Subject: [eap] Proposed Resolution of Issue 145: Terminology: MITM Resistance

From: [email-masked] (Bernard Aboba)
Date: Tue, 8 Jul 2003 21:51:51 -0700 (PDT)

The text of Issue 145 is included below. The proposed fix is to delete the
current definition of MITM and utilize the term "Cryptographic binding"
instead. This is proposed in Issue 156, so that if this is acceptable,
then Issue 145can be resolved as a duplicate of Issue 156 (Reject).

--------------------------------------------------------------------------
Issue 145: Terminology: Man-in-the-Middle Resistance
Submitter name: Henrik Levkowetz
Submitter email address: [email-masked]
Date first submitted: June 18, 2003
Reference:
Document: EAP-04
Comment type: T
Priority: S
Section: Terminology and throughout
Rationale/Explanation of issue:

"Man-in-the-Middle resistance".

I don't really feel comfortable with the use of this term. From what I
know, Man-in-the-middle attacks have a well established existing
meaning, while here we are defining something related which applies only
to sequences or tunnelled methods. If a reader skips lightly over the
definitions, and doesn't catch the limited meaning of this term, the
classification of MitM resistance: N/A for the basic authentication
methods will not make sense, or in the worst case be misleading.

If I understand the issues correctly, all the basic authentication
methods (MD5, OTP, GTC) *are* vulnerable to classic MitM attacks -
but our MitM resistance term describes something else, and I'd
therefore prefer to call it something else.
[Jari Arkko]
I agree. MITM is too general term.

"Compound authentication Man-in-the-Middle attack resistance"?

Shorter name would be useful.

---

From: [email-masked] (Henrik Levkowetz)
Date: Wed, 9 Jul 2003 09:39:39 +0200

> then Issue 145can be resolved as a duplicate of Issue 156 (Reject).

The resolution to 145 proposed in 156 looks good to me, I'm for it.

	Henrik

> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>