[PATCH 0/2] EAP-PEAP: Fix TLS 1.3 cryptobinding and expose policy

[Jouni Malinen]

On Mon, Oct 05, 2026 at 05:35:34PM +0200, github at singe.za.net wrote:
> This pair addresses two PEAPv0 cryptobinding issues.
> 
> 1 - hostapd generates wrong crypto binding TK when using TLS 1.3
> 2 - there is no way to have hostapd's EAP server require cryptobinding

Thanks, applied.

> Patch 1 makes the authenticator request the same amount of key material as the
> peer and extends the TLS 1.3 hwsim test to require cryptobinding. This could be
> split into a separate test, but this would exercise the full code path.

By the way, that change in the case alone is not sufficient to test
cryptobinding.. PEAPv0 needs to be forced for that to happen and I added
that in the commit as well to make sure that this case would indeed fail
without the fixed EAP-PEAP server implementation.

-- 
Jouni Malinen                                            PGP id EFC895FA