EAP-AKA will not bid up to AKA'

James Prestwood james.prestwood at linux.intel.com
Wed Sep 13 11:30:38 PDT 2017


Hello,

I was testing out EAP-AKA/AKA' server and found that if the eap_user 
file defined an identity which used both AKA and AKA' e.g.

"abc at example.com" AKA,AKA'

the server will never bid up to use AKA' with the AT_BIDDING attribute. 
I traced it down to src/eap_server_aka.c in the function 
eap_aka_build_challenge(). Near the bottom in the while loop it checks 
all available methods to see if AKA' is supported. The problem is that 
there is a check for EAP_TYPE_AKA, and if found it breaks out of the 
loop. This means that the aka_prime_preferred flag will never get set if 
AKA is found (and it will always be found since we are using AKA). This 
whole loop is surrounded with a check for EAP_TYPE_AKA, so I don't quite 
understand why the while loop has the check anyways; it should only be 
looking for AKA'. Removing this check for EAP_TYPE_AKA fixes the 
problem, and the server correctly sends the AT_BIDDING attribute.

Was there a reason this check was done? If not could it be removed? (I 
can send a patch if so).

Thanks,

James




More information about the Hostap mailing list