RFC 3579

RADIUS (Remote Authentication Dial In User Service) Support For Extensible Authentication Protocol (EAP)
Standards Track
September 2003
RFC Library > Diameter & AAA > RFC 3579
Abstract: This document defines how EAP is carried within RADIUS packets, enabling Network Access Servers to relay EAP authentication exchanges to a back-end RADIUS server. Specifies the EAP-Message and Message-Authenticator attributes, fragmentation handling, and authenticator computation for EAP over RADIUS transport.
Canonical source: https://www.rfc-editor.org/rfc/rfc3579  |  IETF Datatracker

Overview & Purpose

▶

RFC 3579 specifies how the Extensible Authentication Protocol is transported over RADIUS, allowing NAS devices to act as pass-through EAP authenticators that relay EAP packets between the supplicant (UE) and the RADIUS-based authentication server (AAA).

This is critical for 3GPP WLAN interworking (TS 33.234) where EAP-AKA/EAP-AKA' authentication is carried over RADIUS from WLAN access points to the 3GPP AAA server.

EAP-Message Attribute

▶

The EAP-Message attribute (Type 79) encapsulates a single EAP packet within a RADIUS Access-Request, Access-Challenge, Access-Accept, or Access-Reject message.

  • Maximum 253 bytes per attribute instance — multiple EAP-Message attributes are concatenated for larger EAP packets
  • Carried in Access-Request: EAP-Response from supplicant
  • Carried in Access-Challenge: EAP-Request from server
  • Carried in Access-Accept: EAP-Success (optional, may include keying material)
  • Carried in Access-Reject: EAP-Failure

Message-Authenticator

▶

When EAP-Message attributes are present, the Message-Authenticator attribute (Type 80) MUST be included. It provides per-packet authentication using HMAC-MD5 over the entire RADIUS message.

Security requirement: Without Message-Authenticator, an attacker could inject or modify EAP-Message attributes, potentially bypassing authentication.

EAP Session Flow over RADIUS

▶ 
  Supplicant          NAS/AP            RADIUS Server
│                  │                     │
│─EAP-Response/Id─►│                     │
│                  │──Access-Request────►│
│                  │  (EAP-Message)      │
│                  │                     │
│                  │◄─Access-Challenge───│
│                  │  (EAP-Message)      │
│◄─EAP-Request────│                     │
│                  │                     │
│─EAP-Response────►│                     │
│                  │──Access-Request────►│
│                  │                     │
│                  │◄─Access-Accept──────│
│◄─EAP-Success────│  (EAP-Message,      │
│                  │   MS-MPPE-Keys)     │

Key Distribution

▶

When EAP authentication succeeds and generates keying material (MSK/EMSK), the RADIUS server delivers the MSK to the NAS via vendor-specific attributes in the Access-Accept message.

Attribute Type Purpose
EAP-Message 79 EAP packet encapsulation
Message-Authenticator 80 HMAC-MD5 packet integrity
MS-MPPE-Recv-Key Vendor (MS) Receive key from MSK
MS-MPPE-Send-Key Vendor (MS) Send key from MSK
EAP-Key-Name 102 Session key identifier

Fragmentation

▶

EAP packets exceeding 253 bytes are fragmented across multiple EAP-Message attributes within a single RADIUS packet. The NAS concatenates EAP-Message attributes in order to reconstruct the full EAP packet. The maximum RADIUS packet size of 4096 bytes limits the maximum EAP message that can be transported.

3GPP Relevance

▶
  • TS 33.234 WLAN interworking: EAP-AKA/EAP-AKA' carried over RADIUS from untrusted WLAN access points to 3GPP AAA server
  • ePDG/N3IWF: RADIUS may be used as AAA transport between ePDG and 3GPP AAA server for non-3GPP access
  • Legacy integration: Many deployments use RADIUS as the AAA transport even where Diameter is specified, requiring RADIUS-Diameter gateways