Subject: [eap] Re: Proposed Resolution of Issue 74

From: [email-masked] ([email-masked])
Date: Thu, 6 Feb 2003 10:26:33 +0200

On 6 Feb 2003, Bernard Aboba wrote:

> Some EAP methods may define MICs that cover more than one EAP packet.
> Since the Identity Request/Response, Nak Response or Notification
> Request/Response messages are not authenticated, once an EAP method
> derives keys it may be desirable to exchange MICs that cover these
> unauthenticated packets, so as to be able to detect forgeries after
> the fact. Alternatively, an EAP method may define a MIC covering an
> extended PDU that could be split into multiple fragments.
>=20
> In these situations, failure of MIC validation is typically a fatal
> error, since it may not be possible to recover the original state and
> continue the exchange. It should be understood that this increases
> vulnerability to denial of service attacks."

Is this a a protocol issue or an implementation issue? It is=20
possible to imagine an implementation which would work much like a=20
"non-deterministic state machine" in this case. Consider an
example where an attacker and the legitimate peer both send EAP
packet with identifier N, and we can't yet validate the MIC (so
we can't know which is the correct one).=20

I guess that most implementations simply pick the packet which arrived=20
first, but an alternative would be to "fork" the state: if before
receiving either of the packes we were in state S0, and
receiving the packets would take us to states S1 and S2,
we could consider this a state set {S1,S2}. Then a conversation
would be successful if the final state set contains a successful
state.

I admit that I'm not really sure if such an implementation would
make sense, but then, you get these strange ideas when
you haven't had your morning coffee yet :-) And, of course,=20
storing all those states also takes up memory, which could
lead to a different kind of DoS attack.

Best regards,
Pasi