Subject: SeNAA comments

From: "Alper E. YEGIN" <[email-masked]>
Date: Mon, 4 Nov 2002 17:22:15 -0800

Hello,

Here is my initial set of comments on
draft-forsberg-pana-secure-network-access-auth-01.txt.

- Document claims that TLS protocol can be optionally left out
  from the protocol stack. I cannot see the details (format, etc.)
  on that. Is this TBD?

- PAA discovery is missing. Section 3.2 is not clear. Why does the
  PaC need to send messages to PAA via AR? They are on the same subnet,
  therefore it should be able to send them directly.

- In Figure 3, PaC sends a CLR message that includes an EAP-Payload
  to initiate the EAP authentication. But EAP Request packets are
  sent by the authenticator. In that case, what would be the content
  of this EAP message sent by the PaC?

- Figure 3, CLR message also includes a field called "User-name".
  Is this meant to replace EAP Identity Request/Response sequence?

- Message flows always start with PaC sending a request. How can PAA
initiate
  the sequence? It should be able to signal PaC to start this messaging.

- Section 7.0 Security Considerations is not clear. Is MitM still a problem
  when we use TLS, or not?

alper

---

From: <[email-masked]>
Date: Wed, 6 Nov 2002 18:32:44 +0200

Alper, 

One in the end of this email.

> -----Original Message-----
> From: ext Alper E. YEGIN [mailto:[email-masked]]
> Sent: 05 November, 2002 22:29
> To: Forsberg Dan (NRC/Helsinki); Rajahalme Jarno (NRC/Helsinki)
> Cc: [email-masked]
> Subject: Re: SeNAA comments
> 
> 
> Hi Dan,
> 
> > Without TLS the signaling starts right away with CLR/CLA 
> messages. Thus,
> LSA and network authentication are lost if the EAP method 
> itself doesn't
> provide them (or the L2). The AVPs that are protected inside 
> the TLS-Payload
> are the same with or without the TLS, except the Msg-Checksum 
> AVP which is
> TLS mode specific only.
> >
> > The Session-Id is selected by the PAA and thus if CLR is 
> sent as the first
> message without TLS the Session-Id could be zero for example. 
> Also, the
> Authorization-Lifetime and Auth-Grace-Period AVPs in the CLA 
> message could
> be sent only once.
> >
> > TBD in next version.
> 
> OK.
> 
> >
> > PAA discovery happens through the access routers (or access 
> points), or
> should we say EPs. PaC sends the first message to the EP. PaC 
> gets the first
> answer from the PAA, because EP proxied the request to the 
> PAA. Signaling
> continues directly between PaC and PAA. In case of PAA initiated
> authentication the "first message" can be any data packet.
> >
> 
> OK, if we can include these details in the draft as well.
> 
> > The first EAP-Payload in the CLR contains Identity Response.
> 
> Which PaC hasn't received an ID request for... I don't know how this
> works with EAP state machine.
> 
> >
> > No. It can be used for certificate selection process in the 
> access network
> and AAA msg routing purposes. Material could be used with EAP 
> also, though.
> >
> 
> This would need clarification in the draft as well, as there 
> are two places
> to provide client id now.
> 
> > Access network can initiate the signaling with a
> Client-Auth-Request-Request (CARR) message that can be sent 
> from PAA or even
> from EP..
> >
> > TBD in next version.
> 
> OK.
> 
> >
> > MitM can be avoided if EAP method's credentials are 
> different without the
> TLS (or similar L2 protection) and with the TLS (or similar 
> L2 protection).
> >
> > But if the credentials are the same with or without SeNAA, 
> TLS mutual
> authentication is not used and the EAP method is used in 
> uprotected way,
> then this kind of MitM attack is possible and should be avoided.
> >
> 
> 
>    If an EAP method is used in an unsecure environment, TLS with SeNAA
>    doesn't provide adequate protection for the 
> man-in-the-middle attack
>    with that EAP method.
> 
> So, shouldn't we replace "doesn't" with "can" in the above section?

I see, that this section is be a bit misleading. What was meant is that if the EAP method is used in unsecure environment without PANA and then in some other environment with PANA again, then the MitM is possible. MitM is not possible if different credentials are used with PANA.

Better problem description and possible solutions can be found here:

 http://www.saunalahti.fi/~asokan/research/mitm.html

- Dan