Jari Arkko, Henry Haverinen, Joseph Salowey (presented by Pasi Eronen) EAP SIM and AKA Jari Arkko, Henry Haverinen, Joseph Salowey (presented by Pasi Eronen) July 14, 2003 EAP WG, IETF 57

Introduction Authentication based on GSM SIM and UMTS USIM smart cards Neither the user’s terminal nor EAP server has direct access to the shared secret key We rely on GSM/UMTS key agreement protocols July 14, 2003 EAP WG, IETF 57

EAP SIM status Quite stable Some updates based on Sarvar Patel’s analysis: When multiple RANDs used, client checks that they are different Clarified security considerations section Aligned key derivation with 2284bis AT_CHECKCODE July 14, 2003 EAP WG, IETF 57

EAP AKA status Stable Aligned key derivation with 2284bis AT_CHECKCODE July 14, 2003 EAP WG, IETF 57

”N bits of security” 2284bis: “If the effective key strength is N bits, the best currently known methods to recover the key (with non-negligible probability) require an effort comparable to 2N operations of a typical block cipher.” Must not mix the probability of 2–64 and the work of 264 operations! Attacks with 264 work are interesting; attacks with success probability of 2–64 are not very interesting July 14, 2003 EAP WG, IETF 57

”N bits of security” EAP SIM key strength is ~64 bits with one triplet, and ~128 bits with 2 or 3 New text strongly recommends that both client and server require at least 2 triplets If the same SIM is used in GSM/GPRS, attacker can use their vulnerabilities No need to use SRES to increase key strength July 14, 2003 EAP WG, IETF 57

RAND re-use within one exchange Obviously, if multiple triplets are used, the server chooses different triplets The latest version also requires the client to check this July 14, 2003 EAP WG, IETF 57

RAND re-use in different exchanges EAP SIM requires that the server always uses fresh RANDs Client can’t check if RANDs are fresh (Keeping a list of all previously seen RANDs is not probably feasible) Well-known limitation of GSM; changed in UMTS (AKA) Discussed extensively in security considerations section July 14, 2003 EAP WG, IETF 57

Alternative protocols Main goals in current protocol Use existing SIM cards without changes >800,000,000 deployed When they are redeployed, will support EAP AKA Keys that allow impersonating as the user (for longer than the current session) are never handled outside SIM and AuC This would undermine integrity of charging Keys that allow impersonation as the network are handled in user terminal and EAP server July 14, 2003 EAP WG, IETF 57

Next steps Wait until 2284bis is finished Get reviews and publish as informational RFCs July 14, 2003 EAP WG, IETF 57