Alan,
Yes, I can propose a specific modification. In fact, I did already.
It just got truncated from the thread. What I suggest is that in
section 3.1, in the middle of the first paragraph (the text that Joe
was quoting originally), remove this:
"The tunnel method MUST support transporting the username
and password to the authentication server. However, it
MUST NOT expose the username and password to parties in the
communication path between the peer and the EAP server and
it MUST provide protection against man-in-the-middle and
dictionary attacks."
and put this in its stead:
"The advantage any attacker gains against the tunneled method
when employing a username and password for authentication MUST
be through interaction and not computation".
I believe that captures the property we want the tunnel method to
have and is not so vague. It applies to active attacks against the
authenticator, active attacks against the client, passive attacks
between them and between the authenticator and any authentication
server that may exist, and all forms of man-in-the-middle and
dictionary attack that could be launched against the legitimate
participants in this tunnel method.
Dan.
On Tue, December 1, 2009 2:52 am, Alan DeKok wrote:
> Dan Harkins wrote:
>> The text says the method
>> "MUST NOT expose" the username and password. The word "expose" is not
>> defined and is very vague and open to interpretations that would result
>> in an insecure protocol. I think there is a property in a properly
>> modeled
>> protocol that could replace that vague term.
>
> OK.
>
>> I am saying that the current requirement is
>> vague and may not be accurate for some reasonable definitions of
>> "expose".
>> I suggest a better, and more accurate description of this property. Is
>> there a problem with my suggestion?
>
> No. I just want to be sure I understand what you're getting at.
>
> Can you propose specific modifications to the text? i.e. quote the
> current text, and then write what you think it should say.
>
> Alan DeKok.
>
_______________________________________________
Emu mailing list
Emu@ietf.org
https://www.ietf.org/mailman/listinfo/emu
