Subject: [eap] Issue 25: Spoofing and duplicate detection

From: [email-masked] (Bernard Aboba)
Date: Tue, 7 May 2002 18:06:01 -0700 (PDT)

Issue 25: Spoofing and duplicate detection
Submitter: Jesse Walker
Submitter email address: [email-masked]
Date first submitted: May 3, 2002
Reference: 
Document: RFC2869bis-04
Comment type: T
Priority: S
Section: 9.3
Rationale/Explanation of issue:
Section 9.3 page 23, point 1 says:

Silent discard. Since only a single EAP Request can be in progress
between an Authenticator and a Peer at a given time, if a Peer
receives a new Request before sending a Response, the new Request
can be silently discarded. This increases resilience against
spoofed Requests. Similarly, an Authenticator can silently discard
Responses with Identifiers that do not correspond to the Identifier
included in the last Request, or that represent duplicate
Responses.

This advice seems effective only if both the Authenticator and the Peer
respond significantly more rapidly than does the active attacker, or their
responses are delivered more expeditiously than the attacker's, i.e., you
can't depend on it. The Success and Negotiate messages in particular
require their own protection. I suggest noting this method does not work
except in very constrained environments because of the race conditions
cited.