Subject: [Emu] Open Issues with EAP-GPSK

From: "Tschofenig, Hannes (NSN - DE/Germany - MiniMD)" <[email-masked]>
Date: Thu, 20 Sep 2007 10:51:00 +0200

attack) and limited number of associated servers, this fixes the attack.

Initially, I was a bit curious about the need to allocate state on the
client side with an injected Message 1 by the adversary. The text in
Section 4.2 of [1] was, however, convincing that the end host needs to
keep state information of multiple sessions even if it only accepts a
single one since otherwise you would be able to put the client into a
blocking state. [1] focuses on a case where only a single nonce is used
in message 3 whereas in EAP-GPSK both nonces are present in message 3.
When the client receives message (3) then it needs to derive keying
material based on the following info: RAND_Peer, ID_Peer, RAND_Server,
ID_Server, RAND_Peer, RAND_Server is in message 3 provided by the server
and ID_Peer is known to the peer. The EAP peer may have multiple
identities too. Hence, in EAP-GPSK at least the ID_Server attribute is
missing in message 3. Now, the question is how many EAP server
identities a client has. I suspect only a single one, with the realm
name for the entire domain (with respect to a particular credential) and
how many identities the client uses. 

In any case, I agree with the assessment and the need to document
something in the draft.

Do you agree that the problem is real?
If yes, what type of solution approach would the group prefer?

Ciao
Hannes

Reference:

[1] Changhua He, John C. Mitchell. Analysis of the 802.11i 4-Way
Handshake. In Proceedings of the Third ACM International Workshop on
Wireless Security (WiSe'04), pages 43-50. Philadelphia, PA, Oct. 2004

_______________________________________________
Emu mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/emu

---

From: "Joseph Salowey \(jsalowey\)" <[email-masked]>
Date: Thu, 20 Sep 2007 09:32:09 -0700

I added these issues to the issue list at
http://www3.tools.ietf.org/wg/emu/trac/report/1

Joe 

> -----Original Message-----
> From: Tschofenig,Hannes (NSN - DE/Germany - MiniMD) 
> [mailto:[email-masked]] 
> Sent: Thursday, September 20, 2007 1:51 AM
> To: [email-masked]
> Subject: [Emu] Open Issues with EAP-GPSK
> 
> 
> Hi all, 
>  
> Paul Rowe, Arnab Roy, Prof. Andre Scedrov and Prof. John C. 
> Mitchell did an analysis of EAP-GPSK and they essentially 
> found three issues:
> 
> 1) Use of encryption algorithms before choice is confirmed
> 
> This aspect can be covered in the security consideration 
> section of the upcoming draft version of EAP-GPSK:
> http://www.tschofenig.com/svn/draft-clancy-emu-eap-gpsk/draft-
> ietf-emu-e
> ap-gpsk-07.txt
> 
> 2) Mitigation of potential DOS attack against client 
> 
> This aspect is a bit more controversial and we would require 
> feedback from the group. I will post a separate mail on this subject. 
> 
> 3) Potential problem with the key derivation function
> 
> This aspect also requires feedback from the group and a 
> separate mail will be posted to the list. 
> 
> Ciao
> Hannes
> 
> PS: Thanks to the group for doing the analysis and for 
> discussing the issues with us. 
> 
>