Subject: [eap] draft-haverinen-pppext-eap-sim-05

From: [email-masked] (Max DE-GROOT)
Date: Fri, 13 Sep 2002 18:05:03 +0200

--202745770-25793-1031933103=:1836
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Content-Language: fr-FRA

Dear Henry

I have some remarks to draft 5 of EAP/SIM.

The principle issues I have with the contents are:

-The previous versions used MAC-RAND to authenticate the network, MAC was used as an integrity check on the whole EAP packet. In this version (and I believe from V4 on) MAC-RAND has been suppressed and now MAC is used to authenticate the network and to verify integrity.
I can imagine that from a development point of view, things are made easier like this, but from a security point of view, it cannot be accepted. 
Furthermore, the calculation of MAC-RAND was quit similar to MAC-SRES, which allowed for a balanced mutual authentication, which is not the case when MAC is used.

-There is a risk that an attacker spoofs a network if he can obtain valid triplets. This is possible when an attacker has physical access to a SIM, like stated in the document, but also when an attacker has logical access to a SIM through an unprotected client (windows based PC connected to the internet for example). Therefore, access to GSM functions like RUN GSM ALGORITHM (returning the triplets) should be avoided when a SIM is inserted in a client. This can be made possible if new specific EAP commands are developed, allowing authentication with an HLR/AUC based on the existing Ki and IMSI, but protecting the sensible triplets by executing most of the authentication calculations internally. 

I reflected these major and some other corrections and comments in the attached document.

Best Regards

Max de Groot
Technical Marketing
GEMPLUS Card International
Tel: +33442365036 GSM: +33607479373 Fax: +33442364100

--202745770-25793-1031933103=:1836
Content-Type: APPLICATION/msword
Content-Transfer-Encoding: BASE64
Content-Description: draft-haverinen-pppext-eap-gsmsim-06 gemplus revisions.doc
Content-Language: fr-FRA
Content-Disposition: attachment; filename="draft-haverinen-pppext-eap-gsmsim-06 gemplus revisions.doc"

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAAE
AAAAqAEAAAAAAAAAEAAAqgEAAAEAAAD+////AAAAAKQBAAClAQAApgEAAKcB
AAD/////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
AAAA

--202745770-25793-1031933103=:1836--

---

From: [email-masked] (Joseph Salowey)
Date: Fri, 13 Sep 2002 10:03:43 -0700

Hi Max,

I'm trying to understand why using AT-MAC to authenticate the RANDS and the 
rest of the EAP message is unacceptable from a security point-of-view.  Can 
you please elaborate on this?

Thanks,

Joe

At 06:05 PM 9/13/2002 +0200, Max DE-GROOT wrote:
>-The previous versions used MAC-RAND to authenticate the network, MAC was 
>used as an integrity check on the whole EAP packet. In this version (and I 
>believe from V4 on) MAC-RAND has been suppressed and now MAC is used to 
>authenticate the network and to verify integrity.
>I can imagine that from a development point of view, things are made 
>easier like this, but from a security point of view, it cannot be accepted.
>Furthermore, the calculation of MAC-RAND was quit similar to MAC-SRES, 
>which allowed for a balanced mutual authentication, which is not the case 
>when MAC is used.
>
>-There is a risk that an attacker spoofs a network if he can obtain valid 
>triplets. This is possible when an attacker has physical access to a SIM, 
>like stated in the document, but also when an attacker has logical access 
>to a SIM through an unprotected client (windows based PC connected to the 
>internet for example). Therefore, access to GSM functions like RUN GSM 
>ALGORITHM (returning the triplets) should be avoided when a SIM is 
>inserted in a client. This can be made possible if new specific EAP 
>commands are developed, allowing authentication with an HLR/AUC based on 
>the existing Ki and IMSI, but protecting the sensible triplets by 
>executing most of the authentication calculations internally.
>
>Content-Disposition: attachment; 
>filename="draft-haverinen-pppext-eap-gsmsim-06 gemplus revisions.doc"