RE: Clarification of EAP authentication in IKEv2?
Hugo Krawczyk <hugo <at> ee.technion.ac.il>
2004-01-02 20:46:20 GMT
On Wed, 31 Dec 2003 Pasi.Eronen <at> nokia.com wrote:
>
> > Moreover, this envelopping gives a false sense of security
> > which can easily lead applications to, for example, send
> > sensitive information as part of the exchange assuming its
> > protection under SK_e.
>
> It's quite clear that without the signature, the initiator at
> this point (before the AUTH payloads with EAP-derived keys) does
> not know who is the other party it shares SK_e with.But, as
> the EAP methods were designed to be useful even without any
> encryption (during the EAP exchange), Idon't think this false
> sense of security is very important.
We disagree. I've seen even "more obvious" protocols being misused. And in
this case I would not blame anyone that sees the protection under SK{} and
assumes that this protection has some actual effect such as protecting the
exchange from an (active) eavsdropper.
>
> > As a more immediate threat, what this signature-less version
> > of ikev2 is doing is to allow the same Asokan-Niemi-Nyberg
> > mitm attacks (in reverse direction) that the key-generating
> >EAP extensions of ikev2 were designed to avoid, namely, the
> > "stealing" of EAP runs from one context to another.
> > Specifically, by impersonating a signature-less responder in
> > the IKE exchange, the attacker can trick an initiator, that is
> > willing to run the EAP method in a IKEv2-context only, to
(Continue reading)
RSS Feed