Subject: RE2: Do ipsec vendors care about privacy?

From: Gregory Lebovitz <[email-masked]>
Date: Thu, 20 Mar 2003 00:12:36 -0800

Just had a thinking session with Bill Sommerfeld on this...

My question, at least from both our perspectives, was valid; neither of us
could think of a way to know if Bob should send EAP-Challenge in msg 4 w/o
first having seen IDi, GIVEN -05's CURRENT TEXT ABOUT HOW EAP WORKS. 

However, we could move IDi to message 5 IF WE CHANGE HOW EAP WORKS. If a Bob
who supports EAP in at least one of his SPDs ALWAYS sends EAP-Challenge in
msg 4 for any connection, then we would need to add text as follows:
 - If Bob has any SPDs calling for EAP, he must ALWAYS send EAP-Challenge in
msg 4,
 - It then becomes up to Alice's responsibility (based on SPD) to respond to
the EAP-Challenge, but only if her SPD calls for it,
 - Bob cannot determine until receiving IDi in Msg 5 if he actually
(according to HIS SPD) requires EAP. 
 - Bob will process or drop depending upon local SPD for IDi

But, all this is moot if we decide that IDr is more important to protect
than IDi, as I think we did earlier in list history. The justification being
that attacker can mount an active attack simply by initiating, and learn
IDr. 

Gregory (with bar-input from Bill S. and Derek A.) 

-----Original Message-----
From: Gregory Lebovitz
To: 'Hugo Krawczyk '; 'Russ Housley '
Cc: 'IPsec WG '
Sent: 3/19/03 10:58 PM
Subject: RE: Do ipsec vendors care about privacy?

First, yes, we do care.

> The only question is operational: can the responder (server) send the
> first EAP message before getting IDi? If this is the case (as it was
in
> PIC and seems tobe agreed in some responses to my message) then we are
> done at no cost at all (solution 1). If not, we may need to go to 
> solution 2 (in which the responder authenticates in message 2). Here
the
> main operational issue, pointed out by Antonio, is that you need to
have
> a
> way for the initiator to signal that he is requiring legacy
> authentication.
>Hugo

I think I may be missing something, and would appreciate some
clarification. Operationally, how can Bob know that he needs to send
AUTH if he does not receive IDi from Alice, from which to do an SPD
lookup, to know that AUTH is required for this particular connection?
Bob will likely be a device doing both EAP'd IKE connections, and
non-EAP IKE connections. Doesn't he need IDi to know when AUTH is to be
used?

Gregory
NetScreen

---

From: Hugo Krawczyk <[email-masked]>
Date: Thu, 20 Mar 2003 23:31:53 +0200 (IST)

Gregory,

Your previous email seemed to be talking about what I described as
solution (2), namely the responder auhenticates in message 2 rather than
in msg 4. In that case the issue of how R knows that he needs to respond
with authentication in message 2 (rather than the regular IKE behaviour)
is a valid question. The only solution I can see for that is to add an
indication from the Initiator in message 1 (either an additional field in
the message or some other trick such a convention about the value of SPI
chosen by I).

The email below, however, seems to be talking about solution (1) in
which the only difference with the current mechanism for EAP support in
ikev2-05 (sec 2.16) is moving IDi from msg 3 to msg 5.
In this case there is no problem for R to know that the initiator intends
to do a EAP-authentication. As explained in page 27 of draft-05:  
 "An initiator indicates a desire to use extended authentication by
   leaving out the AUTH payload from message 3."
Same will hold with the modified solution.

The question is: DOES THE RESPONDER (GATEWAY) NEED TO KNOW the value IDi 
IN ORDER TO DETERMINE THE CONTENTS OF THE EAP PAYLOAD SENT IN MESSAGE 4?

If the answer is NO (as assumed in the PIC protocol developed under the ipsra
WG) then solution (1) provides user's privacy at no extra cost and we should 
certainly go with it for IKEv2.
If the answer is that R CANNOT know how to generate the EAP payload if it does
not know IDi then we can forget of solution (1).  
If the answer is: most usually R does NOT NEED to know IDi 
(but in some special case it may need it) then I'd still go with solution (1). 
In my view, user's privacy in the remote access scenario is more important than
covering some unusual cases.  

IF for some reason solution (1) is deemed inappropriate then solution (2)
should be chosen but then the real question is what indication can the
initiator provide to the responder for the latter to know that it needs to
authenticate (send IDr and AUTH)  in message 2. Note that in this solution
the responder sends the EAP payload in message 4 AFTER having learned IDi
in message 3, so the above problem with solution (1) does not exisit here.

Hugo

---

From: Antonio Forzieri <[email-masked]>
Date: Fri, 21 Mar 2003 11:52:55 +0100

Hugo Krawczyk wrote:
[SNIP]

 > The question is: DOES THE RESPONDER (GATEWAY) NEED TO KNOW the value 
IDi IN ORDER TO DETERMINE THE CONTENTS OF THE EAP PAYLOAD SENT IN MESSAGE 4?

I think that only EAP people can give use the right response. I've just 
sent an e-mail to the eap WG asking about this problem, I hope they will 
give us feed-back as soon as possible.
In line a brief of the mail I sent to eap wg 2 minutes ago :

 >>Does the autheticator need to know the peer's identity before sending 
 >>an EAP(Request,MD5)? Or we can send that EAP message without knowing 
 >>the initiator identity? Is it possible a scenario like this?
 >>
 >>        Peer                             Authenticator
 >>       ------                           ---------------
 >>                              <--       EAP(Request,MD5)
 >>
 >>       IDi, EAP(Response,MD5) -->
 >>
 >>                              <--    EAP(Success/Failure)
[SNIP]

-- 
------------------------------------------------
Antonio Forzieri
CEFRIEL - Politecnico di Milano
Tesista Area E-Service Tecnologies
Tel: 02-23954.334 - email: [email-masked]
ICQ# 177683894
------------------------------------------------

---

From: Antonio Forzieri <[email-masked]>
Date: Fri, 21 Mar 2003 12:01:14 +0100

[SNIP]
I've just received feed-back from an EAP people:

[COPY&PASTE BEGIN]
For MD5-challenge, it's possible if the identity is passed together with 
the response/md5 (inside the encapsulating RADIUS message for instance) 
or is determined from the response-message itself (source-ip-address, 
caller-id, whatever, ...). Or if you would use always the same identity 
somehow.

All that the MD5-response proves, is that the peer is in possesion of 
the correct secret for that identity (user-password for instance), so 
you can calculate the correct response. The Authenticator would have to 
check that, and needs an identity, but it doesn't matter when it's 
passed to the authenticator.

Other authentication-mehtods might be different though.

--
Jo Hermans
[COPY&PASTE END]

With CHAP (Or MD5-CHALLENGE) Hugo's proposal will work, however with OTP 
and maybe with GTC I think that the responder needs to know the 
Iniziator ID prior to send the OTP challenge.

---

From: Tero Kivinen <[email-masked]>
Date: Sat, 22 Mar 2003 02:46:44 +0800

> IN ORDER TO DETERMINE THE CONTENTS OF THE EAP PAYLOAD SENT IN MESSAGE 4?

If the responder cannot even do the policy lookup based on the
identity? If have correctly understood the EAP, then it can support
multiple authentication methods, i.e for example say that user
"kivinen" the authentication method used is one-time password and for
the user "hugo" the authentication method used is the generic token
card.

Now when the responder only knows that it is someone connecting who
want to do EAP, how does he know which of those EAP authentication
types it should start?

Note, that in EAP there is also way to transport the identity inside
EAP packet, and in that case we do no need the external identity. In
the IKEv2 the EAP specification is trying to get rid of that exchange,
because it adds one more round trip and because we already have the
identity of the initiator (in the IDi payload). 
-- 
[email-masked]
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/

---

From: "Yoav Nir" <[email-masked]>
Date: Sun, 23 Mar 2003 10:10:53 +0200

With GTC, the challenge is a string like "Enter your password" and the
response is also a string.  I think this is more useful than the other
methods for passing user/password from the client to the gateway.
With MD5-Challenge, the authenticator needs to issue the challenge.  You may
have some problems integrating it with various authentication servers.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Antonio Forzieri
Sent: Friday, March 21, 2003 1:01 PM
To: ''IPsec WG ' '
Subject: Re: RE2: Do ipsec vendors care about privacy?

[SNIP]