An inconvenient truth about tunneled authentications

Abstract

In recent years, it has been a common practice to execute client authentications for network access inside a protective tunnel. Man-in-the-middle (MitM) attacks on such tunneled authentications have been discovered early on and cryptographic bindings are widely adopted to mitigate these attacks. In this paper, we shake the false sense of security given by these so-called protective tunnels by demonstrating that most tunneled authentications are still susceptible to MitM attacks despite the use of cryptographic bindings and other proposed countermeasures. Our results affect widely deployed protocols, such as EAP-FAST and PEAP.

A forward secure PKI-based UMTS-AKA with tunneling authentication

“…-As mentioned in [8] most tunneled authentication schemes are susceptible to Man-In-The-Middle attacks. In the proposed protocol we solved this problem simply by using two innovative methods we used in this protocol.…”