Subject: [eap] EAP-SIM -- Protected Start/Notifybefore fast-ReAuth

From: Uma Shankar Ch <[email-masked]>
Date: Mon, 23 Aug 2004 18:31:10 +0530

Can any body answer this query -- from "draft-haverinen-pppext-eap-sim-13.txt"

As of now,the protected  Notification are valid only after successful 
EAP-Request/SIM/Challenge round trip in full authentication or 
successful  EAP-Request/SIM/Re-authentication round trip in fast 
re-authentication. IF the draft won't mandate protected notifications after 
successful authentication there is a possibility for session closure by the 
peer because of an attacker as mentioned below.

Consider the case, when server is going for fast re-authentication and for 
the same it has started with EAP-Request/SIM/Start and at that point of 
time even if, EAP server wants to send a Notification it MUST send a 
protected notify, otherwise an attacker can always force the peer to close 
the connection just by sending a unprotected Notification Failure followed 
by Failure.

In the similar lines, before the fast re-authentication, the 
EAP-Request/SIM/Start MUST be protected, if not a man in the middle 
attacker  can always force the peer to reveal the permanent Identity by 
changing the actual the EAP-Request/SIM/Start from AT_ANY_ID to 
AT_PERMENANT_ID_REQ. Where server is expecting a valid fast-re 
authentication ID and for that peer would be responding with Permanent 
Identity because of the Man-In-Middle attacker.

So, is it not advisable to send EAP-Request/SIM/Start or 
EAP-Request/Identity under the protection of the K_auth key derived in 
full-authentication, before going for fast re-authentication.

Thanks in advance.
Uma S

www.intoto.com

---

From: "Joseph Salowey" <[email-masked]>
Date: Mon, 23 Aug 2004 08:49:03 -0700

Hi Uma,

Thanks for a detailed review of the document.  Comments inline below. 

Joe

Uma Shankar Ch wrote:
> re-authentication. IF the draft won't mandate protected notifications
> after successful authentication there is a possibility for session
> closure by the peer because of an attacker as mentioned below.     
> 
> Consider the case, when server is going for fast re-authentication
> and for the same it has started with EAP-Request/SIM/Start and at
> that point of time even if, EAP server wants to send a Notification
> it MUST send a protected notify, otherwise an attacker can always
> force the peer to close the connection just by sending a unprotected
> Notification Failure followed by Failure.     
>

[Joe] This is true, any notification sent in the clear will result in a
failure.  We chose not to attempt to protect from many DOS attacks on
EAP-SIM as there are many in the system that we can do nothing about.
Perhaps in the future a subsequent version of EAP-SIM will be able to do
better.  
 
> attacker  can always force the peer to reveal the permanent Identity
> by changing the actual the EAP-Request/SIM/Start from AT_ANY_ID to
> authentication ID and for that peer would be responding with
> Permanent Identity because of the Man-In-Middle attacker.      
> 

[Joe] It is not possible to avoid this problem with EAP-SIM alone.  The
identity privacy offered by EAP-SIM is only slightly better than what is
provided by GSM TMSI.  Considerations for implementing identity privacy are
discussed in several places throughout the document including section 9.1
and section 4.2.2.5.  

> EAP-Request/Identity under the protection of the K_auth key derived
> in full-authentication, before going for fast re-authentication.  
> 

[Joe] You are correct that the protection of these messages can help reduce
the problems you described above.  Unfortunately it is not possible to
protect these using EAP-SIM.  If this level of protection is desired then a
tunneling method such as PEAP,TTLS,EAP-FAST, or IKEv2 should be used with
EAP-SIM as an inner method.  

> www.intoto.com

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap