Where EAP security claims fail

Abstract

The Extensible Authentication Protocol (EAP) is widely used as an authentication framework to control the access to wireless networks, e.g. in IEEE 802.11 and IEEE 802.16 networks. In this paper, we discuss limitations of EAP security and demonstrate how these limitations can be exploited to launch attacks on existing EAP methods. In particular, we present a series of attacks which cause some standard security claims, namely channel binding, protected ciphersuite negotiation and cryptobinding, to fail and compromise the key exchange, authentication and privacy of EAP communications. Next, we identify the special security challenges of EAP systems that may cause the considered security claims to fail. EAP differs from other authentication frameworks as a two party protocol, like IKE and TLS, because it is conducted with three parties involved across two communication links with different media. Another security challenge of EAP is the negotiability of EAP methods, ciphersuites, and protocol versions. These challenges make it difficult to derive a trust model for EAP and to securely adopt existing protocols. Finally, we conclude with recommendations for more secure EAP implementations. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. not provide any physical protection. Without implementing any layer of security, adversaries can eavesdrop on wireless communications and unauthorized users can easily access the network. To prevent these and other attacks, wireless networks need to provide an access control mechanism that enables authentication of all wireless users who wish to access the network. The authentication needs to be mutual to prevent an adversary from masquerading as a wireless access point. Furthermore, a key management scheme is needed to establish keys that can be used to secure all communications over the wireless channel. Categories and Subject DescriptorsCurrently, the Extensible Authentication Protocol (EAP), defined in IETF RFC 3748 [13], has been adopted by a few wireless standards as an access authentication and key establishment protocol. For example, IEEE 802.11i [6] makes use of IEEE 802.1X [8], which relies on EAP for authentication. EAP is also an authentication option in IEEE 802.16e [9]. EAP is an authentication framework that defines message formats and flows to support different authentication methods, referred to as EAP methods in the remainder of this paper. There are currently more than 40 EAP methods, e.g. EAP-TLS [16], EAP-TTLS [4], and EAP-GPSK [3]. EAP was originally designed for the use with the Point-to-Point Protocol (PPP). However, today EAP is widely used to control access to wireless networks and we limit our d...

Channel-Binding Support for Extensible Authentication Protocol (EAP) Methods

“…Checking the consistency of i1 and i2 is nontrivial, as has been pointed out already in [HC07]. First, i1 can contain any type of information propagated by the authenticator, whereas i2 is restricted to information that can be carried in AAA attributes.…”

CPAL: A Conditional Privacy-Preserving Authentication With Access Linkability for Roaming Service

“…However, they require the interaction between the foreign server and the home server, which may lead to the single point of failure [34], and induce large authentication transmission overhead because of the long distance between the foreign server and the home server. Moreover, recent studies [35], [36] have shown that SC-based schemes cannot provide strong user anonymity and non-traceability, and most of them cannot provide session key security and resistance to sophisticated attacks. Another weakness is that, they cannot flexibly be applied to all application scenarios because each protocol is only suitable for the corresponding network architecture, this may increase the complexity of the entire system.…”

An inconvenient truth about tunneled authentications

“…MitM attacks on tunneled authentications and authentications in anonymous tunnels have been identified in [3] and [8], respectively. For the sake of simplicity, we review the attacks for scenarios in which tunnel server and inner authentication server are the same entity.…”

“…As an alternative to cryptographic bindings, the authors in [3] suggest enforcing a policy that prevents authentication methods that are tunneled from being executed outside a protective tunnel. Similarly, the authors in [8] propose a number of security policies, including to prohibit anonymous tunnels, to thwart the reviewed attacks.…”

“…In our analysis we consider not only the MitM attacks proposed in [3] and [8], but also a new extended MitM attack that is a modified combination of both attacks. While the original attack relies on the fact that clients may execute inner methods outside a protective tunnel, the extended attack exploits that clients may accept the establishment of anonymous tunnels.…”