Subject: [eap] Re: method identification

From: Thomas Otto <[email-masked]>
Date: Sat, 28 Aug 2004 14:30:31 +0200

> case 3. My client software has upgraded to support both EAP methods 
> M1 and M2. Assume that M2 is more stronger authentication method than M1.
> Can the RADIUS server force M2 to be used? It is because, the client can
> send I1 and not I2 in response to EAP-ID/Request.

> My question:
> 1) Identity is independant of EAP method that is used, but client need to
> have different identities to uniquely identify a EAP method to be used, to
> negate attacks as mentioned above. So how the case 3 mentioned above
> generally handled. 

Scenario: 
Peer and EAP server support several EAP methods. Let the common set 
of EAP methods contain two or more methods. 

According to RFC 3748, each EAP method is assigned a different Identifier:
M1 <--> ID1
M2 <--> ID2
Now, the peer choose some (following Suresh, the weakest) EAP method, M1, 
by sending EAP-Response/Identity (ID1). The question arise how the EAP
server can force the execution of a stronger EAP method?

We can generalize the problem above saying
"After sending the EAP-Request/Identity, the peer responds an Identifier ID 
within EAP-Response/Identity(ID) of an arbitrarily chosen supported EAP 
method."

Arbitrary, because ID may correspond to the
- preferred EAP method
- weakest EAP method (downgrade attack)
- EAP method with heavy computational cost on server side (DOS attack)
... 

However, the chosen method is not that one the EAP server wanted to perform.

Now my (immature) first idea: 
Isn't it possible for the EAP server to include in the EAP-Request/Identity
appropriate information about the preferred EAP method? Similar to the I-D
"Network Discovery and Selection" of F.Adrangi et al, where this message has
also been extended. 

Thomas
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Jari Arkko <[email-masked]>
Date: Sun, 29 Aug 2004 10:54:28 +0300

Hi Thomas,

> within EAP-Response/Identity(ID) of an arbitrarily chosen supported EAP 

I don't think support of the EAP method is the key issue here.
The real issue is which credentials you have available.

> "Network Discovery and Selection" of F.Adrangi et al, where this message has

Yes and no.

Yes, in the sense that we have now formulated the network discovery
problem so that you'll actually be receiving hints about the NAI
you should submit. You do this by getting some information about what
network is on the other side. Maybe its your home1.com or home2.com,
that may tell you which credential to use. Or maybe its mediatingnetwork1.net,
in which case you'll realize that you can only use the credential which
can be roamed through this operator.

No, in the sense that we do not want the EAP Identity Request packet
to be the general information delivery vehicle beyond what Farid's
draft is doing. EAP does not have a secure, general negotiation of
EAP methods and we are not chartered to change that.

--Jari