Subject: [eap] concern on invalid MIC (fwd)

From: [email-masked] (Bernard Aboba)
Date: Mon, 3 Feb 2003 10:40:24 -0800 (PST)

This is an interesting corner case, Yoshi.

How do people feel this should be handled?

---------- Forwarded message ----------
Date: Mon, 3 Feb 2003 12:25:58 -0500
From: Yoshihiro Ohba <[email-masked]>
To: Bernard Aboba <[email-masked]>
Subject: concern on invalid MIC

Bernard,

I'm sorry for discussing this issue again, but I am still not sure
whether mandating silent discard of packets with invalid MIC is always
good.

For example, EAP-TLS and PEAP haves its own fragmentation mechanism
outside the TLS, in which each fragment is carried in a single EAP
Request/Response packet.  In this case, since TLS MIC validation
cannot be performed before reassembling the fragmented packets, so an
attacker Authenticator can send a fragment with broken MIC.  The
packet will be accepted by the Peer as long as it is valid except for
MIC, and EAP Requests sent by legitimate Authenticator after the
attacker's attempt may be treated just as a deplicate Request.
Finally, when all fragments are received by the Peer, the Peer
reassembles a TLS record and will find invalid in terms of MIC.

If this is a possible situation, how silently discarding the packet
with invalid MIC can improve robustness againt the DoS attack of
blindly injecting fragments?

Yoshihiro Ohba

---

From: [email-masked] (James Carlson)
Date: Mon, 3 Feb 2003 14:56:43 -0500

> How do people feel this should be handled?

It sounds like breakage in the EAP-TLS and PEAP fragmentation
mechanisms, rather than a problem with EAP itself.

> blindly injecting fragments?

If you're not doing a MIC per message, then it's hard for me to see
what the value of the thing called a "MIC" might be.

-- 
James Carlson, Solaris Networking         <[email-masked]>
Sun Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677