Subject: [eap] Propsoed resolution to Issue 201: Some NITs

From: Bernard Aboba <[email-masked]>
Date: Tue, 18 Nov 2003 07:34:07 -0800 (PST)

The text of Issue 201 is enclosed below.  The proposed resolution is as
follows:

Replace "acknowledged result indications" with "protected result
indications" throughout the document.

In Section 7.4, change:

Where EAP is tunneled within another protocol that omits peer
authentication, there exists a potential vulnerability to
man-in-the-middle attack.

To:

Where EAP is tunneled within another protocol that omits peer
authentication, there exists a potential vulnerability to
man-in-the-middle attack.   For details, see [BINDING] and [MiTM].

Change:

[b] Requiring cryptographic binding between the EAP tunneling protocol and
the tunneled EAP methods. Where cryptographic binding is supported, a
mechanism is also needed to protect against downgrade attacks that would
bypass it.

To:

[b] Requiring cryptographic binding between the EAP tunneling protocol and
the tunneled EAP methods. Where cryptographic binding is supported, a
mechanism is also needed to protect against downgrade attacks that would
bypass it.   For further details on cryptographic binding, see [BINDING].

Add the following informative references:

[BINDING] Puthenkulam, J., et al., "The Compound Authentication Binding
Problem", draft-puthenkulam-eap-binding-04.txt,
Internet draft (work in progress), October 2003.

[MITM]  N. Asokan, Valtteri Niemi and Kaisa Nyberg, Man-in-the-middle in
tunneled authentication protocols,
Technical Report 2002/163, IACR ePrint archive, October 2002. Available
from http://eprint.iacr.org/2002/163

------------------------------------------------
Issue 201: Some NITs
Submitter name: Jose Puthenkulam
Submitter email address: [email-masked]
Date first submitted: Nov 17, 2003
Reference:
http://mail.frascone.com/pipermail/public/eap/2003-November/001814.html
Document: RFC2284bis-06
Comment type: E
Priority: 1
Section: 7.2, 7.4
Rationale/Explanation of issue:
In section 7.2 [c]

Replace "acknowledged result indications" with "protected result
indications". It makes more sense to have the EAP method indicate its
result in a protected manner than making sure the result is
acknowledged.

Also for section 7.4 Man-in-the-middle attacks would it not be
appropriate to add an informative reference to the EAP Binding Draft and
the Nokia Mitm paper.

[Jari Arkko]

Ok. The term is defined in 7.2.1, and the text already requires
protection, I agree that the name "protected result indications" would be
appropriate. Need to change the name then in both 7.2 and 7.2.1 as well as
in a few other places in the document...

> Also for section 7.4 Man-in-the-middle attacks would it not be
> appropriate to add an informative reference to the EAP Binding Draft and
> the Nokia Mitm paper.

Yes, this would be appropriate.

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "Puthenkulam, Jose P" <[email-masked]>
Date: Tue, 18 Nov 2003 07:27:04 -0800

The resolution and changes look good.

best regards,
jose

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Bernard Aboba
> Sent: Tuesday, November 18, 2003 7:34 AM
> To: [email-masked]
> Subject: [eap] Propsoed resolution to Issue 201: Some NITs
> 
> 
Document: RFC2284bis-06
Comment type: E
Priority: 1
Section: 7.2, 7.4

[Jari Arkko]

Ok. The term is defined in 7.2.1, and the text already requires
protection, I agree that the name "protected result indications" would
be
appropriate. Need to change the name then in both 7.2 and 7.2.1 as well
as
in a few other places in the document...