Subject: RE: Follow up on Authorize Only issue (was RE: [Isms] ISMS session summary)

From: "Glen Zorn \(gwz\)" <[email-masked]>
Date: Tue, 18 Jul 2006 16:54:42 -0700

[email-masked] <mailto:[email-masked]> supposedly scribbled:

> "Glen Zorn \(gwz\)" <[email-masked]> wrote:
>> The risk I mention above has never seemed to bother anyone, at least
>> not enough to fix it;
> 
>   True.  I think the concern here is that the user has not been
> authenticated.  In the above scenario, the bad guesses 

OK, yeah, but I didn't say anything about guesses: in that scenario, the compromised NAS has saved valid credentials from previous authentications & used them for nefarious purposes.

> have been
> rejected, and no additional information leaks from the RADIUS server
> to the NAS.  If the user is authenticated, then information about the
> user can, and should be sent from the server to the NAS.    
> 
>   I could rephrase the original question as: what information can the
> RADIUS server send to the NAS about the user, if the user was not
> authenticated through RADIUS?  
> 
>   For privacy and security, I think the answer is "none".  For useful
> networks, I think "authorize only" is pretty safe. 
> 
>   If we look at another threat scenairo: A user is authenticated
> through RADIUS, and RADIUS returns authorization parameters in the
> Access-Accept.  Since the contents of RADIUS packets aren't
> encrypted, anyone who can see that traffic can see all of the users
> authorization.  So the information could be construed as public.    
> 
>   In that case, there's little additional risk in sending that
> information, again unencrypted, to a NAS without authenticating the
> user.  
> 
>   If the traffic *is* encrypted, then the previous analysis doesn't
> apply... 

I hope that the issue is not divulging the contents of RADIUS attributes but something a bit more serious, like authorizing an imposter.

>   Alan DeKok.

Hope this helps,

~gwz

Why is it that most of the world's problems can't be solved by simply
  listening to John Coltrane? -- Henry Gabriel

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 19 Jul 2006 00:00:44 -0400

"Glen Zorn \(gwz\)" <[email-masked]> wrote:
> OK, yeah, but I didn't say anything about guesses: in that scenario, the
> compromised NAS has saved valid credentials from previous =
> authentications & used them for nefarious purposes.

  It could also save authorization parameters, for precisely the same
reason.

> I hope that the issue is not divulging the contents of RADIUS attributes
> but something a bit more serious, like authorizing an imposter.

  A compromised NAS can authorize anyone it chooses for any purpose.

  If the threat we're trying to avoid is a compromised NAS, then there
is little point in doing more security analysis.  The NAS is *inside*
of the RADIUS trust boundary, with all of the side-effects that result.

  If the threat we're trying to avoid is someone fooling a trusted NAS
into leaking information about users, then that situation is somewhat
more managable.

  Alan DeKok.