Subject: [Ipsec] Double authentication of responder

From: Tom Stiemerling <[email-masked]>
Date: Tue, 8 Feb 2005 15:15:28 -0500

When you do EAP you delay sending the initiators AUTH until you have done
EAP. Fine.
The spec says you must also do PKI authentication of the responder. Fine.
But then you also re-authenticate the responder in the last message of the
exchange.
So, my question is what purpose does this serve? You have already
authenticated
the server using PKI, so why do it again?

Thanks, Tom

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Wed, 9 Feb 2005 09:38:37 +0200

The second time, the responder is proving that it has a trust 
relationship with the EAP server - that it is not doing some MITM 
attack with the EAP server.

---

From: Tom Stiemerling <[email-masked]>
Date: Wed, 9 Feb 2005 12:05:47 -0500

OK. Here is a summary of my understanding of this:

1) If the EAP method does not generate an MSK, then you are not
authenticating the
EAP server, and the second AUTH from the gateway is redundant.

2) If the EAP method does generate an MSK, but does not  authenticate the
EAP
server, then the second AUTH is necessary to authenticate the EAP server.

3) If the EAP method does generate an MSK and also authenticates the EAP
server,
then the second AUTH is redundant.

Would you agree?

Tom

---

From: Yoav Nir <[email-masked]>
Date: Thu, 10 Feb 2005 10:02:50 +0200

I agree with #1 and with #2. In #3 the AUTH message proves that the EAP 
server trusts the gateway enough to send the MSK.  I'm at a loss to 
figure out why that's important.

---

From: Jari Arkko <[email-masked]>
Date: Thu, 10 Feb 2005 10:42:21 +0200

> 1) If the EAP method does not generate an MSK, then  
> you are not authenticating the EAP server, and 
> the second AUTH from the gateway is rdundant.

Just because you don't generate a key doesn't mean
that you are not authenticating the server. (The
reverse isn't true, see below.)

> 2) If the EAP method does generate an MSK, but does not  
> authenticate the EAP server, then the second AUTH
>  is necessary to authenticate the EAP server.

This case is illegal according to current RFCs. RFC 3748
says "EAP Methods deriving keys MUST provide for mutual
authentication between the EAP peer and the EAP Server."

--Jari