The Insecurity of Tunnelled Authentication Protocols N ASOKAN

Скачать презентацию The Insecurity of Tunnelled Authentication Protocols N ASOKAN

ad993445a2fa3f58b1cd603e850e01d0.ppt

Количество слайдов: 20

The Insecurity of Tunnelled Authentication Protocols N. ASOKAN, VALTTERI NIEMI, KAISA NYBERG Nokia Research Center 1 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Remote MN Authentication Methods • Two network access scenarios • Subscription based – there is a home network • Alternative access based – there is no home network In both cases AAAL contacts some back-end authentication server to verify authenticity of MN 2 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Remote MN Authentication Methods • Two cryptographic scenarios • Public key based • Secret key based In both cases authenticity of MN is based on some secrets MN has 3 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Remote MN Authentication Methods • At least two session key scenarios • Session credentials for MN – goal is service level session security, or session connection security with a different party • Session connection security, e. g. , communication security in link, transport and/or network layer • … In all cases session keys are derived as a result of successful authentication between MN and AAAL 4 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Remote MN Authentication Methods EAP • Extensible Authentication Protocol (EAP) is a general protocol framework that supports • multiple authentication mechanisms • allows a back-end server to implement the actual mechanism • authenticator simply passes authentication signaling through • EAP was initially designed for use with PPP network access • But has been adapted by for many types of access authentication • • WLAN (IEEE 802. 1 X), Bluetooth, … And even other applications • charging, authorization • EAP consists of • several Request/Response pairs; Requests are sent by network • • 5 © NOKIA (NRC/COM) starts with EAP-Request/Identity sent by network ends with EAP-Success or EAP-Failure sent by network Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Privacy requirements • Confidentiality of the identity of the MN on the air interface • Prevention of linking between pairs of authentication messages involving the same MN • Confidentiality against radio interface eavesdropping for data exchanged during the authentication protocol Existing EAP based authentication methods fail… 6 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Different session key derivation methods • Many legacy protocols for MN authentication • Encapsulated in EAP types • EAP does not provide a standard way for deriving session keys that can be used for message authentication or encryption • Examples: 1. One-time passwords – totally insecure if not protected. Typically tunnelled through TLS. Session keys derived from TLS (proprietary to PEAP or TTLS). 2. EAP/SIM – proprietary protection methods network authentication, session key derivation A consistent method of session key derivation is desirable (EAP WG needs to specify a key derivation 7 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Protecting EAP- the PEAP approach • Designed to protect any EAP method for terminal authentication. • Designed to protect terminal anonymity. • Authenticates network to terminal based on public key of network. • Designed to provide mutual authentication. • Makes use of TLS as the tunnel protocol: EAP protocol runs in TLS tunnel. • Designed to provide unified method for session key derivation. • Session keys derived from TLS: Protection of WLAN link is based on the same secrets as the TLS tunnel. 8 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Protecting EAP – the PEAP approach 9 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Protecting EAP – the PIC approach • Bootstraps IKE (JFK etc) from any EAP protocol – intended for remote access to VPN gateways • Protects any EAP method for MN authentication • Provides MN anonymity • Authenticates network (Back-end server or its agent) to MN • Provides unified method for credential transport • Tunnel protocol: simplified unilateral version of ISAKMP (Layer 3) • Session credentials for IPSec SA created by Backend server transported to MN through the protected tunnel • Session communication protected by the L 3 tunnel – 10 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Protecting EAP – the PIC approach 11 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

PIC and PEAP - Open issues • If it can be done, at what cost and under what assumptions on the use of PK? • Do. S attacks on access network? • Do. S attacks on radio interface? • Additional roundtrip necessary? • How to obtain network’s public key and link it to network’s identity? • How can user verify network’s certificate? • What about revocation? 12 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Analysis of the problem • Inner protocol is a legacy remote client authentication protocol (EAP/SIM, EAP/AKA) –typically used also without TLS tunnelling, also without ANY tunnelling • Mit. M can set up a false cellular base station to ask for IMSI and subsequently, for RES. • Even if EAP protocol is used exclusively in tunnelled mode, authentication of tunnel relies solely upon the terminal. Terminal user may accept an unknown certificate! This is not acceptable to network operators. • Session keys are derived from TLS Master Key generated using tunnel protocol (same key as used to create tunnel). • Keys derived in the EAP protocol (EAP SIM or UMTS AKA Master Keys) are not used. 17 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Impacts of failure • Under passive (eavesdropping) attacks: • Tunneling provides some protection of user identity – however temporary identities that are managed on the home network can provide protection against both passive and active attacks • Under active (man-in-the-middle) attacks: Tunnelled authentication protocols • • • 18 © NOKIA (NRC/COM) fail to protect user identity (e. g. , IMSI in EAP AKA or EAP SIM) allow attacker to masquerade as the victim (e. g. , and hijack her WLAN link) risk link confidentiality with EAP SIM as auth. protocol, are weaker than plain EAP SIM with EAP AKA as auth. protocol, are much weaker than plain EAP/AKA Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Proposed solution • Create cryptographic binding between tunneling protocol and MN authentication protocol: METHOD 1: Use a one-way function to compute session keys from tunnel secrets (e. g. TLS master key) and EAP secrets (e. g. IK, CK). METHOD 2: Compute a MAC over the protected EAP-response and credential request, using a MAC key derived as session key in Method 1. MAC is verified by AAAL or AAAH. Now tunnel is secure for handling of session keys or credentials. • In both methods, EAP secrets must be sent from AAAH to AAAL (or tunnel secrets must be sent from AAAL to AAAH) • Both methods rely on the MN authentication protocol producing a session key as well. 19 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan

Conclusions • Composing two secure protocols may result in an insecure protocol • Don’t fix something that isn’t broken! • Using tunnelling to “improve” a remote authentication protocol is very common • Known vulnerable combinations: • HTTP Digest authentication and TLS • PEAP and any EAP subtype • PIC and any EAP subtype • … • The proposed solutions can be used to fix the problem • the exact fix needs to be tailored to the specific protocols. 20 © NOKIA (NRC/COM) Mit. M. PPT/ 15/03/2018 / Kaisa Nyberg (NRC/MNW), N. Asokan