Re: [Emu] Working Group Last Call for draft-ietf-emu-chbind-04.txt (part 3)‏

"Hoeper Katrin-QWKN37" <khoeper@motorola.com> Tue, 02 March 2010 17:12 UTC

Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01CABA2B.7F9F7D01"
Date: Tue, 02 Mar 2010 12:12:12 -0500
Message-ID: <3A241A6B234BE948B8B474D261FEBC2F07239E91@de01exm68.ds.mot.com>
In-Reply-To: <BLU137-W224800D5E4F025B20DA32A938F0@phx.gbl>
Thread-Topic: [Emu] Working Group Last Call for draft-ietf-emu-chbind-04.txt (part 3)‏
Thread-Index: Acp30Fal0U342+rxThqm/T2sK0lgfxCWcGww
References: <BLU137-W224800D5E4F025B20DA32A938F0@phx.gbl>
From: Hoeper Katrin-QWKN37 <khoeper@motorola.com>
To: Bernard Aboba <bernard_aboba@hotmail.com>, emu@ietf.org
Subject: Re: [Emu] Working Group Last Call for draft-ietf-emu-chbind-04.txt (part 3)‏
Precedence: list

Bernard, All,

 

Comments inline.

 

________________________________

From: emu-bounces@ietf.org [mailto:emu-bounces@ietf.org] On Behalf Of Bernard Aboba
Sent: Tuesday, December 08, 2009 12:33 AM
To: emu@ietf.org
Subject: Re: [Emu] Working Group Last Call for draft-ietf-emu-chbind-04.txt (part 3)‏

 

Section 9.2



   Additional network entities (such as proxies) might be on the

   communication path between peer and server and may attempt to

   manipulate the channel binding protocol.  If these entities do not

   possess the keying material used for integrity protection of the

   channel binding messages, the same threat analysis applies as for the

   dishonest authenticators.  Hence, such entities can neither

   manipulate single channel binding messages nor the outcome.  On the

   other hand, entities with access to the keying material must be

   treated like a server in a threat analysis.  Hence such entities are

   able to manipulate the channel binding protocol without being

   detected.  However, the required knowledge of keying material is

   unlikely since channel binding is executed before the EAP method is

   completed, and thus before keying material is typically transported

   to other entities.



[BA]
Unless the transient EAP keys used for integrity protection are derivable from the 

MSK, possession of the MSK would not be sufficient to enable an authenticator to modify 

the channel bindings.  As a result, the only entities relevant to the threat analysis 

are those that possess the TEKs, not just those that possess the MSK or other derived keys.  
[KH] I assume you have a problem with the last sentence that suggests that integrity protected keys are derived from the MSK. The rest of the paragraph talks very generally about “keying material used for integrity-protection”. For this reason I suggest changing the last sentence to “However, the required knowledge of keying material is unlikely even if the keys are derived from the MSK because channel binding is executed before the EAP method is  completed, and thus before the MSK is transported to other entities.”






 

<http://im.live.com/Messenger/IM/Home/?source=EML_WLHM_GreaterGood>

Re: [Emu] Working Group Last Call for draft-ietf-… Bernard Aboba
Re: [Emu] Working Group Last Call for draft-ietf-… Hoeper Katrin-QWKN37