Subject: Re: [Emu] on draft-hartman-emu-mutual-crypto-bind-00

From: Sam Hartman <[email-masked]>
Date: Thu, 28 Jun 2012 14:06:00 -0400

>>>>> "zhou" == zhou sujing <[email-masked]> writes:

    zhou> To my understanding, right prior to finishing tunnel establishement, EAP peer
    zhou> and EAP Server(print server in the server insertion attack case) should have
    zhou> exchanged channel binding with integrity protection by key only known to EAP
    zhou> peer and EAP server (MSK in this case),

well, I actually think this happens after tunnel establishment and after
the inner method.
So,  after the print server learns the MSK.
As I read draft-ietf-emu-chbind nothing forbids this. Certainly the
existing implementations of channel binding I'm aware of work that way.

---

From: "Jim Schaad" <[email-masked]>
Date: Thu, 28 Jun 2012 17:00:32 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Sam Hartman
> Sent: Thursday, June 28, 2012 11:06 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Emu] on draft-hartman-emu-mutual-crypto-bind-00
> 
>     zhou> To my understanding, right prior to finishing tunnel
establishement,
> EAP peer
the
> inner method.
existing
> implementations of channel binding I'm aware of work that way.

I think that as I understand it, it would occur before the MSK has been
computed.  An "intermediate" value has been computed but a new channel
binding method could be defined that adds to the MSK and other EAP methods
could be run after the channel binding has been done.

Jim

> _______________________________________________
> Emu mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/emu

---

From: Sam Hartman <[email-masked]>
Date: Thu, 28 Jun 2012 21:18:57 -0400

>>>>> "Jim" == Jim Schaad <[email-masked]> writes:

Before the outer MSK has been computed, yes.
Before the inner MSK (the one you need to attack crypto binding) has
been computed no.
Also, note that the RADIUS server only knows about the inner method, so
it will transport the inner MSK as soon as it believes the inner method
succeeds.