HP-UX AAA Server A.08.01 administrator's guide (T1428-90072, May 2010)

Lookup AATV Functionality and Return Events
The fast re-authentication lookup AATV attempts to retrieve the full authentication
details of the Fast-Reauth-Username attribute from its database.
• If the information is available, the lookup AATV updates the
AUTHREQ_REPLY_QUEUE list of the authreq with the specified output and a
RETRIEVE_SUCCESS message is returned
• If the information is not available, a RETRIEVE_ERROR message is returned.
• The lookup AATV can check if the fast re-authentication information has expired
based on the Fast-Reauth-Expiration-Time value. If the fast re-authentication
information has expired, a RETRIEVE_ERROR message is returned, and the
cur_request list of the authreq is not updated. If the AATV does not check for
an expired entry, the Fast-Reauth-Expiration-Time value is returned.
Subsequently, the HP-UX AAA Server checks for the expiration.
Pseudonym Identities
Pseudonym Identity support is an optional EAP-SIM and EAP-AKA feature, which
provides identity protection by hiding the permanent identity on the second and all
future authentications.
The HP-UX AAA Server can generate pseudonyms as an encrypted form of the
permanent identity, which can be subsequently decrypted to reproduce the permanent
identity. Alternatively, the server can generate pseudonyms as a string of random
characters, similar to the fast re-authentication identity. In the latter case, an external
database is required to store the pseudonym to permanent identity mappings. For
many users, the algorithm-based pseudonyms are the easiest and most efficient option.
Random pseudonyms are required if the algorithm does not provide adequate security
to the permanent identity.
Random Pseudonyms
The server, while operating in an environment where a central database is used for
saving the pseudonym to permanent identity mappings, can be configured to generate
a pseudonym as a string of random characters. The server can also store the last used
and last assigned pseudonyms in this central database. EAP-SIM RFC 4186 recommends
saving at least two pseudonyms, the last used and the last assigned. To ensure random
pseudonyms work, the realm configuration in EAP-Type SIM{} block within the
EAP.authfile file must specify the Pseudonym-Lookup and Pseudonym-Update
parameters with an AATV, which maps the pseudonym to the permanent identity,
and which stores the random pseudonym in the database. In this case, the pseudonym
algorithm is employed and the pseudonym resembles a fast re-authentication identity
with a different prefix. The random pseudonym identity is 10 characters long, consisting
of the pseudonym prefix 2, followed by nine random characters from the character set,
{BCDFGHJKLMNPQRSTVWXYZ0123456789}. The random pseudonym is advantageous,
256 Configuring EAP-SIM and EAP-AKA Authentication Methods