MS-MPPE keys in proxy

[Alan DeKok]

M Arif wrote:
> I am having trouble understanding the EAP-TLS authentication when
> requests are proxied.

  There is nothing magic.

> I want to know how MS-MPPE-Send-Key and MS-MPPE-Recv-Keys are
> transferred in proxy..

  They are transferred verbatim by the proxy.

> since these keys contain values calculated with
> EAP-Messages exchanged hashed with shared secret bla bla.

  The *values* are transferred verbatim.  The *encrypted* versions are
decrypted when the proxy receives a reply from the home server, and
encrypted by the proxy when it sends a reply to the client.

> Does the proxy
> keep its own EAP state and varialbe and calculates the Message
> Authenticator. or free-radius ignores these keys when exchanging EAP
> messages.

  That questions makes no sense.

  The process of handling the MPPE keys is *exactly* the same as
proxying User-Password.  There is no magic.  It is very simple.

  Alan DeKok.