Subject: [eap] Compound Authentication Draft

From: [email-masked] (Puthenkulam, Jose P)
Date: Fri, 28 Mar 2003 15:43:21 -0800

Some more comments. Also I've only taken the pertinent parts of the last
email that refers to the attack.

> > > Take an example using MSCHAPv2 inside of a mechanism such 
> > > as PEAP. 
> > > Party A can establish a secure connection to party B by 
> > > establishing 
> > > PEAP and verifying B's identity.  B can then request that A 
> > > authenticate
> > > with MSCHAPv2.   A will perform MSCHAPv2 authentication with B.
> > > B can open up another PEAP session to C.  B can proxy the 
> > > MSCHAPv2 
> > > authentication to C  and authenticate as A.  B can now carry on a 
> > > conversation with C as if he were A.
> > 
> > So here B the final authentication server that A trusted, 
> > proxies A's authentication to another server C. So basically 
> > B has violated A's trust in totality. Now what did A trust B 
> > for? The PEAP stage 1 between A and B seems to have no 
> > meaning? I guess all bets are off at this point. 
> > 
> 
> [Joe] Here the problem is that if the inner protocol is not run inside
> of PEAP then B could not send data to C as A.  A may trust B to do
> somethings for him and not others.  For example A may want 
> sotck quites
> from B, probably he does not want B to impersonate him.  
> 

Looks like I'm not comprehending the attack you describe. So here's an
attempt to clarify... Tell me if your case is as follows:

So A wants some service from B we call S1 and it uses identity IA1 for it.
The MS-CHAPv2 credentials used were intended to get access for this service
S1 from B. So this was in context of PEAP session BA (B authenticated by A).

Now C offers service S2 to A and B and the identities for access are IA2 and
IB2 and MSCHAPv2 is the method used. So B after setting up PEAP session with
A now has a separate PEAP session CB with B (C authenticated by B). 

So when A authenticates with B for S1 it uses identity IA1. If A
authenticates with C for S2 it would use IA2 right? How would A ever
disclose IA2 to B when B doesn't provide the service S2? 

I agree the attack you describe is possible if A uses identity IA2 to access
service from C but thru B. Why would this happen? Can you give an example.

Is your case when A has the same identity IA1=IA2 for both services S1 and
S2?  

best regards,
jose

---

From: [email-masked] (Joseph Salowey)
Date: Fri, 28 Mar 2003 16:04:24 -0800

Hi Jose,

I think we are getting close.

> -----Original Message-----
> From: Puthenkulam, Jose P [mailto:[email-masked]] 
> Sent: Friday, March 28, 2003 3:43 PM
> To: 'Joseph Salowey'; [email-masked]
> Subject: RE: [eap] Compound Authentication Draft
> 
> 
> Some more comments. Also I've only taken the pertinent parts 
> of the last email that refers to the attack.
> 
> > somethings for him and not others.  For example A may want sotck 
> > quites from B, probably he does not want B to impersonate him.
> > 
> 
> Looks like I'm not comprehending the attack you describe. So 
> here's an attempt to clarify... Tell me if your case is as follows:
> 
> So A wants some service from B we call S1 and it uses 
> identity IA1 for it. The MS-CHAPv2 credentials used were 
> intended to get access for this service S1 from B. So this 
> was in context of PEAP session BA (B authenticated by A).
> 
[Joe]  So far so good

> Now C offers service S2 to A and B and the identities for 
> access are IA2 and IB2 and MSCHAPv2 is the method used. So B 
> after setting up PEAP session with A now has a separate PEAP 
> session CB with B (C authenticated by B). 
> 
[Joe] The identity for A is the same IA1. Service is not offered to B
and IB2 does not exist

> So when A authenticates with B for S1 it uses identity IA1. 

[Joe] OK

> If A authenticates with C for S2 it would use IA2 right? 

[Joe] It uses IA1 (same identity for both services) 

How 
> would A ever disclose IA2 to B when B doesn't provide the service S2? 
> 

[Joe] Same identity both services.  

> I agree the attack you describe is possible if A uses 
> identity IA2 to access service from C but thru B. Why would 
> this happen? Can you give an example.
> 
[Joe] This is not the case I was thinking about, but in this case it
would have had to use the incorrect credential based on the identity B.
This could be done thrugh incorrect configuration or perhaps some clever
manipulation by B to make things appear to be C (except for the server
side auth).   

> Is your case when A has the same identity IA1=IA2 for both 
> services S1 and S2?  
> 
[Joe]  Yes.