Subject: [eap] Question regarding draft-puthenkulam-eap-binding-01

From: [email-masked] (Jari Arkko)
Date: Sun, 02 Mar 2003 23:32:29 +0200

Joe Salowey wrote:
> It is also not always necessary for the method to be the same inside and
> outside the tunnel to expose this vulnerability(although this makes
> things easier).  If the same credentials are used in different protocols
> inside and outside the tunnel you may still be vulnerable (of course
> using the same credentials in two different mechanism may create other
> vulnerabilities as well.)

Right. Specifically, any messages M1, M2, ..., Mn that you
need inside the tunnel have to be derivable from messages
M1', M2', ..., Mm' used outside the tunnel somewhere else,
without knowledge of secrets associated with the victim(s).

In the basic case of the mitm attack, n = m and Mi = Mi'
so the attack is easy. But its also possible that you
have to change some headers, maybe even to the point
where the actual _method_ can be said to be different,
as long as the cryptographic information in the method
stays unchanged. This necessarily includes use of the
same password or shared secret inside and outside tunnel.

Here's one example where the credentials stay the same
but the method can be said to have "changed" in a very
strict sense of the word: if someone uses CHAP on credential
X, I think you catch that and replay inside a tunnel using
EAP MD5-Challenge.

Jari