default" sectionFormat="of" derivedContent="Section 3.4.1"/></t>
          <t indent="0" pn="section-8.4.1-5">Note that the Phase 2 data could simply be a Result TLV with value
Success, along with a Crypto-Binding TLV.
This Phase 2 data serves as a protected success indication as
discussed in <xref section="2.1.1" sectionFormat="comma" target="RFC9190" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9190#section-2.1.1" derivedContent="RFC9190"/></t>
        </section>
      </section>
      <section anchor="dictionary-attack-resistance" numbered="true" removeInRFC="false" toc="include" pn="section-8.5">
        <name slugifiedName="name-dictionary-attack-resistanc">Dictionary Attack Resistance</name>
        <t indent="0" pn="section-8.5-1">TEAP was designed with a focus on protected Inner Methods
that typically rely on weak credentials, such as password-based
secrets.  TEAP mitigates offline dictionary attacks by allowing the
establishment of a mutually authenticated encrypted TLS tunnel
providing confidentiality and integrity to protect the weak
credential-based Inner Method.</t>
        <t indent="0" pn="section-8.5-2">TEAP mitigates dictionary attacks by permitting Inner Methods, such as
EAP-pwd, that are not vulnerable to dictionary attacks.</t>
        <t indent="0" pn="section-8.5-3">TEAP implementations can mitigate online "brute force"
dictionary attempts by limiting the number of failed authentication
attempts for a particular identity.</t>
        <section anchor="protection-against-on-path-attacks" numbered="true" removeInRFC="false" toc="include" pn="section-8.5.1">
          <name slugifiedName="name-protection-against-on-path-">Protection Against On-Path Attacks</name>
          <t indent="0" pn="section-8.5.1-1">TEAP provides protection from on-path attacks in a few ways:</t>
          <ol spacing="normal" type="1" indent="adaptive" start="1" pn="section-8.5.1-2"><li pn="section-8.5.1-2.1" derivedCounter="1.">
              <t indent="0" pn="section-8.5.1-2.1.1">By using a certificates or a session ticket to mutually
authenticate the peer and server during TEAP authentication Phase 1
establishment of a secure TLS tunnel.</t>
            </li>
            <li pn="section-8.5.1-2.2" derivedCounter="2.">
              <t indent="0" pn="section-8.5.1-2.2.1">When the TLS tunnel is not secured, by using the keys generated by the Inner Method
(if the Inner Methods are key generating) in the crypto-binding
exchange and in the generation of the key material exported by
the Inner Method described in <xref target="cryptographic-calculations" format="default" sectionFormat="of" derivedContent="Section 6"/>.</t>
            </li>
          </ol>
          <t indent="0" pn="section-8.5.1-3">TEAP crypto-binding does not guarantee protection from on-path attacks
if the client allows a connection to an untrusted server, such as in
the case where the client does not properly validate the server's
certificate.  If the TLS cipher suite derives the master secret solely
from the contribution of secret data from one side of the
conversation (such as cipher suites based on RSA key transport), then
an attacker who can convince the client to connect and engage in
authentication can impersonate the client to another server even if a
strong Inner Method is executed within the tunnel.  If the TLS
cipher suite derives the master secret from the contribution of
secrets from both sides of the conversation (such as in cipher suites
based on Diffie-Hellman), then crypto-binding can detect an attacker
in the conversation if a strong Inner Method is used.</t>
          <t indent="0" pn="section-8.5.1-4">TEAP crypto-binding does not guarantee protection from on-path attacks
when the client does not verify the server, and the Inner Method does
not produce an EMSK.  The only way to close this vulnerability is to
define TEAPv2, which would then have different crypto-binding
derivations.</t>
        </section>
      </section>
      <section anchor="protecting-against-forged-cleartext-eap-packets" numbered="true" removeInRFC="false" toc="include" pn="section-8.6">
        <name slugifiedName="name-protecting-against-forged-c">Protecting Against Forged Cleartext EAP Packets</name>
        <t indent="0" pn="section-8.6-1">EAP Success and EAP Failure packets are, in general, sent in
cleartext and may be forged by an attacker without detection.  Forged
EAP Failure packets can be used to attempt to convince an EAP peer to
disconnect.  Forged EAP Success packets may be used to attempt to
convince a peer that authentication has succeeded, even though the
authenticator has not authenticated itself to the peer.</t>
        <t indent="0" pn="section-8.6-2">By providing message confidentiality and integrity, TEAP provides
protection against these attacks.  Once the peer and authentication server (AS) initiate the TEAP authentication Phase 2, compliant TEAP
implementations <bcp14>MUST</bcp14> silently discard all cleartext EAP messages,
unless both the TEAP peer and server have indicated success or
failure using a protected mechanism.  Protected mechanisms include
the TLS alert mechanism and the protected termination mechanism
described in <xref target="protected-termination" format="default" sectionFormat="of" derivedContent="Section 3.6.6"/>.</t>
        <t indent="0" pn="section-8.6-3">The success/failure decisions within the TEAP tunnel indicate the
final decision of the TEAP authentication conversation.  After a
success/failure result has been indicated by a protected mechanism,
the TEAP peer can process unprotected EAP Success and EAP Failure
messages; however, the peer <bcp14>MUST</bcp14> ignore any unprotected EAP Success
or Failure messages where the result does not match the result of the
protected mechanism.</t>
        <t indent="0" pn="section-8.6-4">To abide by <xref target="RFC3748" format="default" sectionFormat="of" derivedContent="RFC3748"/>, the server sends a cleartext EAP Success or
EAP Failure packet to terminate the EAP conversation.  However, since
EAP Success and EAP Failure packets are not retransmitted, the final
packet may be lost.  While a TEAP-protected EAP Success or EAP
Failure packet should not be a final packet in a TEAP conversation,
it may occur based on the conditions stated above, so an EAP peer
should not rely upon the unprotected EAP Success and Failure
messages.</t>
      </section>
      <section anchor="use-of-clear-text-passwords" numbered="true" removeInRFC="false" toc="include" pn="section-8.7">
        <name slugifiedName="name-use-of-cleartext-passwords">Use of Cleartext Passwords</name>
        <t indent="0" pn="section-8.7-1">TEAP can carry cleartext passwords in the Basic-Password-Auth-Resp
TLV.  Implementations should take care to protect this data.  For
example, passwords should not normally be logged, and password data
should be securely scrubbed from memory when it is no longer needed.</t>
      </section>
      <section anchor="accidental-or-unintended-behavior" numbered="true" removeInRFC="false" toc="include" pn="section-8.8">
        <name slugifiedName="name-accidental-or-unintended-be">Accidental or Unintended Behavior</name>
        <t indent="0" pn="section-8.8-1">Due to the complexity of TEAP, and the long time between <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/>
and any substantial implementation, there are many accidental or
unintended behaviors in the protocol.</t>
        <t indent="0" pn="section-8.8-2">The first one is that EAP-FAST-MSCHAPv2 is used instead of
EAP-MSCHAPv2.  While <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/> defined TEAP to use EAP-MSCHAPv2, an
early implementor or implementors instead used EAP-FAST-MSCHAPv2.  The
choice for this document was either to define a new version of TEAP
that used EAP-MSCHAPv2 or instead to document implemented behavior.
The choice taken here was to document running code.</t>
        <t indent="0" pn="section-8.8-3">The issues discussed in <xref target="oops" format="default" sectionFormat="of" derivedContent="Section 6.2.5"/> could have security impacts, but no
analysis has been performed.  The choice of using a special "all zero"
IMSK in <xref target="intermediate-compound-key" format="default" sectionFormat="of" derivedContent="Section 6.2"/> was made for simplicity but could
also have negative security impacts.</t>
        <t indent="0" pn="section-8.8-4">The definition of the Crypto-Binding TLV means that the final
Crypto-Binding TLV values might not depend on all previous values of
MSK and EMSK.  This limitation could have negative security impacts,
but again, no analysis has been performed.</t>
        <t indent="0" pn="section-8.8-5">We suggest that the TEAP be revised to TEAP version 2, which
could address these issues.  There are proposals at this time to
better derive the various keying materials and cryptographic binding
derivations.  However, in the interest of documenting running code, we
are publishing this document with the acknowledgment that there are
improvements to be made.</t>
      </section>
      <section anchor="implicit-challenge" numbered="true" removeInRFC="false" toc="include" pn="section-8.9">
        <name slugifiedName="name-implicit-challenge">Implicit Challenge</name>
        <t indent="0" pn="section-8.9-1">Certain authentication protocols that use a challenge/response
mechanism rely on challenge material that is not generated by the
authentication server; therefore, the material may require special
handling.  For EAP-TTLS, these challenges are defined in <xref section="11.1" sectionFormat="comma" target="RFC5281" format="default" derivedLink="https://rfc-editor.org/rfc/rfc5281#section-11.1" derivedContent="RFC5281"/>.</t>
        <t indent="0" pn="section-8.9-2">In EAP-MSCHAPv2, the authenticator issues a challenge to the
supplicant. Then, the supplicant hashes the challenge with the password
and forwards the response to the authenticator. The response also
includes a Peer-Challenge, which is created by the supplicant.  Since
the challenge is random, it is not associated with the TLS tunnel and
the protocol may be susceptible to a replay attack.</t>
        <t indent="0" pn="section-8.9-3">The Crypto-Binding TLV provides protection against intermediaries, but
it does not provide protection against a replay attack.  We suggest
that any TEAPv2 specification correct this issue.</t>
      </section>
      <section anchor="security-claims" numbered="true" removeInRFC="false" toc="include" pn="section-8.10">
        <name slugifiedName="name-security-claims">Security Claims</name>
        <t indent="0" pn="section-8.10-1">This section provides the needed security claim requirement for EAP
<xref target="RFC3748" format="default" sectionFormat="of" derivedContent="RFC3748"/>.</t>
        <dl spacing="normal" newline="false" indent="3" pn="section-8.10-2">
          <dt pn="section-8.10-2.1">Auth. mechanism:</dt>
          <dd pn="section-8.10-2.2">         Certificate-based, shared-secret-based, and
                         various tunneled authentication mechanisms.</dd>
          <dt pn="section-8.10-2.3">Cipher Suite negotiation:</dt>
          <dd pn="section-8.10-2.4">Yes</dd>
          <dt pn="section-8.10-2.5">Mutual authentication:</dt>
          <dd pn="section-8.10-2.6">   Yes</dd>
          <dt pn="section-8.10-2.7">Integrity protection:</dt>
          <dd pn="section-8.10-2.8">    Yes.  Any method executed within the TEAP
                         tunnel is integrity protected.  The
                         cleartext EAP headers outside the tunnel are
                         not integrity protected.  Server
                         unauthenticated provisioning provides its own
                         protection mechanisms.</dd>
          <dt pn="section-8.10-2.9">Replay protection:</dt>
          <dd pn="section-8.10-2.10">       Yes</dd>
          <dt pn="section-8.10-2.11">Confidentiality:</dt>
          <dd pn="section-8.10-2.12">         Yes</dd>
          <dt pn="section-8.10-2.13">Key derivation:</dt>
          <dd pn="section-8.10-2.14">          Yes</dd>
          <dt pn="section-8.10-2.15">Key strength:</dt>
          <dd pn="section-8.10-2.16">            See Note 1 below.</dd>
          <dt pn="section-8.10-2.17">Dictionary attack prot.:</dt>
          <dd pn="section-8.10-2.18"> See Note 2 below.</dd>
          <dt pn="section-8.10-2.19">Fast reconnect:</dt>
          <dd pn="section-8.10-2.20">          Yes</dd>
          <dt pn="section-8.10-2.21">Cryptographic binding:</dt>
          <dd pn="section-8.10-2.22">   Yes</dd>
          <dt pn="section-8.10-2.23">Session independence:</dt>
          <dd pn="section-8.10-2.24">    Yes</dd>
          <dt pn="section-8.10-2.25">Fragmentation:</dt>
          <dd pn="section-8.10-2.26">           Yes</dd>
          <dt pn="section-8.10-2.27">Key Hierarchy:</dt>
          <dd pn="section-8.10-2.28">           Yes</dd>
          <dt pn="section-8.10-2.29">Channel binding:</dt>
          <dd pn="section-8.10-2.30">         Yes</dd>
        </dl>
        <t indent="0" pn="section-8.10-3">Notes:</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-8.10-4">
          <li pn="section-8.10-4.1">
            <t indent="0" pn="section-8.10-4.1.1">Note 1. <xref target="BCP86" format="default" sectionFormat="of" derivedContent="BCP86"/> offers advice on appropriate
  key sizes.  The National Institute for Standards and Technology (NIST) also
  offers advice on appropriate key sizes in <xref target="NIST-SP-800-57" format="default" sectionFormat="of" derivedContent="NIST-SP-800-57"/>. <xref target="RFC3766" sectionFormat="comma" section="6" format="default" derivedLink="https://rfc-editor.org/rfc/rfc3766#section-6" derivedContent="RFC3766"/> advises use of the following required RSA or Diffie-Hellman (DH) module and
  Digital Signature Algorithm (DSA) subgroup size in bits for a given level of
  attack resistance in bits.  Based on the table below, a 2048-bit RSA key is
  required to provide 112-bit equivalent key strength:</t>
            <table align="center" pn="table-8">
              <thead>
                <tr>
                  <th align="left" colspan="1" rowspan="1">Attack Resistance (bits)</th>
                  <th align="left" colspan="1" rowspan="1">RSA or DH Modulus size (bits)</th>
                  <th align="left" colspan="1" rowspan="1">DSA subgroup size (bits)</th>
                </tr>
              </thead>
              <tbody>
                <tr>
                  <td align="left" colspan="1" rowspan="1">70</td>
                  <td align="left" colspan="1" rowspan="1">                        947</td>
                  <td align="left" colspan="1" rowspan="1">                         129</td>
                </tr>
                <tr>
                  <td align="left" colspan="1" rowspan="1">80</td>
                  <td align="left" colspan="1" rowspan="1">                        1228</td>
                  <td align="left" colspan="1" rowspan="1">                         148</td>
                </tr>
                <tr>
                  <td align="left" colspan="1" rowspan="1">90</td>
                  <td align="left" colspan="1" rowspan="1">                        1553</td>
                  <td align="left" colspan="1" rowspan="1">                         167</td>
                </tr>
                <tr>
                  <td align="left" colspan="1" rowspan="1">100</td>
                  <td align="left" colspan="1" rowspan="1">                        1926</td>
                  <td align="left" colspan="1" rowspan="1">                         186</td>
                </tr>
                <tr>
                  <td align="left" colspan="1" rowspan="1">150</td>
                  <td align="left" colspan="1" rowspan="1">                        4575</td>
                  <td align="left" colspan="1" rowspan="1">                         284</td>
                </tr>
                <tr>
                  <td align="left" colspan="1" rowspan="1">200</td>
                  <td align="left" colspan="1" rowspan="1">                        8719</td>
                  <td align="left" colspan="1" rowspan="1">                         383</td>
                </tr>
                <tr>
                  <td align="left" colspan="1" rowspan="1">250</td>
                  <td align="left" colspan="1" rowspan="1">                       14596</td>
                  <td align="left" colspan="1" rowspan="1">                         482</td>
                </tr>
              </tbody>
            </table>
          </li>
          <li pn="section-8.10-4.2">
            <t indent="0" pn="section-8.10-4.2.1">Note 2. TEAP protects against offline dictionary attacks when secure
  Inner Methods are used.  TEAP protects against online dictionary attacks by
  limiting the number of failed authentications for a particular identity.</t>
          </li>
        </ul>
      </section>
    </section>
  </middle>
  <back>
    <displayreference target="I-D.kamath-pppext-eap-mschapv2" to="KAMATH"/>
    <references anchor="sec-combined-references" pn="section-9">
      <name slugifiedName="name-references">References</name>
      <references anchor="sec-normative-references" pn="section-9.1">
        <name slugifiedName="name-normative-references">Normative References</name>
        <reference anchor="RFC2119" target="https://www.rfc-editor.org/info/rfc2119" quoteTitle="true" derivedAnchor="RFC2119">
          <front>
            <title>Key words for use in RFCs to Indicate Requirement Levels</title>
            <author fullname="S. Bradner" initials="S." surname="Bradner"/>
            <date month="March" year="1997"/>
            <abstract>
              <t indent="0">In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="14"/>
          <seriesInfo name="RFC" value="2119"/>
          <seriesInfo name="DOI" value="10.17487/RFC2119"/>
        </reference>
        <reference anchor="RFC2985" target="https://www.rfc-editor.org/info/rfc2985" quoteTitle="true" derivedAnchor="RFC2985">
          <front>
            <title>PKCS #9: Selected Object Classes and Attribute Types Version 2.0</title>
            <author fullname="M. Nystrom" initials="M." surname="Nystrom"/>
            <author fullname="B. Kaliski" initials="B." surname="Kaliski"/>
            <date month="November" year="2000"/>
            <abstract>
              <t indent="0">This memo represents a republication of PKCS #9 v2.0 from RSA Laboratories' Public-Key Cryptography Standards (PKCS) series, and change control is retained within the PKCS process. The body of this document, except for the security considerations section, is taken directly from that specification. This memo provides information for the Internet community.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="2985"/>
          <seriesInfo name="DOI" value="10.17487/RFC2985"/>
        </reference>
        <reference anchor="RFC2986" target="https://www.rfc-editor.org/info/rfc2986" quoteTitle="true" derivedAnchor="RFC2986">
          <front>
            <title>PKCS #10: Certification Request Syntax Specification Version 1.7</title>
            <author fullname="M. Nystrom" initials="M." surname="Nystrom"/>
            <author fullname="B. Kaliski" initials="B." surname="Kaliski"/>
            <date month="November" year="2000"/>
            <abstract>
              <t indent="0">This memo represents a republication of PKCS #10 v1.7 from RSA Laboratories' Public-Key Cryptography Standards (PKCS) series, and change control is retained within the PKCS process. The body of this document, except for the security considerations section, is taken directly from the PKCS #9 v2.0 or the PKCS #10 v1.7 document. This memo provides information for the Internet community.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="2986"/>
          <seriesInfo name="DOI" value="10.17487/RFC2986"/>
        </reference>
        <reference anchor="RFC3748" target="https://www.rfc-editor.org/info/rfc3748" quoteTitle="true" derivedAnchor="RFC3748">
          <front>
            <title>Extensible Authentication Protocol (EAP)</title>
            <author fullname="B. Aboba" initials="B." surname="Aboba"/>
            <author fullname="L. Blunk" initials="L." surname="Blunk"/>
            <author fullname="J. Vollbrecht" initials="J." surname="Vollbrecht"/>
            <author fullname="J. Carlson" initials="J." surname="Carlson"/>
            <author fullname="H. Levkowetz" initials="H." role="editor" surname="Levkowetz"/>
            <date month="June" year="2004"/>
            <abstract>
              <t indent="0">This document defines the Extensible Authentication Protocol (EAP), an authentication framework which supports multiple authentication methods. EAP typically runs directly over data link layers such as Point-to-Point Protocol (PPP) or IEEE 802, without requiring IP. EAP provides its own support for duplicate elimination and retransmission, but is reliant on lower layer ordering guarantees. Fragmentation is not supported within EAP itself; however, individual EAP methods may support this. This document obsoletes RFC 2284. A summary of the changes between this document and RFC 2284 is available in Appendix A. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="3748"/>
          <seriesInfo name="DOI" value="10.17487/RFC3748"/>
        </reference>
        <reference anchor="RFC5077" target="https://www.rfc-editor.org/info/rfc5077" quoteTitle="true" derivedAnchor="RFC5077">
          <front>
            <title>Transport Layer Security (TLS) Session Resumption without Server-Side State</title>
            <author fullname="J. Salowey" initials="J." surname="Salowey"/>
            <author fullname="H. Zhou" initials="H." surname="Zhou"/>
            <author fullname="P. Eronen" initials="P." surname="Eronen"/>
            <author fullname="H. Tschofenig" initials="H." surname="Tschofenig"/>
            <date month="January" year="2008"/>
            <abstract>
              <t indent="0">This document describes a mechanism that enables the Transport Layer Security (TLS) server to resume sessions and avoid keeping per-client session state. The TLS server encapsulates the session state into a ticket and forwards it to the client. The client can subsequently resume a session using the obtained ticket. This document obsoletes RFC 4507. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5077"/>
          <seriesInfo name="DOI" value="10.17487/RFC5077"/>
        </reference>
        <reference anchor="RFC5216" target="https://www.rfc-editor.org/info/rfc5216" quoteTitle="true" derivedAnchor="RFC5216">
          <front>
            <title>The EAP-TLS Authentication Protocol</title>
            <author fullname="D. Simon" initials="D." surname="Simon"/>
            <author fullname="B. Aboba" initials="B." surname="Aboba"/>
            <author fullname="R. Hurst" initials="R." surname="Hurst"/>
            <date month="March" year="2008"/>
            <abstract>
              <t indent="0">The Extensible Authentication Protocol (EAP), defined in RFC 3748, provides support for multiple authentication methods. Transport Layer Security (TLS) provides for mutual authentication, integrity-protected ciphersuite negotiation, and key exchange between two endpoints. This document defines EAP-TLS, which includes support for certificate-based mutual authentication and key derivation.</t>
              <t indent="0">This document obsoletes RFC 2716. A summary of the changes between this document and RFC 2716 is available in Appendix A. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5216"/>
          <seriesInfo name="DOI" value="10.17487/RFC5216"/>
        </reference>
        <reference anchor="RFC5246" target="https://www.rfc-editor.org/info/rfc5246" quoteTitle="true" derivedAnchor="RFC5246">
          <front>
            <title>The Transport Layer Security (TLS) Protocol Version 1.2</title>
            <author fullname="T. Dierks" initials="T." surname="Dierks"/>
            <author fullname="E. Rescorla" initials="E." surname="Rescorla"/>
            <date month="August" year="2008"/>
            <abstract>
              <t indent="0">This document specifies Version 1.2 of the Transport Layer Security (TLS) protocol. The TLS protocol provides communications security over the Internet. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5246"/>
          <seriesInfo name="DOI" value="10.17487/RFC5246"/>
        </reference>
        <reference anchor="RFC5295" target="https://www.rfc-editor.org/info/rfc5295" quoteTitle="true" derivedAnchor="RFC5295">
          <front>
            <title>Specification for the Derivation of Root Keys from an Extended Master Session Key (EMSK)</title>
            <author fullname="J. Salowey" initials="J." surname="Salowey"/>
            <author fullname="L. Dondeti" initials="L." surname="Dondeti"/>
            <author fullname="V. Narayanan" initials="V." surname="Narayanan"/>
            <author fullname="M. Nakhjiri" initials="M." surname="Nakhjiri"/>
            <date month="August" year="2008"/>
            <abstract>
              <t indent="0">The Extensible Authentication Protocol (EAP) defined the Extended Master Session Key (EMSK) generation, but reserved it for unspecified future uses. This memo reserves the EMSK for the sole purpose of deriving root keys. Root keys are master keys that can be used for multiple purposes, identified by usage definitions. This document also specifies a mechanism for avoiding conflicts between root keys by deriving them in a manner that guarantees cryptographic separation. Finally, this document also defines one such root key usage: Domain-Specific Root Keys are root keys made available to and used within specific key management domains. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5295"/>
          <seriesInfo name="DOI" value="10.17487/RFC5295"/>
        </reference>
        <reference anchor="RFC5705" target="https://www.rfc-editor.org/info/rfc5705" quoteTitle="true" derivedAnchor="RFC5705">
          <front>
            <title>Keying Material Exporters for Transport Layer Security (TLS)</title>
            <author fullname="E. Rescorla" initials="E." surname="Rescorla"/>
            <date month="March" year="2010"/>
            <abstract>
              <t indent="0">A number of protocols wish to leverage Transport Layer Security (TLS) to perform key establishment but then use some of the keying material for their own purposes. This document describes a general mechanism for allowing that. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5705"/>
          <seriesInfo name="DOI" value="10.17487/RFC5705"/>
        </reference>
        <reference anchor="RFC5746" target="https://www.rfc-editor.org/info/rfc5746" quoteTitle="true" derivedAnchor="RFC5746">
          <front>
            <title>Transport Layer Security (TLS) Renegotiation Indication Extension</title>
            <author fullname="E. Rescorla" initials="E." surname="Rescorla"/>
            <author fullname="M. Ray" initials="M." surname="Ray"/>
            <author fullname="S. Dispensa" initials="S." surname="Dispensa"/>
            <author fullname="N. Oskov" initials="N." surname="Oskov"/>
            <date month="February" year="2010"/>
            <abstract>
              <t indent="0">Secure Socket Layer (SSL) and Transport Layer Security (TLS) renegotiation are vulnerable to an attack in which the attacker forms a TLS connection with the target server, injects content of his choice, and then splices in a new TLS connection from a client. The server treats the client's initial TLS handshake as a renegotiation and thus believes that the initial data transmitted by the attacker is from the same entity as the subsequent client data. This specification defines a TLS extension to cryptographically tie renegotiations to the TLS connections they are being performed over, thus preventing this attack. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5746"/>
          <seriesInfo name="DOI" value="10.17487/RFC5746"/>
        </reference>
        <reference anchor="RFC5929" target="https://www.rfc-editor.org/info/rfc5929" quoteTitle="true" derivedAnchor="RFC5929">
          <front>
            <title>Channel Bindings for TLS</title>
            <author fullname="J. Altman" initials="J." surname="Altman"/>
            <author fullname="N. Williams" initials="N." surname="Williams"/>
            <author fullname="L. Zhu" initials="L." surname="Zhu"/>
            <date month="July" year="2010"/>
            <abstract>
              <t indent="0">This document defines three channel binding types for Transport Layer Security (TLS), tls-unique, tls-server-end-point, and tls-unique-for-telnet, in accordance with RFC 5056 (On Channel Binding).</t>
              <t indent="0">Note that based on implementation experience, this document changes the original definition of 'tls-unique' channel binding type in the channel binding type IANA registry. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5929"/>
          <seriesInfo name="DOI" value="10.17487/RFC5929"/>
        </reference>
        <reference anchor="RFC6677" target="https://www.rfc-editor.org/info/rfc6677" quoteTitle="true" derivedAnchor="RFC6677">
          <front>
            <title>Channel-Binding Support for Extensible Authentication Protocol (EAP) Methods</title>
            <author fullname="S. Hartman" initials="S." role="editor" surname="Hartman"/>
            <author fullname="T. Clancy" initials="T." surname="Clancy"/>
            <author fullname="K. Hoeper" initials="K." surname="Hoeper"/>
            <date month="July" year="2012"/>
            <abstract>
              <t indent="0">This document defines how to implement channel bindings for Extensible Authentication Protocol (EAP) methods to address the "lying Network Access Service (NAS)" problem as well as the "lying provider" problem. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6677"/>
          <seriesInfo name="DOI" value="10.17487/RFC6677"/>
        </reference>
        <reference anchor="RFC7030" target="https://www.rfc-editor.org/info/rfc7030" quoteTitle="true" derivedAnchor="RFC7030">
          <front>
            <title>Enrollment over Secure Transport</title>
            <author fullname="M. Pritikin" initials="M." role="editor" surname="Pritikin"/>
            <author fullname="P. Yee" initials="P." role="editor" surname="Yee"/>
            <author fullname="D. Harkins" initials="D." role="editor" surname="Harkins"/>
            <date month="October" year="2013"/>
            <abstract>
              <t indent="0">This document profiles certificate enrollment for clients using Certificate Management over CMS (CMC) messages over a secure transport. This profile, called Enrollment over Secure Transport (EST), describes a simple, yet functional, certificate management protocol targeting Public Key Infrastructure (PKI) clients that need to acquire client certificates and associated Certification Authority (CA) certificates. It also supports client-generated public/private key pairs as well as key pairs generated by the CA.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7030"/>
          <seriesInfo name="DOI" value="10.17487/RFC7030"/>
        </reference>
        <reference anchor="RFC8174" target="https://www.rfc-editor.org/info/rfc8174" quoteTitle="true" derivedAnchor="RFC8174">
          <front>
            <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
            <author fullname="B. Leiba" initials="B." surname="Leiba"/>
            <date month="May" year="2017"/>
            <abstract>
              <t indent="0">RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="14"/>
          <seriesInfo name="RFC" value="8174"/>
          <seriesInfo name="DOI" value="10.17487/RFC8174"/>
        </reference>
        <reference anchor="RFC8446" target="https://www.rfc-editor.org/info/rfc8446" quoteTitle="true" derivedAnchor="RFC8446">
          <front>
            <title>The Transport Layer Security (TLS) Protocol Version 1.3</title>
            <author fullname="E. Rescorla" initials="E." surname="Rescorla"/>
            <date month="August" year="2018"/>
            <abstract>
              <t indent="0">This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery.</t>
              <t indent="0">This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8446"/>
          <seriesInfo name="DOI" value="10.17487/RFC8446"/>
        </reference>
        <reference anchor="RFC8996" target="https://www.rfc-editor.org/info/rfc8996" quoteTitle="true" derivedAnchor="RFC8996">
          <front>
            <title>Deprecating TLS 1.0 and TLS 1.1</title>
            <author fullname="K. Moriarty" initials="K." surname="Moriarty"/>
            <author fullname="S. Farrell" initials="S." surname="Farrell"/>
            <date month="March" year="2021"/>
            <abstract>
              <t indent="0">This document formally deprecates Transport Layer Security (TLS) versions 1.0 (RFC 2246) and 1.1 (RFC 4346). Accordingly, those documents have been moved to Historic status. These versions lack support for current and recommended cryptographic algorithms and mechanisms, and various government and industry profiles of applications using TLS now mandate avoiding these old TLS versions. TLS version 1.2 became the recommended version for IETF protocols in 2008 (subsequently being obsoleted by TLS version 1.3 in 2018), providing sufficient time to transition away from older versions. Removing support for older versions from implementations reduces the attack surface, reduces opportunity for misconfiguration, and streamlines library and product maintenance.</t>
              <t indent="0">This document also deprecates Datagram TLS (DTLS) version 1.0 (RFC 4347) but not DTLS version 1.2, and there is no DTLS version 1.1.</t>
              <t indent="0">This document updates many RFCs that normatively refer to TLS version 1.0 or TLS version 1.1, as described herein. This document also updates the best practices for TLS usage in RFC 7525; hence, it is part of BCP 195.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="195"/>
          <seriesInfo name="RFC" value="8996"/>
          <seriesInfo name="DOI" value="10.17487/RFC8996"/>
        </reference>
        <reference anchor="RFC9190" target="https://www.rfc-editor.org/info/rfc9190" quoteTitle="true" derivedAnchor="RFC9190">
          <front>
            <title>EAP-TLS 1.3: Using the Extensible Authentication Protocol with TLS 1.3</title>
            <author fullname="J. Preuß Mattsson" initials="J." surname="Preuß Mattsson"/>
            <author fullname="M. Sethi" initials="M." surname="Sethi"/>
            <date month="February" year="2022"/>
            <abstract>
              <t indent="0">The Extensible Authentication Protocol (EAP), defined in RFC 3748, provides a standard mechanism for support of multiple authentication methods. This document specifies the use of EAP-TLS with TLS 1.3 while remaining backwards compatible with existing implementations of EAP-TLS. TLS 1.3 provides significantly improved security and privacy, and reduced latency when compared to earlier versions of TLS. EAP-TLS with TLS 1.3 (EAP-TLS 1.3) further improves security and privacy by always providing forward secrecy, never disclosing the peer identity, and by mandating use of revocation checking when compared to EAP-TLS with earlier versions of TLS. This document also provides guidance on authentication, authorization, and resumption for EAP-TLS in general (regardless of the underlying TLS version used). This document updates RFC 5216.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="9190"/>
          <seriesInfo name="DOI" value="10.17487/RFC9190"/>
        </reference>
        <reference anchor="RFC9427" target="https://www.rfc-editor.org/info/rfc9427" quoteTitle="true" derivedAnchor="RFC9427">
          <front>
            <title>TLS-Based Extensible Authentication Protocol (EAP) Types for Use with TLS 1.3</title>
            <author fullname="A. DeKok" initials="A." surname="DeKok"/>
            <date month="June" year="2023"/>
            <abstract>
              <t indent="0">The Extensible Authentication Protocol-TLS (EAP-TLS) (RFC 5216) has been updated for TLS 1.3 in RFC 9190. Many other EAP Types also depend on TLS, such as EAP-Flexible Authentication via Secure Tunneling (EAP-FAST) (RFC 4851), EAP-Tunneled TLS (EAP-TTLS) (RFC 5281), the Tunnel Extensible Authentication Protocol (TEAP) (RFC 7170). It is possible that many vendor-specific EAP methods, such as the Protected Extensible Authentication Protocol (PEAP), depend on TLS as well. This document updates those methods in order to use the new key derivation methods available in TLS 1.3. Additional changes necessitated by TLS 1.3 are also discussed.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="9427"/>
          <seriesInfo name="DOI" value="10.17487/RFC9427"/>
        </reference>
        <reference anchor="RFC9525" target="https://www.rfc-editor.org/info/rfc9525" quoteTitle="true" derivedAnchor="RFC9525">
          <front>
            <title>Service Identity in TLS</title>
            <author fullname="P. Saint-Andre" initials="P." surname="Saint-Andre"/>
            <author fullname="R. Salz" initials="R." surname="Salz"/>
            <date month="November" year="2023"/>
            <abstract>
              <t indent="0">Many application technologies enable secure communication between two entities by means of Transport Layer Security (TLS) with Internet Public Key Infrastructure using X.509 (PKIX) certificates. This document specifies procedures for representing and verifying the identity of application services in such interactions.</t>
              <t indent="0">This document obsoletes RFC 6125.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="9525"/>
          <seriesInfo name="DOI" value="10.17487/RFC9525"/>
        </reference>
        <reference anchor="RFC9908" target="https://www.rfc-editor.org/info/rfc9908" quoteTitle="true" derivedAnchor="RFC9908">
          <front>
            <title>Clarification and Enhancement of the CSR Attributes Definition in RFC 7030</title>
            <author fullname="M. Richardson" initials="M." role="editor" surname="Richardson"/>
            <author fullname="O. Friel" initials="O." surname="Friel"/>
            <author fullname="D. von Oheimb" initials="D." surname="von Oheimb"/>
            <author fullname="D. Harkins" initials="D." surname="Harkins"/>
            <date month="January" year="2026"/>
            <abstract>
              <t indent="0">This document updates RFC 7030, "Enrollment over Secure Transport" (EST), clarifying how the Certificate Signing Request (CSR) Attributes Response can be used by an EST server to specify both CSR attribute Object Identifiers (OIDs) and CSR attribute values, particularly X.509 extension values, that the server expects the client to include in a subsequent CSR request. RFC 9148 is derived from RFC 7030 and is also updated.</t>
              <t indent="0">RFC 7030 is ambiguous in its specification of the CSR Attributes Response. This has resulted in implementation challenges and implementor confusion because there was no universal understanding of what was specified. This document clarifies the encoding rules.</t>
              <t indent="0">This document also provides a new straightforward approach: using a template for CSR contents that may be partially filled in by the server. This also allows an EST server to specify a subject Distinguished Name (DN).</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="9908"/>
          <seriesInfo name="DOI" value="10.17487/RFC9908"/>
        </reference>
      </references>
      <references anchor="sec-informative-references" pn="section-9.2">
        <name slugifiedName="name-informative-references">Informative References</name>
        <referencegroup anchor="BCP26" target="https://www.rfc-editor.org/info/bcp26" derivedAnchor="BCP26">
          <reference anchor="RFC8126" target="https://www.rfc-editor.org/info/rfc8126" quoteTitle="true">
            <front>
              <title>Guidelines for Writing an IANA Considerations Section in RFCs</title>
              <author fullname="M. Cotton" initials="M." surname="Cotton"/>
              <author fullname="B. Leiba" initials="B." surname="Leiba"/>
              <author fullname="T. Narten" initials="T." surname="Narten"/>
              <date month="June" year="2017"/>
              <abstract>
                <t indent="0">Many protocols make use of points of extensibility that use constants to identify various protocol parameters. To ensure that the values in these fields do not have conflicting uses and to promote interoperability, their allocations are often coordinated by a central record keeper. For IETF protocols, that role is filled by the Internet Assigned Numbers Authority (IANA).</t>
                <t indent="0">To make assignments in a given registry prudently, guidance describing the conditions under which new values should be assigned, as well as when and how modifications to existing values can be made, is needed. This document defines a framework for the documentation of these guidelines by specification authors, in order to assure that the provided guidance for the IANA Considerations is clear and addresses the various issues that are likely in the operation of a registry.</t>
                <t indent="0">This is the third edition of this document; it obsoletes RFC 5226.</t>
              </abstract>
            </front>
            <seriesInfo name="BCP" value="26"/>
            <seriesInfo name="RFC" value="8126"/>
            <seriesInfo name="DOI" value="10.17487/RFC8126"/>
          </reference>
        </referencegroup>
        <referencegroup anchor="BCP86" target="https://www.rfc-editor.org/info/bcp86" derivedAnchor="BCP86">
          <reference anchor="RFC3766" target="https://www.rfc-editor.org/info/rfc3766" quoteTitle="true">
            <front>
              <title>Determining Strengths For Public Keys Used For Exchanging Symmetric Keys</title>
              <author fullname="H. Orman" initials="H." surname="Orman"/>
              <author fullname="P. Hoffman" initials="P." surname="Hoffman"/>
              <date month="April" year="2004"/>
              <abstract>
                <t indent="0">Implementors of systems that use public key cryptography to exchange symmetric keys need to make the public keys resistant to some predetermined level of attack. That level of attack resistance is the strength of the system, and the symmetric keys that are exchanged must be at least as strong as the system strength requirements. The three quantities, system strength, symmetric key strength, and public key strength, must be consistently matched for any network protocol usage. While it is fairly easy to express the system strength requirements in terms of a symmetric key length and to choose a cipher that has a key length equal to or exceeding that requirement, it is harder to choose a public key that has a cryptographic strength meeting a symmetric key strength requirement. This document explains how to determine the length of an asymmetric key as a function of a symmetric key strength requirement. Some rules of thumb for estimating equivalent resistance to large-scale attacks on various algorithms are given. The document also addresses how changing the sizes of the underlying large integers (moduli, group sizes, exponents, and so on) changes the time to use the algorithms for key exchange. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
              </abstract>
            </front>
            <seriesInfo name="BCP" value="86"/>
            <seriesInfo name="RFC" value="3766"/>
            <seriesInfo name="DOI" value="10.17487/RFC3766"/>
          </reference>
        </referencegroup>
        <reference anchor="IEEE.802-1X.2020" quoteTitle="true" target="https://doi.org/10.1109/IEEESTD.2020.9018454" derivedAnchor="IEEE.802-1X.2020">
          <front>
            <title>IEEE Standard for Local and Metropolitan Area Networks--Port-Based Network Access Control</title>
            <author>
              <organization showOnFrontPage="true">IEEE</organization>
            </author>
            <date month="2" year="2020"/>
          </front>
          <seriesInfo name="IEEE Std" value="802.1X-2020"/>
          <seriesInfo name="DOI" value="10.1109/IEEESTD.2020.9018454"/>
        </reference>
        <reference anchor="I-D.kamath-pppext-eap-mschapv2" target="https://datatracker.ietf.org/doc/html/draft-kamath-pppext-eap-mschapv2-02" quoteTitle="true" derivedAnchor="KAMATH">
          <front>
            <title>Microsoft EAP CHAP Extensions</title>
            <author fullname="Vivek Kamath" initials="V." surname="Kamath"/>
            <author fullname="Ashwin Palekar" initials="A." surname="Palekar">
              <organization showOnFrontPage="true">Microsoft Corporation</organization>
            </author>
            <date day="19" month="June" year="2007"/>
            <abstract>
              <t indent="0">This document defines the Microsoft EAP CHAP Extensions Protocol, Version 2, which encapsulates the MS-CHAPv2 protocol defined in RFC 2759, within EAP as defined in RFC 3748.</t>
            </abstract>
          </front>
          <seriesInfo name="Internet-Draft" value="draft-kamath-pppext-eap-mschapv2-02"/>
          <refcontent>Work in Progress</refcontent>
        </reference>
        <reference anchor="MSCHAP" target="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-chap/5a860bf5-2aeb-485b-82ee-fac1e8e6b76f" quoteTitle="true" derivedAnchor="MSCHAP">
          <front>
            <title>Master Session Key (MSK) Derivation</title>
            <author>
              <organization showOnFrontPage="true">Microsoft Corporation</organization>
            </author>
            <date day="23" month="4" year="2024"/>
          </front>
        </reference>
        <reference anchor="NIST-SP-800-57" quoteTitle="true" target="https://doi.org/10.6028/NIST.SP.800-57pt1r5" derivedAnchor="NIST-SP-800-57">
          <front>
            <title>Recommendation for Key Management: Part 1 - General</title>
            <author fullname="Elaine Barker"/>
            <date year="2020" month="May"/>
          </front>
          <seriesInfo name="NIST SP" value="800-57 Part 1 Rev. 5"/>
          <seriesInfo name="DOI" value="10.6028/NIST.SP.800-57pt1r5"/>
        </reference>
        <reference anchor="PEAP" target="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-peap/5308642b-90c9-4cc4-beec-fb367325c0f9" quoteTitle="true" derivedAnchor="PEAP">
          <front>
            <title>[MS-PEAP]: Protected Extensible Authentication Protocol (PEAP)</title>
            <author>
              <organization showOnFrontPage="true">Microsoft Corporation</organization>
            </author>
            <date day="24" year="2021" month="June"/>
          </front>
        </reference>
        <reference anchor="RFC2315" target="https://www.rfc-editor.org/info/rfc2315" quoteTitle="true" derivedAnchor="RFC2315">
          <front>
            <title>PKCS #7: Cryptographic Message Syntax Version 1.5</title>
            <author fullname="B. Kaliski" initials="B." surname="Kaliski"/>
            <date month="March" year="1998"/>
            <abstract>
              <t indent="0">This document describes a general syntax for data that may have cryptography applied to it, such as digital signatures and digital envelopes. This memo provides information for the Internet community. It does not specify an Internet standard of any kind.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="2315"/>
          <seriesInfo name="DOI" value="10.17487/RFC2315"/>
        </reference>
        <reference anchor="RFC3579" target="https://www.rfc-editor.org/info/rfc3579" quoteTitle="true" derivedAnchor="RFC3579">
          <front>
            <title>RADIUS (Remote Authentication Dial In User Service) Support For Extensible Authentication Protocol (EAP)</title>
            <author fullname="B. Aboba" initials="B." surname="Aboba"/>
            <author fullname="P. Calhoun" initials="P." surname="Calhoun"/>
            <date month="September" year="2003"/>
            <abstract>
              <t indent="0">This document defines Remote Authentication Dial In User Service (RADIUS) support for the Extensible Authentication Protocol (EAP), an authentication framework which supports multiple authentication mechanisms. In the proposed scheme, the Network Access Server (NAS) forwards EAP packets to and from the RADIUS server, encapsulated within EAP-Message attributes. This has the advantage of allowing the NAS to support any EAP authentication method, without the need for method- specific code, which resides on the RADIUS server. While EAP was originally developed for use with PPP, it is now also in use with IEEE 802. This memo provides information for the Internet community.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="3579"/>
          <seriesInfo name="DOI" value="10.17487/RFC3579"/>
        </reference>
        <reference anchor="RFC3629" target="https://www.rfc-editor.org/info/rfc3629" quoteTitle="true" derivedAnchor="RFC3629">
          <front>
            <title>UTF-8, a transformation format of ISO 10646</title>
            <author fullname="F. Yergeau" initials="F." surname="Yergeau"/>
            <date month="November" year="2003"/>
            <abstract>
              <t indent="0">ISO/IEC 10646-1 defines a large character set called the Universal Character Set (UCS) which encompasses most of the world's writing systems. The originally proposed encodings of the UCS, however, were not compatible with many current applications and protocols, and this has led to the development of UTF-8, the object of this memo. UTF-8 has the characteristic of preserving the full US-ASCII range, providing compatibility with file systems, parsers and other software that rely on US-ASCII values but are transparent to other values. This memo obsoletes and replaces RFC 2279.</t>
            </abstract>
          </front>
          <seriesInfo name="STD" value="63"/>
          <seriesInfo name="RFC" value="3629"/>
          <seriesInfo name="DOI" value="10.17487/RFC3629"/>
        </reference>
        <reference anchor="RFC4017" target="https://www.rfc-editor.org/info/rfc4017" quoteTitle="true" derivedAnchor="RFC4017">
          <front>
            <title>Extensible Authentication Protocol (EAP) Method Requirements for Wireless LANs</title>
            <author fullname="D. Stanley" initials="D." surname="Stanley"/>
            <author fullname="J. Walker" initials="J." surname="Walker"/>
            <author fullname="B. Aboba" initials="B." surname="Aboba"/>
            <date month="March" year="2005"/>
            <abstract>
              <t indent="0">The IEEE 802.11i MAC Security Enhancements Amendment makes use of IEEE 802.1X, which in turn relies on the Extensible Authentication Protocol (EAP). This document defines requirements for EAP methods used in IEEE 802.11 wireless LAN deployments. The material in this document has been approved by IEEE 802.11 and is being presented as an IETF RFC for informational purposes. This memo provides information for the Internet community.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="4017"/>
          <seriesInfo name="DOI" value="10.17487/RFC4017"/>
        </reference>
        <reference anchor="RFC4072" target="https://www.rfc-editor.org/info/rfc4072" quoteTitle="true" derivedAnchor="RFC4072">
          <front>
            <title>Diameter Extensible Authentication Protocol (EAP) Application</title>
            <author fullname="P. Eronen" initials="P." role="editor" surname="Eronen"/>
            <author fullname="T. Hiller" initials="T." surname="Hiller"/>
            <author fullname="G. Zorn" initials="G." surname="Zorn"/>
            <date month="August" year="2005"/>
            <abstract>
              <t indent="0">The Extensible Authentication Protocol (EAP) provides a standard mechanism for support of various authentication methods. This document defines the Command-Codes and AVPs necessary to carry EAP packets between a Network Access Server (NAS) and a back-end authentication server. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="4072"/>
          <seriesInfo name="DOI" value="10.17487/RFC4072"/>
        </reference>
        <reference anchor="RFC4086" target="https://www.rfc-editor.org/info/rfc4086" quoteTitle="true" derivedAnchor="RFC4086">
          <front>
            <title>Randomness Requirements for Security</title>
            <author fullname="D. Eastlake 3rd" initials="D." surname="Eastlake 3rd"/>
            <author fullname="J. Schiller" initials="J." surname="Schiller"/>
            <author fullname="S. Crocker" initials="S." surname="Crocker"/>
            <date month="June" year="2005"/>
            <abstract>
              <t indent="0">Security systems are built on strong cryptographic algorithms that foil pattern analysis attempts. However, the security of these systems is dependent on generating secret quantities for passwords, cryptographic keys, and similar quantities. The use of pseudo-random processes to generate secret quantities can result in pseudo-security. A sophisticated attacker may find it easier to reproduce the environment that produced the secret quantities and to search the resulting small set of possibilities than to locate the quantities in the whole of the potential number space.</t>
              <t indent="0">Choosing random quantities to foil a resourceful and motivated adversary is surprisingly difficult. This document points out many pitfalls in using poor entropy sources or traditional pseudo-random number generation techniques for generating such quantities. It recommends the use of truly random hardware techniques and shows that the existing hardware on many systems can be used for this purpose. It provides suggestions to ameliorate the problem when a hardware solution is not available, and it gives examples of how large such quantities need to be for some applications. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="106"/>
          <seriesInfo name="RFC" value="4086"/>
          <seriesInfo name="DOI" value="10.17487/RFC4086"/>
        </reference>
        <reference anchor="RFC4334" target="https://www.rfc-editor.org/info/rfc4334" quoteTitle="true" derivedAnchor="RFC4334">
          <front>
            <title>Certificate Extensions and Attributes Supporting Authentication in Point-to-Point Protocol (PPP) and Wireless Local Area Networks (WLAN)</title>
            <author fullname="R. Housley" initials="R." surname="Housley"/>
            <author fullname="T. Moore" initials="T." surname="Moore"/>
            <date month="February" year="2006"/>
            <abstract>
              <t indent="0">This document defines two Extensible Authentication Protocol (EAP) extended key usage values and a public key certificate extension to carry Wireless LAN (WLAN) System Service identifiers (SSIDs). This document obsoletes RFC 3770. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="4334"/>
          <seriesInfo name="DOI" value="10.17487/RFC4334"/>
        </reference>
        <reference anchor="RFC4648" target="https://www.rfc-editor.org/info/rfc4648" quoteTitle="true" derivedAnchor="RFC4648">
          <front>
            <title>The Base16, Base32, and Base64 Data Encodings</title>
            <author fullname="S. Josefsson" initials="S." surname="Josefsson"/>
            <date month="October" year="2006"/>
            <abstract>
              <t indent="0">This document describes the commonly used base 64, base 32, and base 16 encoding schemes. It also discusses the use of line-feeds in encoded data, use of padding in encoded data, use of non-alphabet characters in encoded data, use of different encoding alphabets, and canonical encodings. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="4648"/>
          <seriesInfo name="DOI" value="10.17487/RFC4648"/>
        </reference>
        <reference anchor="RFC4851" target="https://www.rfc-editor.org/info/rfc4851" quoteTitle="true" derivedAnchor="RFC4851">
          <front>
            <title>The Flexible Authentication via Secure Tunneling Extensible Authentication Protocol Method (EAP-FAST)</title>
            <author fullname="N. Cam-Winget" initials="N." surname="Cam-Winget"/>
            <author fullname="D. McGrew" initials="D." surname="McGrew"/>
            <author fullname="J. Salowey" initials="J." surname="Salowey"/>
            <author fullname="H. Zhou" initials="H." surname="Zhou"/>
            <date month="May" year="2007"/>
            <abstract>
              <t indent="0">This document defines the Extensible Authentication Protocol (EAP) based Flexible Authentication via Secure Tunneling (EAP-FAST) protocol. EAP-FAST is an EAP method that enables secure communication between a peer and a server by using the Transport Layer Security (TLS) to establish a mutually authenticated tunnel. Within the tunnel, Type-Length-Value (TLV) objects are used to convey authentication related data between the peer and the EAP server. This memo provides information for the Internet community.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="4851"/>
          <seriesInfo name="DOI" value="10.17487/RFC4851"/>
        </reference>
        <reference anchor="RFC4945" target="https://www.rfc-editor.org/info/rfc4945" quoteTitle="true" derivedAnchor="RFC4945">
          <front>
            <title>The Internet IP Security PKI Profile of IKEv1/ISAKMP, IKEv2, and PKIX</title>
            <author fullname="B. Korver" initials="B." surname="Korver"/>
            <date month="August" year="2007"/>
            <abstract>
              <t indent="0">The Internet Key Exchange (IKE) and Public Key Infrastructure for X.509 (PKIX) certificate profile both provide frameworks that must be profiled for use in a given application. This document provides a profile of IKE and PKIX that defines the requirements for using PKI technology in the context of IKE/IPsec. The document complements protocol specifications such as IKEv1 and IKEv2, which assume the existence of public key certificates and related keying materials, but which do not address PKI issues explicitly. This document addresses those issues. The intended audience is implementers of PKI for IPsec. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="4945"/>
          <seriesInfo name="DOI" value="10.17487/RFC4945"/>
        </reference>
        <reference anchor="RFC4949" target="https://www.rfc-editor.org/info/rfc4949" quoteTitle="true" derivedAnchor="RFC4949">
          <front>
            <title>Internet Security Glossary, Version 2</title>
            <author fullname="R. Shirey" initials="R." surname="Shirey"/>
            <date month="August" year="2007"/>
            <abstract>
              <t indent="0">This Glossary provides definitions, abbreviations, and explanations of terminology for information system security. The 334 pages of entries offer recommendations to improve the comprehensibility of written material that is generated in the Internet Standards Process (RFC 2026). The recommendations follow the principles that such writing should (a) use the same term or definition whenever the same concept is mentioned; (b) use terms in their plainest, dictionary sense; (c) use terms that are already well-established in open publications; and (d) avoid terms that either favor a particular vendor or favor a particular technology or mechanism over other, competing techniques that already exist or could be developed. This memo provides information for the Internet community.</t>
            </abstract>
          </front>
          <seriesInfo name="FYI" value="36"/>
          <seriesInfo name="RFC" value="4949"/>
          <seriesInfo name="DOI" value="10.17487/RFC4949"/>
        </reference>
        <reference anchor="RFC4962" target="https://www.rfc-editor.org/info/rfc4962" quoteTitle="true" derivedAnchor="RFC4962">
          <front>
            <title>Guidance for Authentication, Authorization, and Accounting (AAA) Key Management</title>
            <author fullname="R. Housley" initials="R." surname="Housley"/>
            <author fullname="B. Aboba" initials="B." surname="Aboba"/>
            <date month="July" year="2007"/>
            <abstract>
              <t indent="0">This document provides guidance to designers of Authentication, Authorization, and Accounting (AAA) key management protocols. The guidance is also useful to designers of systems and solutions that include AAA key management protocols. Given the complexity and difficulty in designing secure, long-lasting key management algorithms and protocols by experts in the field, it is almost certainly inappropriate for IETF working groups without deep expertise in the area to be designing their own key management algorithms and protocols based on Authentication, Authorization, and Accounting (AAA) protocols. The guidelines in this document apply to documents requesting publication as IETF RFCs. Further, these guidelines will be useful to other standards development organizations (SDOs) that specify AAA key management. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="132"/>
          <seriesInfo name="RFC" value="4962"/>
          <seriesInfo name="DOI" value="10.17487/RFC4962"/>
        </reference>
        <reference anchor="RFC5247" target="https://www.rfc-editor.org/info/rfc5247" quoteTitle="true" derivedAnchor="RFC5247">
          <front>
            <title>Extensible Authentication Protocol (EAP) Key Management Framework</title>
            <author fullname="B. Aboba" initials="B." surname="Aboba"/>
            <author fullname="D. Simon" initials="D." surname="Simon"/>
            <author fullname="P. Eronen" initials="P." surname="Eronen"/>
            <date month="August" year="2008"/>
            <abstract>
              <t indent="0">The Extensible Authentication Protocol (EAP), defined in RFC 3748, enables extensible network access authentication. This document specifies the EAP key hierarchy and provides a framework for the transport and usage of keying material and parameters generated by EAP authentication algorithms, known as "methods". It also provides a detailed system-level security analysis, describing the conditions under which the key management guidelines described in RFC 4962 can be satisfied. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5247"/>
          <seriesInfo name="DOI" value="10.17487/RFC5247"/>
        </reference>
        <reference anchor="RFC5272" target="https://www.rfc-editor.org/info/rfc5272" quoteTitle="true" derivedAnchor="RFC5272">
          <front>
            <title>Certificate Management over CMS (CMC)</title>
            <author fullname="J. Schaad" initials="J." surname="Schaad"/>
            <author fullname="M. Myers" initials="M." surname="Myers"/>
            <date month="June" year="2008"/>
            <abstract>
              <t indent="0">This document defines the base syntax for CMC, a Certificate Management protocol using the Cryptographic Message Syntax (CMS). This protocol addresses two immediate needs within the Internet Public Key Infrastructure (PKI) community:</t>
              <t indent="0">1. The need for an interface to public key certification products and services based on CMS and PKCS #10 (Public Key Cryptography Standard), and</t>
              <t indent="0">2. The need for a PKI enrollment protocol for encryption only keys due to algorithm or hardware design.</t>
              <t indent="0">CMC also requires the use of the transport document and the requirements usage document along with this document for a full definition. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5272"/>
          <seriesInfo name="DOI" value="10.17487/RFC5272"/>
        </reference>
        <reference anchor="RFC5280" target="https://www.rfc-editor.org/info/rfc5280" quoteTitle="true" derivedAnchor="RFC5280">
          <front>
            <title>Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile</title>
            <author fullname="D. Cooper" initials="D." surname="Cooper"/>
            <author fullname="S. Santesson" initials="S." surname="Santesson"/>
            <author fullname="S. Farrell" initials="S." surname="Farrell"/>
            <author fullname="S. Boeyen" initials="S." surname="Boeyen"/>
            <author fullname="R. Housley" initials="R." surname="Housley"/>
            <author fullname="W. Polk" initials="W." surname="Polk"/>
            <date month="May" year="2008"/>
            <abstract>
              <t indent="0">This memo profiles the X.509 v3 certificate and X.509 v2 certificate revocation list (CRL) for use in the Internet. An overview of this approach and model is provided as an introduction. The X.509 v3 certificate format is described in detail, with additional information regarding the format and semantics of Internet name forms. Standard certificate extensions are described and two Internet-specific extensions are defined. A set of required certificate extensions is specified. The X.509 v2 CRL format is described in detail along with standard and Internet-specific extensions. An algorithm for X.509 certification path validation is described. An ASN.1 module and examples are provided in the appendices. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5280"/>
          <seriesInfo name="DOI" value="10.17487/RFC5280"/>
        </reference>
        <reference anchor="RFC5281" target="https://www.rfc-editor.org/info/rfc5281" quoteTitle="true" derivedAnchor="RFC5281">
          <front>
            <title>Extensible Authentication Protocol Tunneled Transport Layer Security Authenticated Protocol Version 0 (EAP-TTLSv0)</title>
            <author fullname="P. Funk" initials="P." surname="Funk"/>
            <author fullname="S. Blake-Wilson" initials="S." surname="Blake-Wilson"/>
            <date month="August" year="2008"/>
            <abstract>
              <t indent="0">EAP-TTLS is an EAP (Extensible Authentication Protocol) method that encapsulates a TLS (Transport Layer Security) session, consisting of a handshake phase and a data phase. During the handshake phase, the server is authenticated to the client (or client and server are mutually authenticated) using standard TLS procedures, and keying material is generated in order to create a cryptographically secure tunnel for information exchange in the subsequent data phase. During the data phase, the client is authenticated to the server (or client and server are mutually authenticated) using an arbitrary authentication mechanism encapsulated within the secure tunnel. The encapsulated authentication mechanism may itself be EAP, or it may be another authentication protocol such as PAP, CHAP, MS-CHAP, or MS-CHAP-V2. Thus, EAP-TTLS allows legacy password-based authentication protocols to be used against existing authentication databases, while protecting the security of these legacy protocols against eavesdropping, man-in-the-middle, and other attacks. The data phase may also be used for additional, arbitrary data exchange. This memo provides information for the Internet community.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5281"/>
          <seriesInfo name="DOI" value="10.17487/RFC5281"/>
        </reference>
        <reference anchor="RFC5421" target="https://www.rfc-editor.org/info/rfc5421" quoteTitle="true" derivedAnchor="RFC5421">
          <front>
            <title>Basic Password Exchange within the Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST)</title>
            <author fullname="N. Cam-Winget" initials="N." surname="Cam-Winget"/>
            <author fullname="H. Zhou" initials="H." surname="Zhou"/>
            <date month="March" year="2009"/>
            <abstract>
              <t indent="0">The Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST) method enables secure communication between a peer and a server by using Transport Layer Security (TLS) to establish a mutually authenticated tunnel. Within this tunnel, a basic password exchange, based on the Generic Token Card method (EAP-GTC), may be executed to authenticate the peer. This memo provides information for the Internet community.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5421"/>
          <seriesInfo name="DOI" value="10.17487/RFC5421"/>
        </reference>
        <reference anchor="RFC5422" target="https://www.rfc-editor.org/info/rfc5422" quoteTitle="true" derivedAnchor="RFC5422">
          <front>
            <title>Dynamic Provisioning Using Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST)</title>
            <author fullname="N. Cam-Winget" initials="N." surname="Cam-Winget"/>
            <author fullname="D. McGrew" initials="D." surname="McGrew"/>
            <author fullname="J. Salowey" initials="J." surname="Salowey"/>
            <author fullname="H. Zhou" initials="H." surname="Zhou"/>
            <date month="March" year="2009"/>
            <abstract>
              <t indent="0">The Flexible Authentication via Secure Tunneling Extensible Authentication Protocol (EAP-FAST) method enables secure communication between a peer and a server by using Transport Layer Security (TLS) to establish a mutually authenticated tunnel. EAP- FAST also enables the provisioning credentials or other information through this protected tunnel. This document describes the use of EAP-FAST for dynamic provisioning. This memo provides information for the Internet community.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5422"/>
          <seriesInfo name="DOI" value="10.17487/RFC5422"/>
        </reference>
        <reference anchor="RFC5652" target="https://www.rfc-editor.org/info/rfc5652" quoteTitle="true" derivedAnchor="RFC5652">
          <front>
            <title>Cryptographic Message Syntax (CMS)</title>
            <author fullname="R. Housley" initials="R." surname="Housley"/>
            <date month="September" year="2009"/>
            <abstract>
              <t indent="0">This document describes the Cryptographic Message Syntax (CMS). This syntax is used to digitally sign, digest, authenticate, or encrypt arbitrary message content. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="STD" value="70"/>
          <seriesInfo name="RFC" value="5652"/>
          <seriesInfo name="DOI" value="10.17487/RFC5652"/>
        </reference>
        <reference anchor="RFC5931" target="https://www.rfc-editor.org/info/rfc5931" quoteTitle="true" derivedAnchor="RFC5931">
          <front>
            <title>Extensible Authentication Protocol (EAP) Authentication Using Only a Password</title>
            <author fullname="D. Harkins" initials="D." surname="Harkins"/>
            <author fullname="G. Zorn" initials="G." surname="Zorn"/>
            <date month="August" year="2010"/>
            <abstract>
              <t indent="0">This memo describes an Extensible Authentication Protocol (EAP) method, EAP-pwd, which uses a shared password for authentication. The password may be a low-entropy one and may be drawn from some set of possible passwords, like a dictionary, which is available to an attacker. The underlying key exchange is resistant to active attack, passive attack, and dictionary attack. This document is not an Internet Standards Track specification; it is published for informational purposes.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5931"/>
          <seriesInfo name="DOI" value="10.17487/RFC5931"/>
        </reference>
        <reference anchor="RFC6066" target="https://www.rfc-editor.org/info/rfc6066" quoteTitle="true" derivedAnchor="RFC6066">
          <front>
            <title>Transport Layer Security (TLS) Extensions: Extension Definitions</title>
            <author fullname="D. Eastlake 3rd" initials="D." surname="Eastlake 3rd"/>
            <date month="January" year="2011"/>
            <abstract>
              <t indent="0">This document provides specifications for existing TLS extensions. It is a companion document for RFC 5246, "The Transport Layer Security (TLS) Protocol Version 1.2". The extensions specified are server_name, max_fragment_length, client_certificate_url, trusted_ca_keys, truncated_hmac, and status_request. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6066"/>
          <seriesInfo name="DOI" value="10.17487/RFC6066"/>
        </reference>
        <reference anchor="RFC6124" target="https://www.rfc-editor.org/info/rfc6124" quoteTitle="true" derivedAnchor="RFC6124">
          <front>
            <title>An EAP Authentication Method Based on the Encrypted Key Exchange (EKE) Protocol</title>
            <author fullname="Y. Sheffer" initials="Y." surname="Sheffer"/>
            <author fullname="G. Zorn" initials="G." surname="Zorn"/>
            <author fullname="H. Tschofenig" initials="H." surname="Tschofenig"/>
            <author fullname="S. Fluhrer" initials="S." surname="Fluhrer"/>
            <date month="February" year="2011"/>
            <abstract>
              <t indent="0">The Extensible Authentication Protocol (EAP) describes a framework that allows the use of multiple authentication mechanisms. This document defines an authentication mechanism for EAP called EAP-EKE, based on the Encrypted Key Exchange (EKE) protocol. This method provides mutual authentication through the use of a short, easy to remember password. Compared with other common authentication methods, EAP-EKE is not susceptible to dictionary attacks. Neither does it require the availability of public-key certificates. This document is not an Internet Standards Track specification; it is published for informational purposes.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6124"/>
          <seriesInfo name="DOI" value="10.17487/RFC6124"/>
        </reference>
        <reference anchor="RFC6238" target="https://www.rfc-editor.org/info/rfc6238" quoteTitle="true" derivedAnchor="RFC6238">
          <front>
            <title>TOTP: Time-Based One-Time Password Algorithm</title>
            <author fullname="D. M'Raihi" initials="D." surname="M'Raihi"/>
            <author fullname="S. Machani" initials="S." surname="Machani"/>
            <author fullname="M. Pei" initials="M." surname="Pei"/>
            <author fullname="J. Rydell" initials="J." surname="Rydell"/>
            <date month="May" year="2011"/>
            <abstract>
              <t indent="0">This document describes an extension of the One-Time Password (OTP) algorithm, namely the HMAC-based One-Time Password (HOTP) algorithm, as defined in RFC 4226, to support the time-based moving factor. The HOTP algorithm specifies an event-based OTP algorithm, where the moving factor is an event counter. The present work bases the moving factor on a time value. A time-based variant of the OTP algorithm provides short-lived OTP values, which are desirable for enhanced security.</t>
              <t indent="0">The proposed algorithm can be used across a wide range of network applications, from remote Virtual Private Network (VPN) access and Wi-Fi network logon to transaction-oriented Web applications. The authors believe that a common and shared algorithm will facilitate adoption of two-factor authentication on the Internet by enabling interoperability across commercial and open-source implementations. This document is not an Internet Standards Track specification; it is published for informational purposes.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6238"/>
          <seriesInfo name="DOI" value="10.17487/RFC6238"/>
        </reference>
        <reference anchor="RFC6678" target="https://www.rfc-editor.org/info/rfc6678" quoteTitle="true" derivedAnchor="RFC6678">
          <front>
            <title>Requirements for a Tunnel-Based Extensible Authentication Protocol (EAP) Method</title>
            <author fullname="K. Hoeper" initials="K." surname="Hoeper"/>
            <author fullname="S. Hanna" initials="S." surname="Hanna"/>
            <author fullname="H. Zhou" initials="H." surname="Zhou"/>
            <author fullname="J. Salowey" initials="J." role="editor" surname="Salowey"/>
            <date month="July" year="2012"/>
            <abstract>
              <t indent="0">This memo defines the requirements for a tunnel-based Extensible Authentication Protocol (EAP) Method. This tunnel method will use Transport Layer Security (TLS) to establish a secure tunnel. The tunnel will provide support for password authentication, EAP authentication, and the transport of additional data for other purposes. This document is not an Internet Standards Track specification; it is published for informational purposes.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6678"/>
          <seriesInfo name="DOI" value="10.17487/RFC6678"/>
        </reference>
        <reference anchor="RFC6960" target="https://www.rfc-editor.org/info/rfc6960" quoteTitle="true" derivedAnchor="RFC6960">
          <front>
            <title>X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP</title>
            <author fullname="S. Santesson" initials="S." surname="Santesson"/>
            <author fullname="M. Myers" initials="M." surname="Myers"/>
            <author fullname="R. Ankney" initials="R." surname="Ankney"/>
            <author fullname="A. Malpani" initials="A." surname="Malpani"/>
            <author fullname="S. Galperin" initials="S." surname="Galperin"/>
            <author fullname="C. Adams" initials="C." surname="Adams"/>
            <date month="June" year="2013"/>
            <abstract>
              <t indent="0">This document specifies a protocol useful in determining the current status of a digital certificate without requiring Certificate Revocation Lists (CRLs). Additional mechanisms addressing PKIX operational requirements are specified in separate documents. This document obsoletes RFCs 2560 and 6277. It also updates RFC 5912.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6960"/>
          <seriesInfo name="DOI" value="10.17487/RFC6960"/>
        </reference>
        <reference anchor="RFC6961" target="https://www.rfc-editor.org/info/rfc6961" quoteTitle="true" derivedAnchor="RFC6961">
          <front>
            <title>The Transport Layer Security (TLS) Multiple Certificate Status Request Extension</title>
            <author fullname="Y. Pettersen" initials="Y." surname="Pettersen"/>
            <date month="June" year="2013"/>
            <abstract>
              <t indent="0">This document defines the Transport Layer Security (TLS) Certificate Status Version 2 Extension to allow clients to specify and support several certificate status methods. (The use of the Certificate Status extension is commonly referred to as "OCSP stapling".) Also defined is a new method based on the Online Certificate Status Protocol (OCSP) that servers can use to provide status information about not only the server's own certificate but also the status of intermediate certificates in the chain.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6961"/>
          <seriesInfo name="DOI" value="10.17487/RFC6961"/>
        </reference>
        <reference anchor="RFC7029" target="https://www.rfc-editor.org/info/rfc7029" quoteTitle="true" derivedAnchor="RFC7029">
          <front>
            <title>Extensible Authentication Protocol (EAP) Mutual Cryptographic Binding</title>
            <author fullname="S. Hartman" initials="S." surname="Hartman"/>
            <author fullname="M. Wasserman" initials="M." surname="Wasserman"/>
            <author fullname="D. Zhang" initials="D." surname="Zhang"/>
            <date month="October" year="2013"/>
            <abstract>
              <t indent="0">As the Extensible Authentication Protocol (EAP) evolves, EAP peers rely increasingly on information received from the EAP server. EAP extensions such as channel binding or network posture information are often carried in tunnel methods; peers are likely to rely on this information. Cryptographic binding is a facility described in RFC 3748 that protects tunnel methods against man-in-the-middle attacks. However, cryptographic binding focuses on protecting the server rather than the peer. This memo explores attacks possible when the peer is not protected from man-in-the-middle attacks and recommends cryptographic binding based on an Extended Master Session Key, a new form of cryptographic binding that protects both peer and server along with other mitigations.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7029"/>
          <seriesInfo name="DOI" value="10.17487/RFC7029"/>
        </reference>
        <reference anchor="RFC7170" target="https://www.rfc-editor.org/info/rfc7170" quoteTitle="true" derivedAnchor="RFC7170">
          <front>
            <title>Tunnel Extensible Authentication Protocol (TEAP) Version 1</title>
            <author fullname="H. Zhou" initials="H." surname="Zhou"/>
            <author fullname="N. Cam-Winget" initials="N." surname="Cam-Winget"/>
            <author fullname="J. Salowey" initials="J." surname="Salowey"/>
            <author fullname="S. Hanna" initials="S." surname="Hanna"/>
            <date month="May" year="2014"/>
            <abstract>
              <t indent="0">This document defines the Tunnel Extensible Authentication Protocol (TEAP) version 1. TEAP is a tunnel-based EAP method that enables secure communication between a peer and a server by using the Transport Layer Security (TLS) protocol to establish a mutually authenticated tunnel. Within the tunnel, TLV objects are used to convey authentication-related data between the EAP peer and the EAP server.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7170"/>
          <seriesInfo name="DOI" value="10.17487/RFC7170"/>
        </reference>
        <reference anchor="RFC7299" target="https://www.rfc-editor.org/info/rfc7299" quoteTitle="true" derivedAnchor="RFC7299">
          <front>
            <title>Object Identifier Registry for the PKIX Working Group</title>
            <author fullname="R. Housley" initials="R." surname="Housley"/>
            <date month="July" year="2014"/>
            <abstract>
              <t indent="0">When the Public-Key Infrastructure using X.509 (PKIX) Working Group was chartered, an object identifier arc was allocated by IANA for use by that working group. This document describes the object identifiers that were assigned in that arc, returns control of that arc to IANA, and establishes IANA allocation policies for any future assignments within that arc.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7299"/>
          <seriesInfo name="DOI" value="10.17487/RFC7299"/>
        </reference>
        <reference anchor="RFC7542" target="https://www.rfc-editor.org/info/rfc7542" quoteTitle="true" derivedAnchor="RFC7542">
          <front>
            <title>The Network Access Identifier</title>
            <author fullname="A. DeKok" initials="A." surname="DeKok"/>
            <date month="May" year="2015"/>
            <abstract>
              <t indent="0">In order to provide inter-domain authentication services, it is necessary to have a standardized method that domains can use to identify each other's users. This document defines the syntax for the Network Access Identifier (NAI), the user identifier submitted by the client prior to accessing resources. This document is a revised version of RFC 4282. It addresses issues with international character sets and makes a number of other corrections to RFC 4282.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7542"/>
          <seriesInfo name="DOI" value="10.17487/RFC7542"/>
        </reference>
        <reference anchor="RFC8146" target="https://www.rfc-editor.org/info/rfc8146" quoteTitle="true" derivedAnchor="RFC8146">
          <front>
            <title>Adding Support for Salted Password Databases to EAP-pwd</title>
            <author fullname="D. Harkins" initials="D." surname="Harkins"/>
            <date month="April" year="2017"/>
            <abstract>
              <t indent="0">EAP-pwd is an Extensible Authentication Protocol (EAP) method that utilizes a shared password for authentication using a technique that is resistant to dictionary attacks. It includes support for raw keys and double hashing of a password in the style of Microsoft Challenge Handshake Authentication Protocol version 2 (MSCHAPv2), but it does not include support for salted passwords. There are many existing databases of salted passwords, and it is desirable to allow their use with EAP-pwd.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8146"/>
          <seriesInfo name="DOI" value="10.17487/RFC8146"/>
        </reference>
        <reference anchor="RFC9325" target="https://www.rfc-editor.org/info/rfc9325" quoteTitle="true" derivedAnchor="RFC9325">
          <front>
            <title>Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)</title>
            <author fullname="Y. Sheffer" initials="Y." surname="Sheffer"/>
            <author fullname="P. Saint-Andre" initials="P." surname="Saint-Andre"/>
            <author fullname="T. Fossati" initials="T." surname="Fossati"/>
            <date month="November" year="2022"/>
            <abstract>
              <t indent="0">Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) are used to protect data exchanged over a wide range of application protocols and can also form the basis for secure transport protocols. Over the years, the industry has witnessed several serious attacks on TLS and DTLS, including attacks on the most commonly used cipher suites and their modes of operation. This document provides the latest recommendations for ensuring the security of deployed services that use TLS and DTLS. These recommendations are applicable to the majority of use cases.</t>
              <t indent="0">RFC 7525, an earlier version of the TLS recommendations, was published when the industry was transitioning to TLS 1.2. Years later, this transition is largely complete, and TLS 1.3 is widely available. This document updates the guidance given the new environment and obsoletes RFC 7525. In addition, this document updates RFCs 5288 and 6066 in view of recent attacks.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="195"/>
          <seriesInfo name="RFC" value="9325"/>
          <seriesInfo name="DOI" value="10.17487/RFC9325"/>
        </reference>
        <reference anchor="X.690" target="https://www.itu.int/rec/T-REC-X.690" quoteTitle="true" derivedAnchor="X.690">
          <front>
            <title>Information technology - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)</title>
            <author>
              <organization showOnFrontPage="true">ITU-T</organization>
            </author>
            <date year="2021" month="February"/>
          </front>
        </reference>
      </references>
    </references>
    <section numbered="true" anchor="appendix-a-evaluation-against-tunnel-based-eap-method-requirements" removeInRFC="false" toc="include" pn="section-appendix.a">
      <name slugifiedName="name-evaluation-against-tunnel-b">Evaluation Against Tunnel-Based EAP Method Requirements</name>
      <t indent="0" pn="section-appendix.a-1">This section evaluates all tunnel-based EAP method requirements
described in <xref target="RFC6678" format="default" sectionFormat="of" derivedContent="RFC6678"/> against TEAP version 1.</t>
      <section numbered="true" anchor="a1-requirement-411-rfc-compliance" removeInRFC="false" toc="include" pn="section-appendix.a.1">
        <name slugifiedName="name-requirement-411-rfc-complia">Requirement 4.1.1: RFC Compliance</name>
        <t indent="0" pn="section-appendix.a.1-1">TEAPv1 meets this requirement by being compliant with <xref target="RFC3748" format="default" sectionFormat="of" derivedContent="RFC3748"/>, <xref target="RFC4017" format="default" sectionFormat="of" derivedContent="RFC4017"/>, <xref target="RFC5247" format="default" sectionFormat="of" derivedContent="RFC5247"/>, and <xref target="RFC4962" format="default" sectionFormat="of" derivedContent="RFC4962"/>.  It is also compliant with the "cryptographic algorithm
agility" requirement by leveraging TLS 1.2 for all cryptographic
algorithm negotiation.</t>
      </section>
      <section numbered="true" anchor="a2-requirement-421-tls-requirements" removeInRFC="false" toc="include" pn="section-appendix.a.2">
        <name slugifiedName="name-requirement-421-tls-require">Requirement 4.2.1: TLS Requirements</name>
        <t indent="0" pn="section-appendix.a.2-1">TEAPv1 meets this requirement by mandating TLS version 1.2 support as
defined in <xref target="phase1" format="default" sectionFormat="of" derivedContent="Section 3.2"/>.</t>
      </section>
      <section numbered="true" anchor="a3-requirement-42111-cipher-suite-negotiation" removeInRFC="false" toc="include" pn="section-appendix.a.3">
        <name slugifiedName="name-requirement-42111-cipher-su">Requirement 4.2.1.1.1: Cipher Suite Negotiation</name>
        <t indent="0" pn="section-appendix.a.3-1">TEAPv1 meets this requirement by using TLS to provide protected
cipher suite negotiation.</t>
      </section>
      <section numbered="true" anchor="a4-requirement-42112-tunnel-data-protection-algorithms" removeInRFC="false" toc="include" pn="section-appendix.a.4">
        <name slugifiedName="name-requirement-42112-tunnel-da">Requirement 4.2.1.1.2: Tunnel Data Protection Algorithms</name>
        <t indent="0" pn="section-appendix.a.4-1">TEAPv1 meets this requirement by mandating cipher suites
as defined in <xref target="phase1" format="default" sectionFormat="of" derivedContent="Section 3.2"/>.</t>
      </section>
      <section numbered="true" anchor="a5-requirement-42113-tunnel-authentication-and-key-establishment" removeInRFC="false" toc="include" pn="section-appendix.a.5">
        <name slugifiedName="name-requirement-42113-tunnel-au">Requirement 4.2.1.1.3: Tunnel Authentication and Key Establishment</name>
        <t indent="0" pn="section-appendix.a.5-1">TEAPv1 meets this requirement by mandating cipher suites that only
include cipher suites that use strong cryptographic algorithms.  They
do not include cipher suites providing mutually anonymous
authentication or static Diffie-Hellman cipher suites as defined in
<xref target="phase1" format="default" sectionFormat="of" derivedContent="Section 3.2"/>.</t>
      </section>
      <section numbered="true" anchor="a6-requirement-4212-tunnel-replay-protection" removeInRFC="false" toc="include" pn="section-appendix.a.6">
        <name slugifiedName="name-requirement-4212-tunnel-rep">Requirement 4.2.1.2: Tunnel Replay Protection</name>
        <t indent="0" pn="section-appendix.a.6-1">TEAPv1 meets this requirement by using TLS to provide sufficient
replay protection.</t>
      </section>
      <section numbered="true" anchor="a7-requirement-4213-tls-extensions" removeInRFC="false" toc="include" pn="section-appendix.a.7">
        <name slugifiedName="name-requirement-4213-tls-extens">Requirement 4.2.1.3: TLS Extensions</name>
        <t indent="0" pn="section-appendix.a.7-1">TEAPv1 meets this requirement by allowing TLS extensions, such as TLS
Certificate Status Request extension <xref target="RFC6066" format="default" sectionFormat="of" derivedContent="RFC6066"/> and SessionTicket
extension <xref target="RFC5077" format="default" sectionFormat="of" derivedContent="RFC5077"/>, to be used during TLS tunnel establishment.</t>
      </section>
      <section numbered="true" anchor="a8-requirement-4214-peer-identity-privacy" removeInRFC="false" toc="include" pn="section-appendix.a.8">
        <name slugifiedName="name-requirement-4214-peer-ident">Requirement 4.2.1.4: Peer Identity Privacy</name>
        <t indent="0" pn="section-appendix.a.8-1">TEAPv1 meets this requirement by establishment of the TLS tunnel and
protection identities specific to the Inner Method.  In addition, the
peer certificate can be sent confidentially (i.e., encrypted).</t>
      </section>
      <section numbered="true" anchor="a9-requirement-4215-session-resumption" removeInRFC="false" toc="include" pn="section-appendix.a.9">
        <name slugifiedName="name-requirement-4215-session-re">Requirement 4.2.1.5: Session Resumption</name>
        <t indent="0" pn="section-appendix.a.9-1">TEAPv1 meets this requirement by mandating support of TLS session
resumption as defined in <xref target="resume-server-state" format="default" sectionFormat="of" derivedContent="Section 3.5.1"/> and TLS session
resumption using the methods defined in <xref target="RFC9190" format="default" sectionFormat="of" derivedContent="RFC9190"/>.</t>
      </section>
      <section numbered="true" anchor="a10-requirement-422-fragmentation" removeInRFC="false" toc="include" pn="section-appendix.a.10">
        <name slugifiedName="name-requirement-422-fragmentati">Requirement 4.2.2: Fragmentation</name>
        <t indent="0" pn="section-appendix.a.10-1">TEAPv1 meets this requirement by leveraging fragmentation support
provided by TLS as defined in <xref target="fragmentation" format="default" sectionFormat="of" derivedContent="Section 3.10"/>.</t>
      </section>
      <section numbered="true" anchor="a11-requirement-423-protection-of-data-external-to-tunnel" removeInRFC="false" toc="include" pn="section-appendix.a.11">
        <name slugifiedName="name-requirement-423-protection-">Requirement 4.2.3: Protection of Data External to Tunnel</name>
        <t indent="0" pn="section-appendix.a.11-1">TEAPv1 meets this requirement by including the TEAP version number
received in the computation of the Crypto-Binding TLV as defined in
<xref target="crypto-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.13"/>.</t>
      </section>
      <section numbered="true" anchor="a12-requirement-431-extensible-attribute-types" removeInRFC="false" toc="include" pn="section-appendix.a.12">
        <name slugifiedName="name-requirement-431-extensible-">Requirement 4.3.1: Extensible Attribute Types</name>
        <t indent="0" pn="section-appendix.a.12-1">TEAPv1 meets this requirement by using an extensible TLV data layer
inside the tunnel as defined in <xref target="teap-tlv-format" format="default" sectionFormat="of" derivedContent="Section 4.2"/>.</t>
      </section>
      <section numbered="true" anchor="a13-requirement-432-requestchallenge-response-operation" removeInRFC="false" toc="include" pn="section-appendix.a.13">
        <name slugifiedName="name-requirement-432-request-cha">Requirement 4.3.2: Request/Challenge Response Operation</name>
        <t indent="0" pn="section-appendix.a.13-1">TEAPv1 meets this requirement by allowing multiple TLVs to be sent in
a single EAP request or response packet, while maintaining the half-duplex
operation typical of EAP.</t>
      </section>
      <section numbered="true" anchor="a14-requirement-433-indicating-criticality-of-attributes" removeInRFC="false" toc="include" pn="section-appendix.a.14">
        <name slugifiedName="name-requirement-433-indicating-">Requirement 4.3.3: Indicating Criticality of Attributes</name>
        <t indent="0" pn="section-appendix.a.14-1">TEAPv1 meets this requirement by having a mandatory bit in each TLV
to indicate whether it is mandatory to support or not as defined in
<xref target="teap-tlv-format" format="default" sectionFormat="of" derivedContent="Section 4.2"/>.</t>
      </section>
      <section numbered="true" anchor="a15-requirement-434-vendor-specific-support" removeInRFC="false" toc="include" pn="section-appendix.a.15">
        <name slugifiedName="name-requirement-434-vendor-spec">Requirement 4.3.4: Vendor-Specific Support</name>
        <t indent="0" pn="section-appendix.a.15-1">TEAPv1 meets this requirement by having a Vendor-Specific TLV to
allow vendors to define their own attributes as defined in
<xref target="vendor-specific-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.8"/>.</t>
      </section>
      <section numbered="true" anchor="a16-requirement-435-result-indication" removeInRFC="false" toc="include" pn="section-appendix.a.16">
        <name slugifiedName="name-requirement-435-result-indi">Requirement 4.3.5: Result Indication</name>
        <t indent="0" pn="section-appendix.a.16-1">TEAPv1 meets this requirement by having a Result TLV to exchange the
final result of the TEAP authentication so both the peer and server
have a synchronized state as defined in <xref target="result-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.4"/>.</t>
      </section>
      <section numbered="true" anchor="a17-requirement-436-internationalization-of-display-strings" removeInRFC="false" toc="include" pn="section-appendix.a.17">
        <name slugifiedName="name-requirement-436-internation">Requirement 4.3.6: Internationalization of Display Strings</name>
        <t indent="0" pn="section-appendix.a.17-1">TEAPv1 meets this requirement by supporting UTF-8 format in the
Basic-Password-Auth-Req TLV as defined in <xref target="bp-auth-req-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.14"/> and the
Basic-Password-Auth-Resp TLV as defined in <xref target="bp-auth-resp-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.15"/>.</t>
      </section>
      <section numbered="true" anchor="a18-requirement-44-eap-channel-binding-requirements" removeInRFC="false" toc="include" pn="section-appendix.a.18">
        <name slugifiedName="name-requirement-44-eap-channel-">Requirement 4.4: EAP Channel-Binding Requirements</name>
        <t indent="0" pn="section-appendix.a.18-1">TEAPv1 meets this requirement by having a Channel-Binding TLV to
exchange the EAP channel-binding data as defined in <xref target="channel-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.7"/>.</t>
      </section>
      <section numbered="true" anchor="a19-requirement-4511-confidentiality-and-integrity" removeInRFC="false" toc="include" pn="section-appendix.a.19">
        <name slugifiedName="name-requirement-4511-confidenti">Requirement 4.5.1.1: Confidentiality and Integrity</name>
        <t indent="0" pn="section-appendix.a.19-1">TEAPv1 meets this requirement by running the password authentication
inside a protected TLS tunnel.</t>
      </section>
      <section numbered="true" anchor="a20-requirement-4512-authentication-of-server" removeInRFC="false" toc="include" pn="section-appendix.a.20">
        <name slugifiedName="name-requirement-4512-authentica">Requirement 4.5.1.2: Authentication of Server</name>
        <t indent="0" pn="section-appendix.a.20-1">TEAPv1 meets this requirement by mandating authentication of the
server before establishment of the protected TLS and then running
inner password authentication as defined in <xref target="phase1" format="default" sectionFormat="of" derivedContent="Section 3.2"/>.</t>
      </section>
      <section numbered="true" anchor="a21-requirement-4513-server-certificate-revocation-checking" removeInRFC="false" toc="include" pn="section-appendix.a.21">
        <name slugifiedName="name-requirement-4513-server-cer">Requirement 4.5.1.3: Server Certificate Revocation Checking</name>
        <t indent="0" pn="section-appendix.a.21-1">TEAPv1 meets this requirement by supporting TLS Certificate Status
Request extension <xref target="RFC6066" format="default" sectionFormat="of" derivedContent="RFC6066"/> during tunnel establishment.</t>
      </section>
      <section numbered="true" anchor="a22-requirement-452-internationalization" removeInRFC="false" toc="include" pn="section-appendix.a.22">
        <name slugifiedName="name-requirement-452-internation">Requirement 4.5.2: Internationalization</name>
        <t indent="0" pn="section-appendix.a.22-1">TEAPv1 meets this requirement by supporting UTF-8 format in
Basic-Password-Auth-Req TLV as defined in <xref target="bp-auth-req-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.14"/> and
Basic-Password-Auth-Resp TLV as defined in <xref target="bp-auth-resp-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.15"/>.</t>
      </section>
      <section numbered="true" anchor="a23-requirement-453-metadata" removeInRFC="false" toc="include" pn="section-appendix.a.23">
        <name slugifiedName="name-requirement-453-metadata">Requirement 4.5.3: Metadata</name>
        <t indent="0" pn="section-appendix.a.23-1">TEAPv1 meets this requirement by supporting Identity-Type TLV as
defined in <xref target="identity-type-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.3"/> to indicate whether the authentication is
for a user or a machine.</t>
      </section>
      <section numbered="true" anchor="a24-requirement-454-password-change" removeInRFC="false" toc="include" pn="section-appendix.a.24">
        <name slugifiedName="name-requirement-454-password-ch">Requirement 4.5.4: Password Change</name>
        <t indent="0" pn="section-appendix.a.24-1">TEAPv1 meets this requirement by supporting multiple
Basic-Password-Auth-Req TLV and Basic-Password-Auth-Resp TLV exchanges within a
single EAP authentication, which allows "housekeeping"" functions
such as password change.</t>
      </section>
      <section numbered="true" anchor="a25-requirement-461-method-negotiation" removeInRFC="false" toc="include" pn="section-appendix.a.25">
        <name slugifiedName="name-requirement-461-method-nego">Requirement 4.6.1: Method Negotiation</name>
        <t indent="0" pn="section-appendix.a.25-1">TEAPv1 meets this requirement by supporting inner EAP method
negotiation within the protected TLS tunnel.</t>
      </section>
      <section numbered="true" anchor="a26-requirement-462-chained-methods" removeInRFC="false" toc="include" pn="section-appendix.a.26">
        <name slugifiedName="name-requirement-462-chained-met">Requirement 4.6.2: Chained Methods</name>
        <t indent="0" pn="section-appendix.a.26-1">TEAPv1 meets this requirement by supporting inner EAP method chaining
within protected TLS tunnels as defined in <xref target="inner-eap" format="default" sectionFormat="of" derivedContent="Section 3.6.2"/>.</t>
      </section>
      <section numbered="true" anchor="a27-requirement-463-cryptographic-binding-with-the-tls-tunnel" removeInRFC="false" toc="include" pn="section-appendix.a.27">
        <name slugifiedName="name-requirement-463-cryptograph">Requirement 4.6.3: Cryptographic Binding with the TLS Tunnel</name>
        <t indent="0" pn="section-appendix.a.27-1">TEAPv1 meets this requirement by supporting cryptographic binding of
the inner EAP method keys with the keys derived from the TLS tunnel
as defined in <xref target="crypto-binding-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.13"/>.</t>
      </section>
      <section numbered="true" anchor="a28-requirement-464-peer-initiated-eap-authentication" removeInRFC="false" toc="include" pn="section-appendix.a.28">
        <name slugifiedName="name-requirement-464-peer-initia">Requirement 4.6.4: Peer-Initiated EAP Authentication</name>
        <t indent="0" pn="section-appendix.a.28-1">TEAPv1 meets this requirement by supporting the Request-Action TLV as
defined in <xref target="request-action-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.9"/> to allow a peer to initiate another inner
EAP method.</t>
      </section>
      <section numbered="true" anchor="a29-requirement-465-method-metadata" removeInRFC="false" toc="include" pn="section-appendix.a.29">
        <name slugifiedName="name-requirement-465-method-meta">Requirement 4.6.5: Method Metadata</name>
        <t indent="0" pn="section-appendix.a.29-1">TEAPv1 meets this requirement by supporting the Identity-Type TLV as
defined in <xref target="identity-type-tlv" format="default" sectionFormat="of" derivedContent="Section 4.2.3"/> to indicate whether the authentication is
for a user or a machine.</t>
      </section>
    </section>
    <section numbered="true" anchor="appendix-b-major-differences-from-eap-fast" removeInRFC="false" toc="include" pn="section-appendix.b">
      <name slugifiedName="name-major-differences-from-eap-">Major Differences from EAP-FAST</name>
      <t indent="0" pn="section-appendix.b-1">This document is a new standard tunnel EAP method based on revision
of EAP-FAST version 1 <xref target="RFC4851" format="default" sectionFormat="of" derivedContent="RFC4851"/> that contains improved flexibility,
particularly for negotiation of cryptographic algorithms.  The major
changes are:</t>
      <ol spacing="normal" type="1" indent="adaptive" start="1" pn="section-appendix.b-2"><li pn="section-appendix.b-2.1" derivedCounter="1.">
          <t indent="0" pn="section-appendix.b-2.1.1">The EAP method name has been changed from EAP-FAST to TEAP; this
change thus requires that a new EAP Type be assigned.</t>
        </li>
        <li pn="section-appendix.b-2.2" derivedCounter="2.">
          <t indent="0" pn="section-appendix.b-2.2.1">This version of TEAP <bcp14>MUST</bcp14> support TLS 1.2 <xref target="RFC5246" format="default" sectionFormat="of" derivedContent="RFC5246"/>.  TLS 1.1 and earlier <bcp14>MUST NOT</bcp14> be used with TEAP.</t>
        </li>
        <li pn="section-appendix.b-2.3" derivedCounter="3.">
          <t indent="0" pn="section-appendix.b-2.3.1">The key derivation now makes use of TLS keying material exporters
<xref target="RFC5705" format="default" sectionFormat="of" derivedContent="RFC5705"/> and the PRF and hash function negotiated in TLS.  This
is to simplify implementation and better support cryptographic
algorithm agility.</t>
        </li>
        <li pn="section-appendix.b-2.4" derivedCounter="4.">
          <t indent="0" pn="section-appendix.b-2.4.1">TEAP is in full conformance with the SessionTicket extension <xref target="RFC5077" format="default" sectionFormat="of" derivedContent="RFC5077"/>.</t>
        </li>
        <li pn="section-appendix.b-2.5" derivedCounter="5.">
          <t indent="0" pn="section-appendix.b-2.5.1">Support is provided for passing optional Outer TLVs in the first
two message exchanges, in addition to the Authority-ID TLV data
in EAP-FAST.</t>
        </li>
        <li pn="section-appendix.b-2.6" derivedCounter="6.">
          <t indent="0" pn="section-appendix.b-2.6.1">Basic password authentication on the TLV level has been added in
addition to the existing inner EAP method.</t>
        </li>
        <li pn="section-appendix.b-2.7" derivedCounter="7.">
          <t indent="0" pn="section-appendix.b-2.7.1">Additional TLV types have been defined to support EAP channel
binding and metadata.  They are the Identity-Type TLV and
Channel-Binding TLVs, defined in <xref target="teap-tlv-format" format="default" sectionFormat="of" derivedContent="Section 4.2"/>.</t>
        </li>
      </ol>
    </section>
    <section numbered="true" anchor="appendix-c-examples" removeInRFC="false" toc="include" pn="section-appendix.c">
      <name slugifiedName="name-examples">Examples</name>
      <section numbered="true" anchor="c1-successful-authentication" removeInRFC="false" toc="include" pn="section-appendix.c.1">
        <name slugifiedName="name-successful-authentication">Successful Authentication</name>
        <t indent="0" pn="section-appendix.c.1-1">The following exchanges show a successful TEAP authentication with
basic password authentication.  The
conversation will appear as follows:</t>
        <artwork align="left" pn="section-appendix.c.1-2">
   Authenticating Peer     Authenticator
   -------------------     -------------
                           &lt;- EAP-Request/
                           Identity
   EAP-Response/
   Identity (MyID1) -&gt;
                           &lt;- EAP-Request/
                           EAP-Type=TEAP, V=1
                           (TEAP Start, S bit set, Authority-ID)

   EAP-Response/
   EAP-Type=TEAP, V=1
   (TLS client_hello) -&gt;

                           &lt;- EAP-Request/
                           EAP-Type=TEAP, V=1
                           (TLS server_hello,
                           (TLS change_cipher_spec,
                            TLS finished)

   EAP-Response/
   EAP-Type=TEAP, V=1 -&gt;
   (TLS change_cipher_spec,
    TLS finished)

   TLS channel established
   (messages sent within the TLS channel)

                          &lt;- Basic-Password-Auth-Req TLV, Challenge

   Basic-Password-Auth-Resp TLV, Response with both
   username and password) -&gt;

   optional additional exchanges (new pin mode,
   password change, etc.) ...

                        &lt;- Intermediate-Result TLV (Success),
                            Crypto-Binding TLV (Request),
                            Result TLV (Success)

   Intermediate-Result TLV (Success),
   Crypto-Binding TLV(Response),
   Result TLV (Success) -&gt;

   TLS channel torn down
   (messages sent in cleartext)

                           &lt;- EAP-Success</artwork>
      </section>
      <section numbered="true" anchor="c2-failed-authentication" removeInRFC="false" toc="include" pn="section-appendix.c.2">
        <name slugifiedName="name-failed-authentication">Failed Authentication</name>
        <t indent="0" pn="section-appendix.c.2-1">The following exchanges show a failed TEAP authentication due to
wrong user credentials.  The conversation will appear as follows:</t>
        <artwork align="left" pn="section-appendix.c.2-2">
   Authenticating Peer     Authenticator
   -------------------     -------------
                           &lt;- EAP-Request/Identity

   EAP-Response/
   Identity (MyID1) -&gt;


                           &lt;- EAP-Request/
                           EAP-Type=TEAP, V=1
                           (TEAP Start, S bit set, Authority-ID)

   EAP-Response/
   EAP-Type=TEAP, V=1
   (TLS client_hello) -&gt;

                           &lt;- EAP-Request/
                           EAP-Type=TEAP, V=1
                           (TLS server_hello,
                           (TLS change_cipher_spec,
                            TLS finished)

   EAP-Response/
   EAP-Type=TEAP, V=1 -&gt;
   (TLS change_cipher_spec,
    TLS finished)

   TLS channel established
   (messages sent within the TLS channel)

                          &lt;- Basic-Password-Auth-Req TLV, Challenge

   Basic-Password-Auth-Resp TLV, Response with both
   username and password) -&gt;

                           &lt;- Intermediate-Result TLV (Failure),
                              Result TLV (Failure)

   Intermediate-Result TLV (Failure),
   Result TLV (Failure) -&gt;

   TLS channel torn down
   (messages sent in cleartext)

                           &lt;- EAP-Failure</artwork>
      </section>
      <section numbered="true" anchor="c3-full-tls-handshake-using-certificate-based-cipher-suite" removeInRFC="false" toc="include" pn="section-appendix.c.3">
        <name slugifiedName="name-full-tls-handshake-using-ce">Full TLS Handshake Using Certificate-Based Cipher Suite</name>
        <t indent="0" pn="section-appendix.c.3-1">In the case within TEAP Phase 1 where an abbreviated TLS handshake is
tried, fails, and falls back to the certificate-based full TLS
handshake, the conversation will appear as follows:</t>
        <artwork align="left" pn="section-appendix.c.3-2">
  Authenticating Peer    Authenticator
  -------------------    -------------
                         &lt;- EAP-Request/Identity
  EAP-Response/
  Identity (MyID1) -&gt;

  // Identity sent in the clear.  May be a hint to help route
     the authentication request to EAP server, instead of the
     full user identity.

                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TEAP Start, S bit set, Authority-ID)
  EAP-Response/
  EAP-Type=TEAP, V=1
  (TLS client_hello with
  SessionTicket extension)-&gt;

  // If the server rejects the session resumption,
     it falls through to the full TLS handshake.

                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS server_hello,
                           TLS certificate,
                          [TLS server_key_exchange,]
                          [TLS certificate_request,]
                           TLS server_hello_done)

  EAP-Response/
  EAP-Type=TEAP, V=1
  ([TLS certificate,]
   TLS client_key_exchange,
  [TLS certificate_verify,]
   TLS change_cipher_spec,
   TLS finished) -&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS change_cipher_spec,
                           TLS finished,
                           EAP-Payload TLV[EAP-Request/
                           Identity])

  // TLS channel established
     (messages sent within the TLS channel)

  // First EAP Payload TLV is coalesced with the TLS Finished as
     Application Data and protected by the TLS tunnel.

  EAP-Payload TLV
  [EAP-Response/Identity (MyID2)]-&gt;

  // identity protected by TLS.

                           &lt;- EAP-Payload TLV
                           [EAP-Request/EAP-Type=X]

  EAP-Payload TLV
  [EAP-Response/EAP-Type=X] -&gt;

  // Method X exchanges followed by Protected Termination

                       &lt;- Intermediate-Result TLV (Success),
                           Crypto-Binding TLV (Request),
                           Result TLV (Success)

  Intermediate-Result TLV (Success),
  Crypto-Binding TLV (Response),
  Result TLV (Success) -&gt;

  // TLS channel torn down
  (messages sent in cleartext)

                          &lt;- EAP-Success</artwork>
      </section>
      <section numbered="true" anchor="c4-client-authentication-during-phase-1-with-identity-privacy" removeInRFC="false" toc="include" pn="section-appendix.c.4">
        <name slugifiedName="name-client-authentication-durin">Client Authentication During Phase 1 with Identity Privacy</name>
        <t indent="0" pn="section-appendix.c.4-1">In the case where a certificate-based TLS handshake occurs within
TEAP Phase 1 and client certificate authentication and identity
privacy is desired (and therefore TLS renegotiation is being used to
transmit the peer credentials in the protected TLS tunnel), the
conversation will appear as follows for TLS 1.2:</t>
        <artwork align="left" pn="section-appendix.c.4-2">
  Authenticating Peer     Authenticator
  -------------------     -------------
                         &lt;- EAP-Request/Identity
  EAP-Response/
  Identity (MyID1) -&gt;

  // Identity sent in the clear.  May be a hint to help route
     the authentication request to EAP server, instead of the
     full user identity.

                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TEAP Start, S bit set, Authority-ID)
  EAP-Response/
  EAP-Type=TEAP, V=1
  (TLS client_hello)-&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS server_hello,
                           TLS certificate,
                          [TLS server_key_exchange,]
                          [TLS certificate_request,]
                           TLS server_hello_done)
  EAP-Response/
  EAP-Type=TEAP, V=1
  (TLS client_key_exchange,
   TLS change_cipher_spec,
   TLS finished) -&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS change_cipher_spec,
                           TLS finished,
                           EAP-Payload TLV[EAP-Request/
                           Identity])

  // TLS channel established
     (EAP Payload messages sent within the TLS channel)

  // peer sends TLS client_hello to request TLS renegotiation
  TLS client_hello -&gt;

                          &lt;- TLS server_hello,
                           TLS certificate,
                           [TLS server_key_exchange,]
                           [TLS certificate_request,]
                           TLS server_hello_done
  [TLS certificate,]
   TLS client_key_exchange,
  [TLS certificate_verify,]
   TLS change_cipher_spec,
   TLS finished -&gt;

                          &lt;- TLS change_cipher_spec,
                             TLS finished,
                             Crypto-Binding TLV (Request),
                             Result TLV (Success)

  Crypto-Binding TLV (Response),
  Result TLV (Success)) -&gt;

  //TLS channel torn down
  (messages sent in cleartext)

                          &lt;- EAP-Success</artwork>
      </section>
      <section numbered="true" anchor="c5-fragmentation-and-reassembly" removeInRFC="false" toc="include" pn="section-appendix.c.5">
        <name slugifiedName="name-fragmentation-and-reassembl">Fragmentation and Reassembly</name>
        <t indent="0" pn="section-appendix.c.5-1">In the case where TEAP fragmentation is required, the conversation
will appear as follows:</t>
        <artwork align="left" pn="section-appendix.c.5-2">
  Authenticating Peer     Authenticator
  -------------------     -------------
                          &lt;- EAP-Request/
                          Identity
  EAP-Response/
  Identity (MyID) -&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TEAP Start, S bit set, Authority-ID)

  EAP-Response/
  EAP-Type=TEAP, V=1
  (TLS client_hello)-&gt;

                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS server_hello,
                           TLS certificate,
                          [TLS server_key_exchange,]
                          [TLS certificate_request,]
                           TLS server_hello_done)
                          (Fragment 1: L, M bits set)

  EAP-Response/
  EAP-Type=TEAP, V=1 -&gt;

                          &lt;- EAP-Request/
                             EAP-Type=TEAP, V=1
                          (Fragment 2: M bit set)
  EAP-Response/
  EAP-Type=TEAP, V=1 -&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (Fragment 3)
  EAP-Response/
  EAP-Type=TEAP, V=1
  ([TLS certificate,]
   TLS client_key_exchange,
  [TLS certificate_verify,]
   TLS change_cipher_spec,
   TLS finished)
   (Fragment 1: L, M bits set)-&gt;

                           &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
  EAP-Response/
  EAP-Type=TEAP, V=1
  (Fragment 2)-&gt;
                         &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS change_cipher_spec,
                           TLS finished,
                          [EAP-Payload TLV[
                          EAP-Request/Identity]])

  // TLS channel established
     (messages sent within the TLS channel)

  // First EAP Payload TLV is coalesced with the TLS Finished as
     Application Data and protected by the TLS tunnel.

  EAP-Payload TLV
  [EAP-Response/Identity (MyID2)]-&gt;

  // identity protected by TLS.

                           &lt;- EAP-Payload TLV
                           [EAP-Request/EAP-Type=X]

  EAP-Payload TLV
  [EAP-Response/EAP-Type=X] -&gt;

  // Method X exchanges followed by Protected Termination

                       &lt;- Intermediate-Result TLV (Success),
                           Crypto-Binding TLV (Request),
                           Result TLV (Success)

  Intermediate-Result TLV (Success),
  Crypto-Binding TLV (Response),
  Result TLV (Success) -&gt;

  // TLS channel torn down
  (messages sent in cleartext)

                          &lt;- EAP-Success</artwork>
      </section>
      <section numbered="true" anchor="c6-sequence-of-eap-methods" removeInRFC="false" toc="include" pn="section-appendix.c.6">
        <name slugifiedName="name-sequence-of-eap-methods">Sequence of EAP Methods</name>
        <t indent="0" pn="section-appendix.c.6-1">When TEAP is negotiated with a sequence of EAP method X followed by
method Y, the conversation will occur as follows:</t>
        <artwork align="left" pn="section-appendix.c.6-2">
  Authenticating Peer     Authenticator
  -------------------     -------------
                          &lt;- EAP-Request/
                          Identity
  EAP-Response/
  Identity (MyID1) -&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TEAP Start, S bit set, Authority-ID)

  EAP-Response/
  EAP-Type=TEAP, V=1
  (TLS client_hello)-&gt;

                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS server_hello,
                           TLS certificate,
                          [TLS server_key_exchange,]
                          [TLS certificate_request,]
                           TLS server_hello_done)
  EAP-Response/
  EAP-Type=TEAP, V=1
  ([TLS certificate,]
   TLS client_key_exchange,
  [TLS certificate_verify,]
   TLS change_cipher_spec,
   TLS finished) -&gt;
                         &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS change_cipher_spec,
                           TLS finished,
                           Identity-Type TLV,
                          EAP-Payload TLV[
                          EAP-Request/Identity])

  // TLS channel established
     (messages sent within the TLS channel)

  // First EAP Payload TLV is coalesced with the TLS Finished as
     Application Data and protected by the TLS tunnel

  Identity_Type TLV
  EAP-Payload TLV
  [EAP-Response/Identity] -&gt;

                          &lt;- EAP-Payload TLV
                        [EAP-Request/EAP-Type=X]

  EAP-Payload TLV
  [EAP-Response/EAP-Type=X] -&gt;

         // Optional additional X Method exchanges...

                         &lt;- EAP-Payload TLV
                        [EAP-Request/EAP-Type=X]

  EAP-Payload TLV
  [EAP-Response/EAP-Type=X]-&gt;

                          &lt;- Intermediate Result TLV (Success),
                           Crypto-Binding TLV (Request),
                           Identity-Type TLV,
                          EAP-Payload TLV[
                          EAP-Request/Identity])

  // Compound MAC calculated using keys generated from
     EAP method X and the TLS tunnel.

  // Next EAP conversation started (with EAP-Request/Identity)
     after successful completion of previous method X.  The
     Intermediate-Result and Crypto-Binding TLVs are sent in
     the next packet to minimize round trips.

  Intermediate Result TLV (Success),
  Crypto-Binding TLV (Response),
  EAP-Payload TLV [EAP-Response/Identity (MyID2)] -&gt;

         // Optional additional EAP method Y exchanges...

                         &lt;- EAP Payload TLV [
                         EAP-Type=Y]

  EAP Payload TLV
  [EAP-Type=Y] -&gt;

                         &lt;- Intermediate-Result TLV (Success),
                           Crypto-Binding TLV (Request),
                           Result TLV (Success)

  Intermediate-Result TLV (Success),
  Crypto-Binding TLV (Response),
  Result TLV (Success) -&gt;

  // Compound MAC calculated using keys generated from EAP
     methods X and Y and the TLS tunnel.  Compound keys are
     generated using keys generated from EAP methods X and Y
     and the TLS tunnel.

  // TLS channel torn down (messages sent in cleartext)

                          &lt;- EAP-Success</artwork>
      </section>
      <section numbered="true" anchor="c7-failed-crypto-binding" removeInRFC="false" toc="include" pn="section-appendix.c.7">
        <name slugifiedName="name-failed-crypto-binding">Failed Crypto-Binding</name>
        <t indent="0" pn="section-appendix.c.7-1">The following exchanges show a failed crypto-binding validation.  The
conversation will appear as follows:</t>
        <artwork align="left" pn="section-appendix.c.7-2">
  Authenticating Peer     Authenticator
  -------------------     -------------
                          &lt;- EAP-Request/
                          Identity
  EAP-Response/
  Identity (MyID1) -&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TEAP Start, S bit set, Authority-ID)

  EAP-Response/
  EAP-Type=TEAP, V=1
  (TLS client_hello) -&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS Server Key Exchange
                           TLS Server Hello Done)
  EAP-Response/
  EAP-Type=TEAP, V=1 -&gt;
  (TLS Client Key Exchange
   TLS change_cipher_spec,
   TLS finished)

                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS change_cipher_spec
                           TLS finished)
                           EAP-Payload TLV[
                           EAP-Request/Identity])

     // TLS channel established
        (messages sent within the TLS channel)

     // First EAP Payload TLV is coalesced with the TLS Finished as
        Application Data and protected by the TLS tunnel.

  EAP-Payload TLV/
  EAP Identity Response -&gt;

                         &lt;-  EAP Payload TLV, EAP-Request,
                             (EAP-FAST-MSCHAPV2, Challenge)

  EAP Payload TLV, EAP-Response,
  (EAP-FAST-MSCHAPV2, Response) -&gt;

                         &lt;-  EAP Payload TLV, EAP-Request,
                             (EAP-FAST-MSCHAPV2, Success Request)

  EAP Payload TLV, EAP-Response,
  (EAP-FAST-MSCHAPV2, Success Response) -&gt;

                       &lt;- Intermediate-Result TLV (Success),
                           Crypto-Binding TLV (Request),
                              Result TLV (Success)

     Intermediate-Result TLV (Success),
     Result TLV (Failure)
     Error TLV with
     (Error Code = 2001) -&gt;

  // TLS channel torn down
     (messages sent in cleartext)

                       &lt;- EAP-Failure</artwork>
      </section>
      <section numbered="true" anchor="c8-sequence-of-eap-method-with-vendor-specific-tlv-exchange" removeInRFC="false" toc="include" pn="section-appendix.c.8">
        <name slugifiedName="name-sequence-of-eap-method-with">Sequence of EAP Method with Vendor-Specific TLV Exchange</name>
        <t indent="0" pn="section-appendix.c.8-1">When TEAP is negotiated with a sequence of EAP methods followed by a
Vendor-Specific TLV exchange, the conversation will occur as follows:</t>
        <artwork align="left" pn="section-appendix.c.8-2">
  Authenticating Peer     Authenticator
  -------------------     -------------
                          &lt;- EAP-Request/
                          Identity
  EAP-Response/
  Identity (MyID1) -&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TEAP Start, S bit set, Authority-ID)

  EAP-Response/
  EAP-Type=TEAP, V=1
  (TLS client_hello)-&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS server_hello,
                           TLS certificate,
                   [TLS server_key_exchange,]
                   [TLS certificate_request,]
                       TLS server_hello_done)

  EAP-Response/
  EAP-Type=TEAP, V=1
  ([TLS certificate,]
   TLS client_key_exchange,
  [TLS certificate_verify,]
   TLS change_cipher_spec,
   TLS finished) -&gt;
                         &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS change_cipher_spec,
                           TLS finished,
                          EAP-Payload TLV[
                          EAP-Request/Identity])

  // TLS channel established
     (messages sent within the TLS channel)

  // First EAP Payload TLV is coalesced with the TLS Finished as
     Application Data and protected by the TLS tunnel.

  EAP-Payload TLV
  [EAP-Response/Identity] -&gt;

                        &lt;- EAP-Payload TLV
                        [EAP-Request/EAP-Type=X]

  EAP-Payload TLV
  [EAP-Response/EAP-Type=X] -&gt;

                         &lt;- EAP-Payload TLV
                        [EAP-Request/EAP-Type=X]

  EAP-Payload TLV
  [EAP-Response/EAP-Type=X]-&gt;

                          &lt;- Intermediate Result TLV (Success),
                           Crypto-Binding TLV (Request),
                           Vendor-Specific TLV,

  // Vendor-Specific TLV exchange started after successful
     completion of previous method X.  The Intermediate-Result
     and Crypto-Binding TLVs are sent with Vendor-Specific TLV
     in next packet to minimize round trips.

  // Compound MAC calculated using keys generated from
     EAP method X and the TLS tunnel.

  Intermediate Result TLV (Success),
  Crypto-Binding TLV (Response),
  Vendor-Specific TLV -&gt;

      // Optional additional Vendor-Specific TLV exchanges...

                         &lt;- Vendor-Specific TLV

  Vendor-Specific TLV -&gt;
                         &lt;- Result TLV (Success)

  Result TLV (Success) -&gt;

  // TLS channel torn down (messages sent in cleartext)

                          &lt;- EAP-Success</artwork>
      </section>
      <section numbered="true" anchor="c9-peer-requests-inner-method-after-server-sends-result-tlv" removeInRFC="false" toc="include" pn="section-appendix.c.9">
        <name slugifiedName="name-peer-requests-inner-method-">Peer Requests Inner Method After Server Sends Result TLV</name>
        <t indent="0" pn="section-appendix.c.9-1">In the case where the peer is authenticated during Phase 1 and the
server sends back a Result TLV but the peer wants to request another
Inner Method, the conversation will appear as follows:</t>
        <artwork align="left" pn="section-appendix.c.9-2">
  Authenticating Peer    Authenticator
  -------------------    -------------
                         &lt;- EAP-Request/Identity
  EAP-Response/
  Identity (MyID1) -&gt;

  // Identity sent in the clear.  May be a hint to help route
     the authentication request to EAP server, instead of the
     full user identity. TLS client certificate is also sent.

                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TEAP Start, S bit set, Authority-ID)
  EAP-Response/
  EAP-Type=TEAP, V=1
  (TLS client_hello)-&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS server_hello,
                           TLS certificate,
                          [TLS server_key_exchange,]
                          [TLS certificate_request,]
                           TLS server_hello_done)

  EAP-Response/
  EAP-Type=TEAP, V=1
  [TLS certificate,]
   TLS client_key_exchange,
  [TLS certificate_verify,]
   TLS change_cipher_spec,
   TLS finished -&gt;
                          &lt;- EAP-Request/
                          EAP-Type=TEAP, V=1
                          (TLS change_cipher_spec,
                           TLS finished,
                           Crypto-Binding TLV (Request),
                            Result TLV (Success))

  // TLS channel established
     (TLV Payload messages sent within the TLS channel)

   Crypto-Binding TLV(Response),
   Request-Action TLV
   (Status=Failure, Action=Negotiate-EAP)-&gt;

                        &lt;- EAP-Payload TLV
                            [EAP-Request/Identity]

  EAP-Payload TLV
  [EAP-Response/Identity] -&gt;

                        &lt;- EAP-Payload TLV
                        [EAP-Request/EAP-Type=X]

  EAP-Payload TLV
  [EAP-Response/EAP-Type=X] -&gt;

                         &lt;- EAP-Payload TLV
                        [EAP-Request/EAP-Type=X]

  EAP-Payload TLV
  [EAP-Response/EAP-Type=X]-&gt;

                          &lt;- Intermediate Result TLV (Success),
                             Crypto-Binding TLV (Request),
                             Result TLV (Success)

  Intermediate Result TLV (Success),
  Crypto-Binding TLV (Response),
  Result TLV (Success)) -&gt;

  // TLS channel torn down
  (messages sent in cleartext)

                          &lt;- EAP-Success</artwork>
      </section>
      <section numbered="true" anchor="c10-channel-binding" removeInRFC="false" toc="include" pn="section-appendix.c.10">
        <name slugifiedName="name-channel-binding-2">Channel Binding</name>
        <t indent="0" pn="section-appendix.c.10-1">The following exchanges show a successful TEAP authentication with
basic password authentication and channel binding using a
Request-Action TLV.  The conversation will appear as follows:</t>
        <artwork align="left" pn="section-appendix.c.10-2">
   Authenticating Peer     Authenticator
   -------------------     -------------
                           &lt;- EAP-Request/
                           Identity
   EAP-Response/
   Identity (MyID1) -&gt;

                           &lt;- EAP-Request/
                           EAP-Type=TEAP, V=1
                           (TEAP Start, S bit set, Authority-ID)

   EAP-Response/
   EAP-Type=TEAP, V=1
   (TLS client_hello) -&gt;

                           &lt;- EAP-Request/
                           EAP-Type=TEAP, V=1
                           (TLS server_hello,
                           (TLS change_cipher_spec,
                            TLS finished)

   EAP-Response/
   EAP-Type=TEAP, V=1 -&gt;
   (TLS change_cipher_spec,
    TLS finished)

   TLS channel established
   (messages sent within the TLS channel)

                          &lt;- Basic-Password-Auth-Req TLV, Challenge

   Basic-Password-Auth-Resp TLV, Response with both
   username and password) -&gt;

   optional additional exchanges (new pin mode,
   password change, etc.) ...

                        &lt;- Crypto-Binding TLV (Request),
                            Result TLV (Success),

   Crypto-Binding TLV(Response),
   Request-Action TLV
   (Status=Failure, Action=Process TLV,
   TLV=Channel-Binding TLV)-&gt;

                            &lt;- Channel-Binding TLV (Response),
                            Result TLV (Success),

   Result TLV (Success) -&gt;

   TLS channel torn down
   (messages sent in cleartext)

                           &lt;- EAP-Success</artwork>
      </section>
      <section numbered="true" anchor="c11-pkcs-exchange" removeInRFC="false" toc="include" pn="section-appendix.c.11">
        <name slugifiedName="name-pkcs-exchange">PKCS Exchange</name>
        <t indent="0" pn="section-appendix.c.11-1">The following exchanges show the peer sending a PKCS#10 TLV and
server replying with a PKCS7 TLV. The exchange below assumes that the
EAP peer is authenticated in Phase 1, either via bidirectional
certificate exchange or some other TLS method such as a proof of
knowledge (TLS-POK).  The conversation will appear as follows:</t>
        <artwork align="left" pn="section-appendix.c.11-2">
,----.                                             ,-------.
|Peer|                                             |AuthSrv|
`-+--'                                             `---+---'
  |               EAP-Request / Identity               |
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - -
  |                                                    |
  |           EAP-Response / Identity (MYID1)          |
  |  - - - - - - - - - - - - - - - - - - - - - - - - - &gt;
  |                                                    |
  |             EAP-Request/EAP-Type=TEAP,             |
  |              V=1(TEAP Start,                       |
  |              S bit set,                            |
  |              Authority-ID)                         |
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - -
  |                                                    |
  |             EAP-Response/EAP-Type=TEAP,            |
  |              V=1(TLS client_hello)                 |
  |  - - - - - - - - - - - - - - - - - - - - - - - - - &gt;
  |                                                    |
  |             EAP-Request/ EAP-Type=TEAP,            |
  |              V=1(TLS server_hello,                 |
  |              TLS certificate,                      |
  |              TLS certificate_request,              |
  |              TLS finished)                         |
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - -
  |                                                    |
  |        EAP-Response/EAP-Type=TEAP,                 |
  |         V=1(TLS change_cipher_spec,                |
  |             TLS certificate,                       |
  |        TLS finished) TLS channel established       |
  |  - - - - - - - - - - - - - - - - - - - - - - - - - &gt;
  |                                                    |
  |               Send Request-Action TLV              |
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - -
  |                                                    |
  |                   Send PKCS10 TLV                  |
  |  - - - - - - - - - - - - - - - - - - - - - - - - - &gt;
  |                                                    |
  | Sign the CSR and send PKCS7 TLV Intermediate-Result|
  | TLV request(Success),                              |
  |  Crypto-Binding TLV(Request),                      |
  |  Result TLV(Success)                               |
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - -
  |                                                    |
  |     Intermediate-Result TLV response(Success),     |
  |      Crypto-Binding TLV(Response),                 |
  |      Result TLV(Success)                           |
  |  - - - - - - - - - - - - - - - - - - - - - - - - - &gt;
  |                                                    |
  |                     EAP Success                    |
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - -</artwork>
      </section>
      <section numbered="true" anchor="c12-failure-scenario" removeInRFC="false" toc="include" pn="section-appendix.c.12">
        <name slugifiedName="name-failure-scenario">Failure Scenario</name>
        <t indent="0" pn="section-appendix.c.12-1">The following exchanges show a failure scenario. The conversation
will appear as follows:</t>
        <artwork align="left" pn="section-appendix.c.12-2">
,----.                                                  ,-------.
|Peer|                                                  |AuthSrv|
`-+--'                                                  `---+---'
  |                  EAP-Request / Identity                 |
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - - - -
  |                                                         |
  |             EAP-Response / Identity (MYID1)             |
  |  - - - - - - - - - - - - - - - - - - - - - - - - - - - -&gt;
  |                                                         |
  |          EAP-Request/EAP-Type=TEAP, V=1                 |
  |          (TEAP Start, S bit set, Authority-ID)          |
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - - - -
  |                                                         |
  |    EAP-Response/EAP-Type=TEAP, V=1(TLS client_hello)    |
  |  - - - - - - - - - - - - - - - - - - - - - - - - - - - -&gt;
  |                                                         |
  | EAP-Request/ EAP-Type=TEAP, V=1                         |
  | (TLS server_hello,(TLS change_cipher_spec, TLS finished)|
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - - - -
  |                                                         |
  |             EAP-Response/EAP-Type=TEAP, V=1             |
  |             (TLS change_cipher_spec,                    |
  |             TLS finished)                               |
  |             TLS channel established                     |
  |  - - - - - - - - - - - - - - - - - - - - - - - - - - - -&gt;
  |                                                         |
  |                    Request-Action TLV                   |
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - - - -
  |                                                         |
  |                      Bad PKCS10 TLV                     |
  |  - - - - - - - - - - - - - - - - - - - - - - - - - - - -&gt;
  |                                                         |
  |        Intermediate-Result TLV request(Failure),        |
  |        Result TLV(Failure)                              |
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - - - -
  |                                                         |
  |        Intermediate-Result TLV response(Failure),       |
  |        Result TLV(Failure)                              |
  |  - - - - - - - - - - - - - - - - - - - - - - - - - - - -&gt;
  |                                                         |
  |                       EAP Failure                       |
  | &lt;- - - - - - - - - - - - - - - - - - - - - - - - - - - -</artwork>
      </section>
      <section numbered="true" anchor="c13-client-certificate-in-phase-1" removeInRFC="false" toc="include" pn="section-appendix.c.13">
        <name slugifiedName="name-client-certificate-in-phase">Client Certificate in Phase 1</name>
        <t indent="0" pn="section-appendix.c.13-1">The following exchanges show a scenario where the client certificate
is sent in Phase 1 and no additional authentication or provisioning
is performed in Phase 2. The conversation will appear as follows:</t>
        <artwork align="left" pn="section-appendix.c.13-2">
,----.                                    ,-------.
|Peer|                                    |AuthSrv|
`-+--'                                    `---+---'
  |           EAP-Request / Identity          |
  | &lt;- - - - - - - - - - - - - - - - - - - - -
  |                                           |
  |      EAP-Response / Identity (MYID1)      |
  |  - - - - - - - - - - - - - - - - - - - - -&gt;
  |                                           |
  |         EAP-Request/EAP-Type=TEAP,        |
  |          V=1(TEAP Start,                  |
  |          S bit set,                       |
  |          Authority-ID)                    |
  | &lt;- - - - - - - - - - - - - - - - - - - - -
  |                                           |
  |        EAP-Response/EAP-Type=TEAP,        |
  |         V=1(TLS client_hello)             |
  |  - - - - - - - - - - - - - - - - - - - - -&gt;
  |                                           |
  |        EAP-Request/ EAP-Type=TEAP,        |
  |         V=1(TLS server_hello,             |
  |         TLS certificate,                  |
  |         TLS certificate_request,          |
  |         TLS change_cipher_spec,           |
  |         TLS finished)                     |
  | &lt;- - - - - - - - - - - - - - - - - - - - -
  |                                           |
  |   EAP-Response/EAP-Type=TEAP,             |
  |    V=1(TLS certificate,                   |
  |        TLS change_cipher_spec,            |
  |   TLS finished) TLS channel established   |
  |  - - - - - - - - - - - - - - - - - - - - -&gt;
  |                                           |
  |        Crypto-Binding TLV(Request),       |
  |        Result TLV(Success)                |
  | &lt;- - - - - - - - - - - - - - - - - - - - -
  |                                           |
  |  Crypto-Binding TLV(Response),            |
  |  Result TLV(Success)                      |
  |  - - - - - - - - - - - - - - - - - - - - -&gt;
  |                                           |
  |                EAP Success                |
  | &lt;- - - - - - - - - - - - - - - - - - - - -</artwork>
      </section>
    </section>
    <section anchor="changes-from-rfc-7170" numbered="true" removeInRFC="false" toc="include" pn="section-appendix.d">
      <name slugifiedName="name-changes-from-rfc-7170">Changes from RFC 7170</name>
      <t indent="0" pn="section-appendix.d-1">Alan DeKok was added as an editor.</t>
      <t indent="0" pn="section-appendix.d-2"> The document was converted to Markdown from the <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/> text output.</t>
      <t indent="0" pn="section-appendix.d-3"> Any formatting changes from <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/> may have
      resulted from changing from XML to Markdown as the source file when
      editing the draft.</t>
      <t indent="0" pn="section-appendix.d-4">The IANA Considerations section was replaced with a note to change
      the IANA registry references to this document.</t>
      <t indent="0" pn="section-appendix.d-5">A new section was added to explain that the inner EAP-MSCHAPv2                                                            
derivation follows EAP-FAST.  This is the largest technical change                                                                 
from the previous revision of this document and follows existing implementations.</t>
      <t indent="0" pn="section-appendix.d-6">Many small changes have been made throughout the document to correct                                                      
inconsistencies and to address mistakes.  At a high level:</t>
      <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-appendix.d-7">
        <li pn="section-appendix.d-7.1">
          <t indent="0" pn="section-appendix.d-7.1.1">All open errata have been addressed.</t>
        </li>
        <li pn="section-appendix.d-7.2">
          <t indent="0" pn="section-appendix.d-7.2.1">A new term "Inner Method" has been defined.</t>
        </li>
        <li pn="section-appendix.d-7.3">
          <t indent="0" pn="section-appendix.d-7.3.1">The definitions and derivation of IMSK, S-IMCK, etc. have been corrected and clarified.</t>
        </li>
        <li pn="section-appendix.d-7.4">
          <t indent="0" pn="section-appendix.d-7.4.1">The diagrams in <xref target="appendix-c-examples" format="default" sectionFormat="of" derivedContent="Appendix C"/> have been updated to match the TEAP state machine.</t>
        </li>
      </ul>
      <t indent="0" pn="section-appendix.d-8">All uses of the PAC were removed.  It had not been implemented, and                                                       
there were no plans by implementors to use it.</t>
      <t indent="0" pn="section-appendix.d-9">Text was added on recommendations for inner and outer identities.</t>
      <t indent="0" pn="section-appendix.d-10"><xref target="oops" format="default" sectionFormat="of" derivedContent="Section 6.2.5"/> was added late in the document life cycle in order to                                               
document accidental behavior that could result in interoperability                                                                 
issues.</t>
    </section>
    <section anchor="acknowledgments" numbered="false" removeInRFC="false" toc="include" pn="section-appendix.e">
      <name slugifiedName="name-acknowledgments">Acknowledgments</name>
      <t indent="0" pn="section-appendix.e-1">Nearly all of the text in this document was taken directly from <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/>. We are grateful to the original authors and
      reviewers for that document.  The acknowledgments given here are only
      for the changes that resulted in this document.</t>
      <t indent="0" pn="section-appendix.e-2"><contact fullname="Alexander Clouter"/> provided substantial and
      detailed technical feedback on nearly every aspect of the specification.
      The corrections in this document are based on his work.</t>
      <t indent="0" pn="section-appendix.e-3">We wish to thank the many reviewers and commenters in the EMU WG,
      including <contact fullname="Eliot Lear"/>, <contact fullname="Joe       Salowey"/>, <contact fullname="Heikki Vatiainen"/>, <contact fullname="Bruno Pereria Vidal"/>, and <contact fullname="Michael       Richardson"/>.  Many corner cases and edge conditions were caught and
      corrected as a result of their feedback.</t>
      <t indent="0" pn="section-appendix.e-4"><contact fullname="Jouni Malinin"/> initially pointed out the issues
      with <xref target="RFC7170" format="default" sectionFormat="of" derivedContent="RFC7170"/>.  Those comments resulted in substantial discussion on the
      EMU WG mailing list, and eventually this document.  Jouni also made
      substantial contributions in analyzing corner cases, which resulted in
      the text in <xref target="oops" format="default" sectionFormat="of" derivedContent="Section 6.2.5"/>.</t>
    </section>
    <section anchor="contributors" numbered="false" toc="include" removeInRFC="false" pn="section-appendix.f">
      <name slugifiedName="name-contributors">Contributors</name>
      <contact initials="H." surname="Zhou" fullname="Han Zhou">
        <organization showOnFrontPage="true"/>
        <address>
      </address>
      </contact>
      <contact initials="J." surname="Salowey" fullname="Joseph Salowey">
        <organization showOnFrontPage="true"/>
        <address>
          <email>joe@salowey.net</email>
        </address>
      </contact>
      <contact initials="N." surname="Cam-Winget" fullname="Nancy Cam-Winget">
        <organization showOnFrontPage="true"/>
        <address>
          <email>ncamwing@cisco.com</email>
        </address>
      </contact>
      <contact initials="S." surname="Hanna" fullname="Steve Hanna">
        <organization showOnFrontPage="true"/>
        <address>
          <email>steve.hanna@infineon.com</email>
        </address>
      </contact>
    </section>
    <section anchor="authors-addresses" numbered="false" removeInRFC="false" toc="include" pn="section-appendix.g">
      <name slugifiedName="name-authors-address">Author's Address</name>
      <author initials="A." surname="DeKok" fullname="Alan DeKok" role="editor">
        <organization showOnFrontPage="true"/>
        <address>
          <email>alan.dekok@inkbridge.io</email>
        </address>
      </author>
    </section>
  </back>
</rfc>
