Subject: [eap] RE: Review: draft-puthenkulam-eap-binding-01.txt

From: [email-masked] ([email-masked])
Date: Fri, 7 Mar 2003 09:58:56 +0200

> -----Original Message-----
> From: ext Joseph Salowey [mailto:[email-masked]]
> Sent: Wednesday, March 05, 2003 8:24 PM
> To: 'Puthenkulam, Jose P'; [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: RE: [eap] Review: draft-puthenkulam-eap-binding-01.txt
  ...
> [Joe] Currently I am of the opinion that combined keys=20
> provides the best solution.  Combined keys should provide the =
potential=20
> to be stronger than either individual key.  I need to think more about =

> Jukka's > proposal. =20

I agree with you; using only the inner protocol keys for session key
derivation would be weaker, and loses some good properties provided by
tunnels, e.g. Perfect Forward Secrecy (PFS) in some cases.

A tunneling scheme such as PEAP (fixed to provide some kind of
cryptographic binding) could be used without server authentication in
the tunnel (e.g. client doesn't verify the certificate at all, or uses
anonymous-DH TLS cipher suite) to provide PFS for other EAP methods.

For instance, it doesn't really matter that much if the EAP-SIM Kc
keys are weak, or MS-CHAPv2 keys are vulnerable to dictionary attacks,
if they are used together with the tunnel keys. Even if the tunneling
does not perform server authentication, the attacker would have to
break the "weak" keys in real-time, and also perform man-in-the-middle
attack for the EAP conversation. This is much more difficult than
simply recording some WLAN traffic and attacking it off-line.

So, provided that the keys are combined properly, compound keys
from both inner and outer methods is probably the best choice.

Best regards,
Pasi

---

From: [email-masked] (Jari Arkko)
Date: Fri, 07 Mar 2003 10:15:32 +0200

> simply recording some WLAN traffic and attacking it off-line.

Could you break this down a bit? I see that dictionary attacks
could be a problem. But then again, you don't actually have to
*break* the method in-real time. You just have to act as a mitm
long enough to see what the parties exchange, and *then* you
go off-line to perform the dictionary attack. So what is added
here is the need to be a mitm. But I don't see how this adds
the need to do things in real-time.

Secondly, isn't there a distinction between weak keys and
dictionary attacks? In the dictionary attack case you acquire
the permanent credentials and can afterwards freely use the
victim's account. This is valuable, even if you'd have to spend
some time off-line first. But the weak key case appears somewhat
different. You still have to do the attack fast if your intention
is to gain access; once the user logs out or re-authenticates
the attack is no longer possible. Of course, if you succeed
in breaking the keys, this might give you an ability to read
the packets that were exchanged. However, it isn't clear to
me if the four-way handshake in 802.11i would prevent these
attacks. Does it do Diffie-Hellman?

> from both inner and outer methods is probably the best choice.

Ok. But are there any downsides to making the combination? Does
it add a requirement to access generated master secrets from
either the inner or outer method?

Jari