Subject: [eap] draft-funk-eap-md5-tunneled-00.txt

From: [email-masked] (Paul Funk)
Date: Fri, 07 Mar 2003 19:46:06 -0500

At the upcoming meeting, I'll be presenting a new EAP protocol
which gets around the Man-in-the-Middle attack on tunneled
protocols for CHAP and EAP-MD5-Challenge.

The protocol, called EAP-MD5-Tunneled, allows a CHAP-equivalent
authentication to occur inside a tunnel that is not vulnerable to MitM,
but that is convertible to CHAP or EAP-MD5-Challenge for proxy
purposes.

The basic idea is that the MD5 digest is only partially performed by
the client, and completed by the server. Normal CHAP that is
intercepted by an attacker cannot be converted into credentials usable
within this protocol.

This draft won't be on the IETF site prior to the meeting due to the I-D
blackout period. Here's a link to use in the meantime:

http://www.funk.com/documents/draft-funk-eap-md5-tunneled-00.txt

Paul