1 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) The Insecurity of Tunnelled Authentication Protocols N. ASOKAN, VALTTERI NIEMI,

Slides:

Advertisements

Similar presentations

Authentication.

Advertisements

Internet Protocol Security (IP Sec)

Key distribution and certification In the case of public key encryption model the authenticity of the public key of each partner in the communication must.

Unlicensed Mobile Access (UMA) Dasun Weerasinghe School of Engineering and Mathematical Sciences City University London.

External User Security Model (EUSM) for SNMPv3 draft-kaushik-snmp-external-usm-00.txt November, 2004.

URP Usage Scenarios for NAS Yoshihiro Ohba August 2001 Toshiba America Research, Inc.

Unifying the conceptual levels of network security through use of patterns Ph.D Dissertation Proposal Candidate: Ajoy Kumar, Advisor: Dr Eduardo B. Fernandez.

Socket Layer Security. In this Presentation: need for web security SSL/TLS transport layer security protocols HTTPS secure shell (SSH)

CSE 461 Section. “Transport Layer Security” protocol Standard protocol for encrypting Internet traffic Previously known as SSL (Secure Sockets Layer),

BASIC CRYPTOGRAPHY CONCEPT. Secure Socket Layer (SSL)  SSL was first used by Netscape.  To ensure security of data sent through HTTP, LDAP or POP3.

What is EAP EAP stands for Extensible Authentication Protocol. Offers a basic framework for authentication. Many different authentication protocols can.

World Class Standards ANFOV - Milano, 14 November 2007 – Paolo DE LUTIIS ANFOV - Milano, 14 November 2007 Autore:Paolo DE LUTIIS Telecom Italia Security.

1 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) The Insecurity of Tunnelled Authentication Protocols N. ASOKAN, VALTTERI NIEMI,

Doc.: IEEE /0408r0 Submission March 2004 Colin Blanchard, BTSlide 1 3GPP WLAN Interworking Security Colin Blanchard British Telecommunications.

1 © NOKIA MitM.PPT (v0.2) / 6-Nov-02 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) The Insecurity of Tunnelled Authentication Protocols N. ASOKAN, VALTTERI.

802.1x EAP Authentication Protocols

An Initial Security Analysis of the IEEE 802.1x Standard Tsai Hsien Pang 2004/11/4.

Protected Extensible Authentication Protocol

IEEE Wireless Local Area Networks (WLAN’s).

WLAN Security:PEAP Sunanda Kandimalla. Intoduction The primary goals of any security setup for WLANs should include: 1. Access control and mutual authentication,

NCHU AI LAB Implications of Unlicensed Mobile Access for GSM security From ： Proceeding of the First International Conference on Security and Privacy for.

WLAN security S Wireless Personal, Local, Metropolitan, and Wide Area Networks1 Contents WEP (Wired Equivalent Privacy) No key management Authentication.

Faten Yahya Ismael.  It is technology creates a network that is physically public, but virtually it’s private.  A virtual private network (VPN) is a.

Wireless LAN Security Yen-Cheng Chen Department of Information Management National Chi Nan University

EAP Overview (Extensible Authentication Protocol) Team Golmaal: Vaibhav Sharma Vineet Banga Manender Verma Lovejit Sandhu Abizar Attar.

SYSTEM ADMINISTRATION Chapter 13 Security Protocols.

Virtual Private Network (VPN) SCSC 455. VPN A virtual private network that is established over, in general, the Internet – It is virtual because it exists.

Remedies Use of encrypted tunneling protocols (e.g. IPSec, Secure Shell) for secure data transmission over an insecure networktunneling protocolsIPSecSecure.

WIRELESS LAN SECURITY Using

Comparative studies on authentication and key exchange methods for wireless LAN Authors: Jun Lei, Xiaoming Fu, Dieter Hogrefe and Jianrong Tan Src:

Wireless and Security CSCI 5857: Encoding and Encryption.

Guomin Yang et al. IEEE Transactions on Wireless Communication Vol. 6 No. 9 September

SSL / TLS in ITDS Arun Vishwanathan 23 rd Dec 2003.

Behzad Akbari Spring 2012 (These slides are based on lecture slides by Lawrie Brown)

1 Chapter 8 Copyright 2003 Prentice-Hall Cryptographic Systems: SSL/TLS, VPNs, and Kerberos.

1 EAP Usage Issues Feb 05 Jari Arkko. 2 Typical EAP Usage PPP authentication Wireless LAN authentication –802.1x and i IKEv2 EAP authentication.

1 Section 10.9 Internet Security Association and Key Management Protocol ISAKMP.

KAIS T Security architecture in a multi-hop mesh network Conference in France, Presented by JooBeom Yun.

1 /10 Pascal URIEN, IETF 66 h, Wednesday July 12 th,Montreal, Canada draft-urien-badra-eap-tls-identity-protection-00.txt

Shambhu Upadhyaya Security –Upper Layer Authentication Shambhu Upadhyaya Wireless Network Security CSE 566 (Lecture 10)

Chapter 21 Distributed System Security Copyright © 2008.

EAP Keying Problem Draft-aboba-pppext-key-problem-03.txt Bernard Aboba

Network access security methods Unit objective Explain the methods of ensuring network access security Explain methods of user authentication.

1 Security Protocols in the Internet Source: Chapter 31 Data Communications & Networking Forouzan Third Edition.

Wireless Network Security and Interworking

EAP Authentication for SIP & HTTP V. Torvinen (Ericsson), J. Arkko (Ericsson), A. Niemi (Nokia),

ICOS BOF EAP Applicability Bernard Aboba IETF 62, Minneapolis, MN.

March 17, 2003 IETF #56, SAN FRANCISCO1 Compound Authentication Binding Problem (EAP Binding Draft) Jose Puthenkulam Intel Corporation (

Securing Data Transmission and Authentication. Securing Traffic with IPSec IPSec allows us to protect our network from within IPSec secures the IP protocol.

PPP Configuration.

1 Pascal URIEN, IETF 63th Paris, France, 2nd August 2005 “draft-urien-eap-smartcard-type-02.txt” EAP Smart Card Protocol (EAP-SC)

1 Objectives Wireless Access IPSec Discuss Network Access Protection Install Network Access Protection.

Washinton D.C., November 2004 IETF 61 st – mip6 WG MIPv6 authorization and configuration based on EAP (draft-giaretta-mip6-authorization-eap-02) Gerardo.

Doc.: IEEE /303 Submission May 2001 Simon Blake-Wilson, CerticomSlide 1 EAP-TLS Alternative for Security Simon Blake-Wilson Certicom.

Wireless Network Security CSIS 5857: Encoding and Encryption.

N. Asokan, Kaisa Nyberg, Valtteri Niemi Nokia Research Center

Dos and Don’ts of Client Authentication on the Web Kevin Fu, Emil Sit, Kendra Smith, Nick Feamster Presented: Jesus F. Morales.

IPSec is a suite of protocols defined by the Internet Engineering Task Force (IETF) to provide security services at the network layer. standard protocol.

1 Secure Key Exchange: Diffie-Hellman Exchange Dr. Rocky K. C. Chang 19 February, 2002.

KAIS T Comparative studies on authentication and key exchange methods for wireless LAN Jun Lei, Xiaoming Fu, Dieter Hogrefe, Jianrong Tan Computers.

Lect 8 Tahani al jehain. Types of attack Remote code execution: occurs when an attacker exploits a software and runs a program that the user does not.

Analysis of SIP security Ashwini Sanap ( ) Deepti Agashe ( )

Securing Access to Data Using IPsec Josh Jones Cosc352.

This courseware is copyrighted © 2016 gtslearning. No part of this courseware or any training material supplied by gtslearning International Limited to.

Lecture 10 Page 1 CS 236 Online SSL and TLS SSL – Secure Socket Layer TLS – Transport Layer Security The common standards for securing network applications.

SSL: Secure Socket Layer By: Mike Weissert. Overview Definition History & Background SSL Assurances SSL Session Problems Attacks & Defenses.

1. Introduction In this presentation, we will review ,802.1x and give their drawbacks, and then we will propose the use of a central manager to replace.

November 18, 2002 IETF #55, ATLANTA1 Problem with Compound Authentication Methods Jesse Walker Intel Corporation (

MAC Address Hijacking Problem

Presentation transcript:

1 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) The Insecurity of Tunnelled Authentication Protocols N. ASOKAN, VALTTERI NIEMI, KAISA NYBERG Nokia Research Center

2 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Remote MN Authentication Methods Two network access scenarios Subscription based – there is a home network Alternative access based – there is no home network In both cases the local authentication agent (e.g., AAAL) contacts some back-end authentication server to verify authenticity of MN

3 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Remote MN Authentication Methods Two cryptographic scenarios Public key based Secret key based In both cases authenticity of MN is based on some secrets MN has

4 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Remote MN Authentication Methods At least two session key scenarios Session credentials for MN – goal is service level session security, or session connection security with a different party Session connection security, e.g., communication security in link, transport and/or network layer … In all cases session keys are derived as a result of successful authentication between MN and a front- end authentication agent (e.g., AAAL)

5 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Remote MN Authentication Methods - EAP Extensible Authentication Protocol (EAP) is a general protocol framework that supports multiple authentication mechanisms allows a back-end server to implement the actual mechanism authenticator simply passes authentication signaling through EAP was initially designed for use with PPP network access But has been adapted by for many types of access authentication WLAN (IEEE 802.1X), Bluetooth, … And even other applications charging, authorization EAP consists of several Request/Response pairs; Requests are sent by network starts with EAP-Request/Identity sent by network ends with EAP-Success or EAP-Failure sent by network But drawbacks of EAP prompted attempts to secure it

6 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Confidentiality of the identity of the MN on the air interface Prevention of linking between pairs of authentication messages involving the same MN Confidentiality against radio interface eavesdropping for data exchanged during the authentication protocol Existing EAP based authentication methods fail… Privacy requirements

7 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Different session key derivation methods Many legacy protocols for MN authentication Encapsulated in EAP types EAP does not provide a standard way for deriving session keys that can be used for message authentication or encryption Examples: 1. One-time passwords – totally insecure if not protected. Typically tunnelled through TLS. Session keys derived from TLS (proprietary to PEAP or TTLS). 2. EAP/SIM – proprietary protection methods - network authentication, session key derivation A consistent method of session key derivation is desirable

8 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Protecting EAP- the PEAP approach Designed to protect any EAP method for terminal authentication. Designed to protect terminal anonymity. Authenticates network to terminal based on public key of network. Designed to provide mutual authentication. Makes use of TLS as the tunnel protocol: EAP protocol runs in TLS tunnel. Designed to provide unified method for session key derivation. Session keys derived from TLS: Protection of WLAN link is based on the same secrets as the TLS tunnel.

9 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Protecting EAP – the PEAP approach

10 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Protecting EAP – the PIC approach Bootstraps IKE (JFK etc) from any EAP protocol – intended for remote access to VPN gateways Protects any EAP method for MN authentication Provides MN anonymity Authenticates network (Back-end server or its agent) to MN Provides unified method for credential transport Tunnel protocol: simplified unilateral version of ISAKMP (Layer 3) Session credentials for IPSec SA created by Back- end server transported to MN through the protected tunnel Session communication protected by the L3 tunnel – currently no protection on L2 (MAC addresses)

11 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Protecting EAP – the PIC approach

12 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) PIC and PEAP - Open issues If it can be done, at what cost and under what assumptions on the use of PK? DoS attacks on access network? DoS attacks on radio interface? Additional roundtrip necessary? How to obtain network’s public key and link it to network’s identity? How can user verify network’s certificate? What about revocation?

13 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) PEAP/AKA- How it works

14 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) PIC EAP/AKA- How it works

15 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) PEAP/AKA- How it can fail

16 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) PIC EAP/AKA- How it can fail

17 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Analysis of the problem Inner protocol is a legacy remote client authentication protocol (EAP/SIM, EAP/AKA) –typically used also without TLS tunnelling, also without ANY tunnelling MitM can set up a false cellular base station to ask for IMSI and subsequently, for RES. Even if EAP protocol is used exclusively in tunnelled mode, authentication of tunnel relies solely upon the terminal. Terminal user may accept an unknown certificate! This is not acceptable to network operators. Session keys are derived from TLS Master Key generated using tunnel protocol (same key as used to create tunnel). Keys derived in the EAP protocol (EAP SIM or UMTS AKA Master Keys) are not used.

18 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Impacts of failure Under passive (eavesdropping) attacks: Tunneling provides some protection of user identity – however WLAN MAC addresses are revealed anyway! Under active (man-in-the-middle) attacks: Tunnelled authentication protocols fail to protect user identity (e.g., IMSI in EAP AKA or EAP SIM) allow attacker to masquerade as the victim (e.g., and hijack her WLAN link) risk link confidentiality with EAP SIM as auth. protocol, are weaker than plain EAP SIM with EAP AKA as auth. protocol, are much weaker than plain EAP/AKA

19 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Conditions for failure A tunnelled authentication protocol is insecure unless if the outer protocol does perform mutual authentication not true for PEAP in server-authenticated mode, or PIC. if the keys used for a particular subscription are not used in the legacy untunnelled mode (even if other subscriptions may be used in this mode) not true for integrated terminals (e.g., GPRS/WLAN) not true when the same general purpose smartcard (SIM/UICC) is used with separate single-purpose terminals (e.g., WLAN, GPRS)

20 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Proposed solution Create cryptographic binding between tunneling protocol and MN authentication protocol: METHOD 1: Use a one-way function to compute session keys from tunnel secrets (e.g.TLS master key) and EAP secrets (e.g. IK,CK). METHOD 2: Compute a MAC over the protected EAP-response and credential request, using a MAC key derived as session key in Method 1. MAC is verified by AAAL or AAAH. Now tunnel is secure for handling of session keys or credentials. In both methods, EAP secrets must be sent from AAAH to AAAL (or tunnel secrets must be sent from AAAL to AAAH) Both methods rely on the MN authentication protocol producing a session key as well (under some assumptions, also possible to use a long-term key)

21 © NOKIA MitM.PPT/ 6/2/2015 / Kaisa Nyberg (NRC/MNW), N.Asokan (NRC/COM) Conclusions Composing two secure protocols may result in an insecure protocol Using tunnelling to “improve” a remote authentication protocol is very common Known vulnerable combinations: HTTP Digest authentication and TLS PEAP and any EAP subtype PIC and any EAP subtype … The proposed solutions can be used to fix the problem the exact fix needs to be tailored to the specific protocols.