Subject: RE: SeNAA comments

From: <[email-masked]>
Date: Tue, 5 Nov 2002 11:37:48 +0200

Alper,

Thank you for your comments. My comments inline. 

BR,
- Dan

> -----Original Message-----
> From: ext Alper E. YEGIN [mailto:[email-masked]]
> Sent: 05 November, 2002 03:22
> To: Forsberg Dan (NRC/Helsinki); Rajahalme Jarno (NRC/Helsinki)
> Cc: Pana (E-mail)
> Subject: SeNAA comments
> 
> 
> 
> Hello,
> 
> Here is my initial set of comments on
> draft-forsberg-pana-secure-network-access-auth-01.txt.
> 
> - Document claims that TLS protocol can be optionally left out
>   from the protocol stack. I cannot see the details (format, etc.)
>   on that. Is this TBD?

Without TLS the signaling starts right away with CLR/CLA messages. Thus, LSA and network authentication are lost if the EAP method itself doesn't provide them (or the L2). The AVPs that are protected inside the TLS-Payload are the same with or without the TLS, except the Msg-Checksum AVP which is TLS mode specific only.

The Session-Id is selected by the PAA and thus if CLR is sent as the first message without TLS the Session-Id could be zero for example. Also, the Authorization-Lifetime and Auth-Grace-Period AVPs in the CLA message could be sent only once.

TBD in next version.

> - PAA discovery is missing. Section 3.2 is not clear. Why does the
>   PaC need to send messages to PAA via AR? They are on the 
> same subnet,
>   therefore it should be able to send them directly.

PAA discovery happens through the access routers (or access points), or should we say EPs. PaC sends the first message to the EP. PaC gets the first answer from the PAA, because EP proxied the request to the PAA. Signaling continues directly between PaC and PAA. In case of PAA initiated authentication the "first message" can be any data packet.

> - In Figure 3, PaC sends a CLR message that includes an EAP-Payload
>   to initiate the EAP authentication. But EAP Request packets are
>   sent by the authenticator. In that case, what would be the content
>   of this EAP message sent by the PaC?

The first EAP-Payload in the CLR contains Identity Response.
 
> - Figure 3, CLR message also includes a field called "User-name".
>   Is this meant to replace EAP Identity Request/Response sequence?

No. It can be used for certificate selection process in the access network and AAA msg routing purposes. Material could be used with EAP also, though.

> - Message flows always start with PaC sending a request. How can PAA
> initiate
>   the sequence? It should be able to signal PaC to start this 
> messaging.

Access network can initiate the signaling with a Client-Auth-Request-Request (CARR) message that can be sent from PAA or even from EP..

TBD in next version.

> - Section 7.0 Security Considerations is not clear. Is MitM 
> still a problem
>   when we use TLS, or not?

MitM can be avoided if EAP method's credentials are different without the TLS (or similar L2 protection) and with the TLS (or similar L2 protection).

But if the credentials are the same with or without SeNAA, TLS mutual authentication is not used and the EAP method is used in uprotected way, then this kind of MitM attack is possible and should be avoided.

> alper

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Tue, 5 Nov 2002 12:29:16 -0800

Hi Dan,

> Without TLS the signaling starts right away with CLR/CLA messages. Thus,
LSA and network authentication are lost if the EAP method itself doesn't
provide them (or the L2). The AVPs that are protected inside the TLS-Payload
are the same with or without the TLS, except the Msg-Checksum AVP which is
TLS mode specific only.
>
> The Session-Id is selected by the PAA and thus if CLR is sent as the first
message without TLS the Session-Id could be zero for example. Also, the
Authorization-Lifetime and Auth-Grace-Period AVPs in the CLA message could
be sent only once.
> TBD in next version.

OK.

> PAA discovery happens through the access routers (or access points), or
should we say EPs. PaC sends the first message to the EP. PaC gets the first
answer from the PAA, because EP proxied the request to the PAA. Signaling
continues directly between PaC and PAA. In case of PAA initiated
authentication the "first message" can be any data packet.

OK, if we can include these details in the draft as well.

> The first EAP-Payload in the CLR contains Identity Response.

Which PaC hasn't received an ID request for... I don't know how this
works with EAP state machine.

> No. It can be used for certificate selection process in the access network
and AAA msg routing purposes. Material could be used with EAP also, though.

This would need clarification in the draft as well, as there are two places
to provide client id now.

> Access network can initiate the signaling with a
Client-Auth-Request-Request (CARR) message that can be sent from PAA or even
from EP..
> TBD in next version.

OK.

> MitM can be avoided if EAP method's credentials are different without the
TLS (or similar L2 protection) and with the TLS (or similar L2 protection).
>
> But if the credentials are the same with or without SeNAA, TLS mutual
authentication is not used and the EAP method is used in uprotected way,
then this kind of MitM attack is possible and should be avoided.

   If an EAP method is used in an unsecure environment, TLS with SeNAA
   doesn't provide adequate protection for the man-in-the-middle attack
   with that EAP method.

So, shouldn't we replace "doesn't" with "can" in the above section?

alper