1. Maryland Information Systems Security Lab D EPARTMENT OF C OMPUTER S CIENCE EAP Password Authenticated eXchange (PAX) T. Charles Clancy William A. Arbaugh {clancy,waa}@cs.umd.edu Department of Computer Science University of Maryland, College Park IETF 61, EAP WG November 10, 2004 draft-clancy-eap-pax-01

2. {} Maryland Information Systems Security Lab D EPARTMENT OF C OMPUTER S CIENCE PAX Introduction 2 round-trip MAC-based mutual authentication Supports provisioning with a weak pre-shared key Optional server-side certificate provides secure provisioning Supports key management with forward secrecy using Diffie-Hellman Optional support for identity protection (requires server-side certificate) Extensible ciphersuite

3. {} Maryland Information Systems Security Lab D EPARTMENT OF C OMPUTER S CIENCE Major Changes from -00 to -01 Address Crypto Concerns –mutual authentication –multiple uses of certain keys with different primitives Protocol Implementation Issues –identity protection paradox –new identity protection subprotocol Paranoia with MD5 and TLS-PRF –extensible key derivation function –support for HMAC-SHA1 and AES-CBC-MAC

4. {} Maryland Information Systems Security Lab D EPARTMENT OF C OMPUTER S CIENCE PAX_STD (no identity protection) A, SID, [PK, Cert PK ] [Enc PK ] (B, CID, MAC CK (A, B, CID, SID)) ServerClient ACK MAC CK (B, CID, SID) X, Y = rand(2 256 ) If keyUpdate thenA = g X, B = g Y, E = g XY elseA = X, B = Y, E = (X || Y) {AK’, CK, SessionKeys} = KDF(AK || E || KeyName)

5. {} Maryland Information Systems Security Lab D EPARTMENT OF C OMPUTER S CIENCE PAX_IDP (identity protection) M, SID, PK, Cert PK Enc PK (M, N, CID) ServerClient B, MAC CK (A, B, CID, SID) A, MAC N (A, CID, SID) M, N, X, Y = rand(2 256 ) If keyUpdate thenA = g X, B = g Y, E = g XY elseA = X, B = Y, E = (X || Y) {AK’, CK, SessionKeys} = KDF(AK || E || KeyName)

6. {} Maryland Information Systems Security Lab D EPARTMENT OF C OMPUTER S CIENCE Cryptographic Primitives Extensible Key Derivation Function –KDF16 X (Y) = MAC X (Y || 1) –KDF64 X (Y) = MAC X (Y || 1) || MAC X (Y || 2) || MAC X (Y || 3) || MAC X (Y || 4) Currently supported: –MAC:HMAC-SHA1-128 AES-CBC-MAC-128 –DH:3072-bit MODP Group [RFC3526] –PubKey:RSA-OAEP-2048

7. {} Maryland Information Systems Security Lab D EPARTMENT OF C OMPUTER S CIENCE PAX Implementation Currently Supports: –FreeRADIUS 1.0.1 –XSupplicant 1.0.1 –Authentication, Key Update Plan to Support: –Microsoft IAS –Windows XP Supplicant –Provisioning, Identity Protection Timings Experiment: –Cisco 1200 AP –Pentium 3 1.2GHz, Linux 2.4.26

8. {} Maryland Information Systems Security Lab D EPARTMENT OF C OMPUTER S CIENCE PAX Implementation Timings ProtocolPK CryptoRTTime (ms) PAX, no update PAX, key update PAX, provision - DH-3072 DH-3072/RSA-2048 223223 9.6 127.3 N/A EAP-TLS DH-512/RSA-512 DH-3072/RSA-2048 5757 89.8 1076.7 PEAP-MSCHAPv2 DH-512/RSA-512 DH-3072/RSA-2048 8 10 90.4 1027.3 TLS/PEAP used OpenSSL DSA-DH parameters, PAX used 3072- bit prime and 256-bit exponent as recommended in [RFC3766]