Subject: [eap] Re: submitting EAP-SIM document

From: [email-masked] (Uri Blumenthal)
Date: Thu, 29 May 2003 14:30:25 -0400

This is a multi-part message in MIME format.
--------------010701050405000100090909
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Folks,

My colleange Sarvar Patel asked me to post his analysis
of EAP-SIM draft. Here's the summary in short, and since
the entire paper (in PDF) is only 16 KB, I'm attaching
it to this posting.

EAP-SIM specifies a mechanism for mutual authentication and session key 
agreement using the GSM-SIM and by proposing enhancement to the GSM 
authentication procedures.  Unfortunately, as we show it does not 
succeed in its goal of providing 128 bit security from the current 64 
bit security of GSM. Furthermore, it does not provide session 
independence between different sessions. For the first problem, we are 
able to provide solutions, but the second problem does not seem solvable 
in practice.

--------------010701050405000100090909
Content-Type: application/pdf;
 name="AnalyisOfEAP.pdf"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
 filename="AnalyisOfEAP.pdf"

--------------010701050405000100090909--

---

From: [email-masked] (Joseph Salowey)
Date: Fri, 30 May 2003 17:05:58 -0700

Hi Savar,

Thank you for taking the time to look at the EAP-SIM draft.  Your
comments are valuable feedback.  

With respect to only 64 bits of security this is indeed a problem that
has been overlooked (at least by me).  I think the appropriate action
would be to revise the draft to require the client to check to make sure
the RAND values within a request are different.  

Also EAP-SIM most definitely relies upon the secrecy of Kcs to maintain
session independence.  As you point out, we must require that all
triplets remain secret, because if an attacker obtains RAND and Kc then
he or she can act as the network.  This is discussed in several sections
in the draft, but stronger wording on this fundamental assumption is
probably warranted.  In general I am less concerned about Kc exposure on
the authenticator side than on the client side.  This is because with
EAP-SIM triplets do not have to leave the home domain to facilitate
roaming authentication (EAP-SIM typically terminates in the home
network) which is different than the VLR model in GSM.  On the client
side there are implementations that perform EAP-SIM calculations on the
SIM card that prevent triplet exposure.  Nonetheless it is still a
serious consideration.  

Once again thanks for your time.  I expect we will be updating the draft
to address your comments in the near future.  

Regards,

Joe 
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Uri Blumenthal
> Sent: Thursday, May 29, 2003 11:30 AM
> To: EAP mailing List
> Cc: Sarvar Patel; 'S.Mizikovsky'
> Subject: [eap] Re: submitting EAP-SIM document
> 
> 
> Folks,
>