Subject: [eap] Question regarding draft-puthenkulam-eap-binding-01

From: [email-masked] (Joe Salowey)
Date: Fri, 28 Feb 2003 10:12:22 -0800

It is also not always necessary for the method to be the same inside and
outside the tunnel to expose this vulnerability(although this makes
things easier).  If the same credentials are used in different protocols
inside and outside the tunnel you may still be vulnerable (of course
using the same credentials in two different mechanism may create other
vulnerabilities as well.)

Joe

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]=20
> Sent: Friday, February 28, 2003 2:47 AM
> To: [email-masked]; [email-masked]
> Subject: RE: [eap] Question regarding draft-puthenkulam-eap-binding-01
>=20
>=20
> Wei,
>=20
> It's not question about the credentials used with the tunnel=20
> creation and the authentication method, but that the method=20
> can be used without the tunnel. For example you use the same=20
> EAP-MD5 credentials with or without the tunnel.
>=20
> - Dan
>=20
> > -----Original Message-----
> > From: ext Wei Wang [mailto:[email-masked]]
> > Sent: 28 February, 2003 10:41
> > To: EAP WG
> > Subject: [eap] Question regarding draft-puthenkulam-eap-binding-01
> >=20
> >=20
> > Greetings,
> >=20
> > In describing a "man-in-the-middle" attack against TLS=20
> protected EAP=20
> > authentication, the referred document stated that, "For=20
> this attack to=20
> > be successful, it is necessary for the tunneled=20
> authentication methods=20
> > to also be enabled for use outside the tunnel, and for the same=20
> > credentials to be used for authentication inside and outside the=20
> > tunnel."
> >=20
> > It seems that it is not necessary for the same credentials=20
> to be used=20
> > both inside and outside the tunnel. At least the EAP-TTLS=20
> method has=20
> > this "anonymity and privacy" feature, in which case, the user id=20
> > inside the tunnel does not (or actually,  should
> > not) be the same as the one outside the tunnel.
> >=20
> > Regards,
> > --=20
> > Wei Wang                  mailto:[email-masked]
> > Interlink Networks, Inc.  http://www.interlinknetworks.com
> >=20
> >=20
> > _______________________________________________
> > eap mailing list
> > [email-masked] http://mail.frascone.com/mailman/listinfo/eap
> >=20
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>=20