Subject: [abfab] Mutual authentication and channel binding should be required

From: Sam Hartman <[email-masked]>
Date: Thu, 31 Mar 2011 07:52:38 -0400

Over lunch, we discovered why it is that you want to require mutual
authentication and channel binding all the time for gss-eap.

The reason is that we're introducing a new application into the system.
Consider the following.

1) EAP is used  for network access. Since that's the only application
and since mutual authentication is not important in a particular
deployment for that, EAP mechanisms that do not provide mutual
authentication are used.

2) A new application, such as e-mail with TLS authentication for e-mail
is deployed.

3) An attacker pretends to be an access point towards a client captures
authentication credentials and then uses them to access the user's mail.

By increasing the number of possible services we've created a situation
where security has been decreased.
To avoid this, at most one service may permit authentication without
establishing which service is involved.
That service is already network access.

For that reason, I think that draft-ietf-gss-eap should be revised to be
consistent with the applicability statement rather than revising the
applicability statement to be more permissive.

---

From: "Alper Yegin" <[email-masked]>
Date: Thu, 31 Mar 2011 15:00:46 +0300

Hi Sam,

Using EAP one-way authentication with network access is neither the norm,
nor allowed by any decent network architecture. Whatever network allows that
already has its own security issues without compounding with any
higher-layer threats.

I don't know if and how it impacts the Abfab discussion, I'm just commenting
on the network access part.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Sam Hartman
> Sent: Thursday, March 31, 2011 2:53 PM
> To: [email-masked]
> Subject: [abfab] Mutual authentication and channel binding should be
> required
> 
> 
> _______________________________________________
> abfab mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/abfab

---

From: Sam Hartman <[email-masked]>
Date: Thu, 31 Mar 2011 08:17:20 -0400

>>>>> "Alper" == Alper Yegin <[email-masked]> writes:

    Alper> Hi Sam, Using EAP one-way authentication with network access
    Alper> is neither the norm, nor allowed by any decent network
    Alper> architecture. Whatever network allows that already has its
    Alper> own security issues without compounding with any higher-layer
    Alper> threats.

I agree with you.

We were basically discussing whether to permit  that one-way use for
abfab.
I think we agree you SHOULD NOT deploy that way.
The question is whether you MUST NOT deploy that way.

I'm now arguing that we MUST NOT use eap without mutual.

In some ways it is a pointless argument because we already agree it is a
bad idea for network access.

It's also at least a bad idea for network access.

I'm arguing that if your network access deployment is bad then it can
make your abfab deployment worse.
To prevent that we can forbid  the bad deployment from ABFAB.
I think that's desirable, but it doesn't matter much.

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 31 Mar 2011 14:42:15 +0200

I guess you are talking about mutual authentication of the EAP peer and the EAP server.

See also text we put in http://tools.ietf.org/html/rfc5998

---

From: Nico Williams <[email-masked]>
Date: Thu, 31 Mar 2011 08:02:24 -0500

Just require mutual auth.  What's the cost?

Nico
--