# Enterprise Security for the Internet of Things (IoT): Lightweight Bootstrapping with EAP-NOOB
## 5 EAP-Noob  
Many different authentication methods have been specified for the EAP framework, making it suitable for building bootstrapping protocols for a variety of IoT devices. However, most of the existing EAP methods require some credentials to be pre-provisioned on the device. EAP-pwd [30] for example requires a user to input a passphrase on the device and the server. Because many IoT devices only have a limited User Interface (UI) available, this task is often non-trivial. Similarly, EAP-TLS [31] requires certificates on both the client IoT device and the AAA server. This is not only costly because of the necessity of certificates, but, as [PERSON] and [PERSON] [32] argue, there is an additional cost of securing the supply chain. Moreover, servers may or may not be able to verify device certificates issued from different manufacturers (and vice-versa). This potentially allows for the creation of walled-gardens where users are locked into a single ecosystem. Nimble out-of-band authentication for EAP (EAP-NOOB) [33] is a new EAP method currently being standardized at the IETF. EAP-NOOB allows for device authentication and bootstrapping without any pre-configured identifiers or security credentials. It not only bootstraps the device, but also binds it with a user account on the AAA server. This is an important feature for managing and re-configuring devices after they have been bootstrapped. Indeed, as we saw in Section 2, many currently deployed devices require users to have a user account through which they manage their network and devices. EAP-NOOB is able to bootstrap devices that have no pre-configured credentials using an ephemeral Elliptic Curve Diffie-Hellman (ECDH) key exchange between the device (called the peer in EAP terminology) and the AAA server. Diffie-Hellman is convenient for bootstrapping new devices since it creates a secure association (shared secret key) between two entities without authenticating them. To prevent man-in-the-middle (MitM) attacks and to authenticate the two endpoints, EAP-NOOB relies on an user-assisted out-of-band (OOB) channel. It requires the user to deliver a single OOB message from either the peer device to the server or from the server to the peer device. This OOB message contains the critical information needed for mutual authentication [33]. The security properties of EAP-NOOB have been verified with formal security proofs [34]. As is the case with many IoT devices, EAP-NOOB specifically supports devices that have limited input/output capabilities. It supports both devices that only have an input interface (e.g., cameras), as well as those that only have an output interface (e.g., printers). However, unlike device-specific proprietary bootstrapping protocols, EAP-NOOB is an open and generic bootstrapping protocol that can support a variety of OOB channels, depending on the capabilities of the device being bootstrapped. Previous implementations [35] have, for example, used QR-codes and NFC-tags for transmitting the OOB authentication data. The EAP-NOOB specification suggests encoding the OOB message content as a Uniform Resource Locator (URL) when sending it in the from the peer device to the server [33]. The size of the message sent on the OOB channel can be in the order of tens of bytes. When encoded as a URL, the length of an OOB message is typically 70-130 characters [36]. While transferring this amount of data on an OOB channel is trivial for large appliances, such as smart TVs, it poses a significant challenge to the use of EAP-NOOB on the devices that are more resource-constrained, such as smart light bulbs. The in-band messages of EAP-NOOB are encoded as JavaScript Object Notation (JSON) objects. EAP-NOOB relies on multiple EAP conversations, called exchanges, for establishing the necessary keys and completing the bootstrapping process. During these exchanges, the peer device and the AAA server exchange configuration parameters perform the ECDH key exchange, and ensure that the OOB message has been delivered correctly.