Subject: [eap] WG last call issue: EAP-04 Terminology: Man-in-the-Middle resistance

From: [email-masked] (Henrik Levkowetz)
Date: Tue, 17 Jun 2003 21:32:26 +0200

Submitter name: Henrik Levkowetz
Submitter email address: [email-masked]
Date first submitted: June 17, 2003
Document: EAP-04
Comment type: T
Priority: S
Section: Terminology and throughout
Rationale/Explanation of issue:

"Man-in-the-Middle resistance".

I don't really feel comfortable with the use of this term. From what I
know, Man-in-the-middle attacks have a well established existing
meaning, while here we are defining something related which applies only
to sequences or tunnelled methods. If a reader skips lightly over the
definitions, and doesn't catch the limited meaning of this term, the
classification of MitM resistance: N/A for the basic authentication
methods will not make sense, or in the worst case be misleading.

If I understand the issues correctly, all the basic authentication
methods (MD5, OTP, GTC) *are* vulnerable to classic MitM attacks -
but our MitM resistance term describes something else, and I'd
therefore prefer to call it something else.

---

From: [email-masked] (Jari Arkko)
Date: Wed, 18 Jun 2003 22:54:25 +0300

> therefore prefer to call it something else.

I agree. MITM is too general term.

"Compound authentication Man-in-the-Middle attack resistance"?

Shorter name would be useful...

--Jari

---

From: [email-masked] (Henrik Levkowetz)
Date: Thu, 19 Jun 2003 11:50:56 +0200

On Wed, 18 Jun 2003 22:54:25 +0300

> Shorter name would be useful...

Slightly shorter:

Compound method MitM resistance ?

	Henrik

-- 
  Experience is something you don't get until just after you need it.

---

From: [email-masked] (Jari Arkko)
Date: Thu, 19 Jun 2003 14:38:20 +0300

> Compound method MitM resistance ?

Good enough. For for it. But maybe s/method/authentication/.

--Jari