UMD D EPARTMENT OF C OMPUTER S CIENCE D O D L ABORATORY FOR T ELECOMMUNICATION S CIENCES EAP-PAX draft-clacy-eap-pax-05 T. Charles Clancy Department of Computer Science University of Maryland, College Park Laboratory for Telecommunication Sciences US Department of Defense IETF 64, EMU BoF, November 10, 2005

{} UMD D EPARTMENT OF C OMPUTER S CIENCE Slide 2 D O D L ABORATORY FOR T ELECOMMUNICATION S CIENCES Overview Basic shared-key mutual authentication method Includes support for: –Ciphersuite extensibility –Provisioning with a weak key or password –Key management (deriving new authentication keys) with perfect forward secrecy (using Diffie-Hellman) –Identity protection / user anonymity –Authenticated data exchange (supports channel binding) Provably secure

{} UMD D EPARTMENT OF C OMPUTER S CIENCE Slide 3 D O D L ABORATORY FOR T ELECOMMUNICATION S CIENCES Subprotocols: PAX_STD A B, CID, MAC CK (A, B, CID) MAC CK (B, CID) ACK CLIENTSERVER

{} UMD D EPARTMENT OF C OMPUTER S CIENCE Slide 4 D O D L ABORATORY FOR T ELECOMMUNICATION S CIENCES Changes since -04 Completed full proof of security, publication pending, will be available online: Added support for the authenticated exchange of data, targeted at channel binding

{} UMD D EPARTMENT OF C OMPUTER S CIENCE Slide 5 D O D L ABORATORY FOR T ELECOMMUNICATION S CIENCES Subprotocols: PAX_SEC M, PK or CertPK ENC PK (M, N, CID) A, MAC N (M, CID) B, MAC CK (A, B, CID) CLIENTSERVER MAC CK (B, CID) ACK

{} UMD D EPARTMENT OF C OMPUTER S CIENCE Slide 6 D O D L ABORATORY FOR T ELECOMMUNICATION S CIENCES Certificate Requirements Use of certificate with PAX_SEC is RECOMMENDED Certificate ModeProvisioningIdentity Protection No CertificateMitM offline dictionary attack ID reveal attack Self-Signed Certificate MitM offline dictionary attack ID reveal attack Key CachingMitM offline dictionary attack ID reveal attack during first auth CA-Signed Certificate secure mutual authentication

{} UMD D EPARTMENT OF C OMPUTER S CIENCE Slide 7 D O D L ABORATORY FOR T ELECOMMUNICATION S CIENCES Security Properties Extensible Ciphersuite –MAC Primatives: HMAC-SHA1 AES-CBC-MAC –Public-Key Primatives: RSA-OAEP-2048 DH-3072, 256-bit exponents Attack Resistance (dictionary, replay, negotiation) Confidentiality (in ID protect mode)

{} UMD D EPARTMENT OF C OMPUTER S CIENCE Slide 8 D O D L ABORATORY FOR T ELECOMMUNICATION S CIENCES Provable Security Random Oracle Model [Bellare 93] Supported primitives all act like Random Oracles [Bellare 94, Bellare 96, Bellare 00] Assume probabilistic, polynomial-time attacker EAP-PAX is secure against: –passive attacks if: PAX_STD without DH: Key O(2 k ) PAX_STD with DH: Key O(1) PAX_SEC without DH: Key O(2 k ) PAX_SEC with DH: Key O(1) –active attacks if: PAX_STD: Key O(2 k ), auth limit O(k n ) PAX_SEC with cert: Key O(k n ), auth limit O(1) PAX_SEC without cert: Key O(2 k ), auth limit O(k n )

{} UMD D EPARTMENT OF C OMPUTER S CIENCE Slide 9 D O D L ABORATORY FOR T ELECOMMUNICATION S CIENCES Channel Binding Validate lower-layer EAP parameters during authentication Need secure mechanism for exchanging parameters What is needed? Confidentiality? Authenticity? PAX provides authenticity, but not confidentiality (would require additional symmetric-key ciphersuite) Attach “Authenticated Data Exchange” frames during authentication once keys have been derived

{} UMD D EPARTMENT OF C OMPUTER S CIENCE Slide 10 D O D L ABORATORY FOR T ELECOMMUNICATION S CIENCES Channel Binding A B, CID, MAC, ADE(type 1, value 1 ) MAC, ADE(type 2, value 2 ) ACK, ADE(type 3, value 3 ) CLIENTSERVER ACK, ADE(type N, value N ) ACK, ADE(type N+1, value N+1 ) EAP-Success / EAP-Failure … …