Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

[Shumon Huque <[e-mail]>]

On Sat, Aug 20, 2005 at 11:42:46AM -0400, Charles Clancy wrote:
> Shumon Huque wrote:
> 
> >Regarding dictionary attack, is it the case that we won't standardize 
> >an EAP method that is vulnerable to it? Or is the objection motivated
> >by the fact that EAP is expected to be commonly used for wireless
> >LAN authentication? I hope it isn't the latter, because it is almost
> >as easy to eavesdrop on wired ethernets with ARP spoofing for example.
> 
> EAP methods vulnerable to dictionary attacks cannot be used with WLAN. 
> See RFC 4017.  I don't think people are against standardizing a kerberos 
> method, as long as people know it should be run in a tunnel -- much like 
> EAP-MSCHAPv2.

I've read RFC 4017. My discomfort comes from the observation that
it is at best incomplete to point this out only for wireless LANs, 
since many of these vulnerabilities are applicable to other link 
layers too. If I use an EAP method that supports Kerberos on a 
wired ethernet for example, the dictionary attack threat still
exists. I do not find the differential magnitude of the threat a 
very convincing argument. It makes more sense to design security 
mechanisms with the uniform assumption that the network is always 
hostile.

This puts us in a position of having to say (whether we're using
EAP or not): "use Kerberos normally, except when running over 
link layers X, Y and Z, in which case you should run it only in 
a protected, cryptographically bound tunnel". If we need to address 
the dictionary attack problem, I think we should discuss how to 
do so in the Kerberos protocol directly. Perhaps that discussion 
belongs in another group though ..

I'm also not a fan of automatically assuming that a tunnel is the 
right solution for many problems. If we are tunnelling in TLS for 
example, I now have additional issues to deal with. Such as how to 
query up-to-date certificate revocation status, and whether my 
users are properly validating the certificates etc.

---
Shumon Huque				3401 Walnut Street, Suite 221A,
Network Engineering			Philadelphia, PA 19104-6228, USA.
Information Systems & Computing		[phone], [phone] (Fax)
University of Pennsylvania / MAGPI.	E-mail: shuque -at- isc.upenn.edu

_______________________________________________
SECMECH mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/secmech