Re: [IPsec] Start of WG Last Call on draft-ietf-ipsecme-eap-mutual (EAP-Only Authentication)

[Yaron Sheffer <[e-mail]>]

Hi Yoav,

please see some comments below.

Thanks,
	Yaron

On 05/03/2010 01:00 PM, Yoav Nir wrote:
> Can't compete with Martin's "running code", but I have a few comments. Before that, the draft seems good, and easy to follow. I think developers who have never heard of the IPsec list should have no problem reading and implementing this correctly. Having said that, here's two comments.
>
> The introduction says this:
>     In some environments, requiring the deployment of PKI for just this
>     purpose can be counterproductive.  Deploying new infrastructure can
>     be expensive, and it may weaken security by creating new
>     vulnerabilities.  Mutually authenticating EAP methods alone can
>     provide a sufficient level of security in many circumstances, and
>     indeed, IEEE 802.11i uses EAP without any PKI for authenticating the
>     WLAN access points.
>
> The way this is phrased, it sounds like you need to deploy a full PKI for the gateway to show a certificate. Web servers do HTTPS without all this. They use either a relatively cheap commercial certificate or a self-signed certificate. The question is what value is there in the client verifying the certificate. With a self-signed certificate (or a corporate certificate) it's really a one-time leap of faith ("do you approve the fingerprint...") like with SSH servers. To do any better, you would need a full PKI with all computers pre-installed with the root trust anchor (or using TAMP). And if you have all that in place, you might as well issue certificates to users and skip EAP altogether.  So I would rephrase it as:
>
>     In order for the public key signature authentication of the gateway to be
>     effective, a deployment of PKI is required, which has to include
>     management of trust anchors on all supplicants. In many environments,
>     this is not realistic, and the security of the gateway public key is
>     the same as the security of a self-signed certificate. Mutually
>     authenticating EAP methods alone can...
>
I'm OK with this new text, but even if enterprise deployment of limited 
PKI is easy in theory, we know that in practice, many people eventually 
disable validation of server certs in the context of EAP (top of this 
screen shot: 
http://www.wegotserved.com/wp-content/uploads/2008/03/settings1.jpg).

>
>
> Nowhere in the document does it say, why the EAP method needs to be key-generating. In fact, RFC 4306 says that it is recommended, but goes on to say what to do if the method is not key-generating. This document should make it clear why omitting the server-side signature changes things such that key generation has become crucial. The only thing I could find was section 6.1, which says:
>     It is important to note that the IKEv2 SA is not authenticated by
>     just running an EAP conversation: the crucial step is the AUTH
>     payload based on the EAP-generated key.  Thus, EAP methods that do
>     not provide mutual authentication or establish a shared secret key
>     MUST NOT be used with the modifications presented in this document.
> Why is it crucial?
>
This is a very good question: the AUTH payloads very indirectly bind the 
IKE shared secret with the actual EAP payloads. So the generated key may 
not be so crucial after all. But AFAIK, all modern EAP methods are key 
generating, so the question is interesting but theoretical.

Also, for people that care about channel binding between IKE and the EAP 
method, the shared EAP key is used to enable the IKE peer to prove that 
it is either the EAP terminator, or at least trusted by it. So in this 
scenario the generated key is essential.
>
> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of Paul Hoffman
> Sent: Monday, May 03, 2010 5:14 AM
> To: IPsecme WG
> Subject: Re: [IPsec] Start of WG Last Call on draft-ietf-ipsecme-eap-mutual (EAP-Only Authentication)
>
> At 2:39 PM -0700 4/21/10, Paul Hoffman wrote:
>> Greetings again. We have kicked around draft-ietf-ipsecme-eap-mutual and its predecessor for a long time, and it seems like there have been few substantial comments lately.
>>
>> Thus, this starts the two-week WG Last Call on "An Extension for EAP-Only Authentication in IKEv2",<http://tools.ietf.org/html/draft-ietf-ipsecme-eap-mutual-01>. Please send any comments on the document to the mailing list. Support, criticism, and suggestions for additions or changes are all appropriate. At a minimum, I would like to see a handful of people say "I have read the draft".
>
> Zero comments so far. Without more input from the WG, we might want to just kill this draft, which would be quite sad.
>
> --Paul Hoffman, Director
> --VPN Consortium
> _______________________________________________
> IPsec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ipsec
>
> Scanned by Check Point Total Security Gateway.
> _______________________________________________
> IPsec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ipsec