Subject: RE: Follow up on Authorize Only issue (was RE: [Isms] ISMS session summary)

From: "Glen Zorn \(gwz\)" <[email-masked]>
Date: Tue, 18 Jul 2006 15:34:40 -0700

Nelson, David <mailto:[email-masked]> supposedly scribbled:

...

> 
> In this particular ISMS use case, SNMP service is authorized based on
> the assertion of identity of the user by the NAS, without the RADIUS
> server ever having performed an authentication, and without the
> benefit of the resultant State attribute.  Thus, the risk is
> potentially higher.   

Actually, the same risk has always been present in RADIUS, because of the way that PPP CHAP (&, for that matter, the MD5-Challenge EAP method) is implemented.  The RADIUS server in the CHAP case generally has no idea whether the user is actually present or not: the NAS presents the server with a self-generated challenge and a response that may or may not be a replay; without saving every challenge-response pair, the server cannot know if the response is fresh or not.
 
> 
> The questions at hand are whether the risk is high enough to be of
> serious concern, and whether or not it can be mitigated? 

The risk I mention above has never seemed to bother anyone, at least not enough to fix it; I don't know why we should be obsessing over it now.

...

Hope this helps,

~gwz

Why is it that most of the world's problems can't be solved by simply
  listening to John Coltrane? -- Henry Gabriel

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 18 Jul 2006 18:45:05 -0400

"Glen Zorn \(gwz\)" <[email-masked]> wrote:
> The risk I mention above has never seemed to bother anyone, at least not
> enough to fix it;

  True.  I think the concern here is that the user has not been
authenticated.  In the above scenario, the bad guesses have been
rejected, and no additional information leaks from the RADIUS server
to the NAS.  If the user is authenticated, then information about the
user can, and should be sent from the server to the NAS.

  I could rephrase the original question as: what information can the
RADIUS server send to the NAS about the user, if the user was not
authenticated through RADIUS?

  For privacy and security, I think the answer is "none".  For useful
networks, I think "authorize only" is pretty safe.

  If we look at another threat scenairo: A user is authenticated
through RADIUS, and RADIUS returns authorization parameters in the
Access-Accept.  Since the contents of RADIUS packets aren't encrypted,
anyone who can see that traffic can see all of the users
authorization.  So the information could be construed as public.

  In that case, there's little additional risk in sending that
information, again unencrypted, to a NAS without authenticating the
user.

  If the traffic *is* encrypted, then the previous analysis doesn't
apply...

  Alan DeKok.