Man-in-the-Middle in Tunnelled Authentication

Recently new protocols have been proposed in IETF for protecting remote client authentication protoocols by running them within a secure tunnel. Examples of such protocols are PIC, PEAP and EAP-TTLS. One goal of these new protocols is to enable the migration from legacy client authentication protocols to more secure protocols, e.g., from plain EAP type to, say, PEAP. In these protocols, the security of the subsequent session credentials is based only on keys derived during the unilateral authentication where the network server is authenticated to the client. Client authentication is mentioned as an option in PEAP and EAP-TTLS, but is not mandated. The PIC protocol does not even o#er this option