Subject: [eap] additional concern on invalid MIC

From: [email-masked] (Yoshihiro Ohba)
Date: Tue, 4 Feb 2003 20:50:45 -0500

I think the policy of silently discarding packets with invalid MIC
might not work as expected when a pass-through authenticator is used.

Since the pass-through authenticator is not able to perform integrity
check for EAP Response messages, when an attacker Peer sends an EAP
Response with invalid MIC, the authenticator will pass it to the
backend EAP server as long as it is valid except for MIC.  Once this
happens, an EAP Response message sent from the legitimate Peer will be
treated as duplicate Response and thus silently discarded at the
pass-through authenticator.

The policy of silently discarding packets with invalid MIC does not
seem to work anything good for this type of DoS attack, and this
problem seems to be common to all methods.  It seems that lower-layer
needs to be secure to EAP, or the EAP server might need to inform the
pass-through authenticator whenever it finds an EAP Response with
invalid MIC so that the authenticator can treat the already forwarded
EAP Response as "invalid".

Yoshihiro Ohba