EAP Authentication Protocols for WLANs

• By Krishna Sankar, Andrew Balinsky, Darrin Miller, Sri Sundaralingam.
• Sample Chapter is provided courtesy of Cisco Press.
• Date: Feb 18, 2005.

SaveDiggDel.icio.usDiscussPrintE-mail

Chapter Information

Contents

1. Access Control and Authentication Mechanisms
2. PEAP
3. 802.1x: Introduction and General Principles
4. Cisco LEAP (EAP-Cisco Wireless)
5. EAP-FAST
6. Summary

Chapter Description

This chapter examines the authentication methods: EAP, PEAP, LEAP, and the newer, emerging paradigm EAP-FAST, and weighs the pros and cons of each, in terms of standardization maturity and effectiveness.

From the Book

Cisco Wireless LAN Security

$58.50 (Save 10%)

The second in the WLAN authentication trilogy of chapters, this chapter examines the various authentication protocols such as the Extensible Authentication Protocol (EAP), Protected EAP (PEAP), the Lightweight Extensible Authentication Protocol (LEAP), and EAP- Flexible Authentication via Secure Tunneling (EAP-FAST). This chapter begins with a look at the fundamental concepts and contexts of authentication and access control; next, it discusses the various protocols such as EAP and 802.1x.

Notice the slow progression out of the basic 802.11 standards as you begin to leverage other standards: IEEE, the Internet Engineering Task Force (IETF), and sometimes even proprietary standards. You will see how the various protocols add more security features such as encrypted tunnels for exchanging various information (authentication, credentials, and other data), dynamic key distribution and rotation, authenticating the user rather than the device, and applying identity-based mechanisms and systems that are part of the administrative domain in enterprises.

Access Control and Authentication Mechanisms

Before allowing entities to access a network and its associated resources, the general mechanism is to authenticate the entity (a device and/or user) and then allow authorization based on the identity. The most common access control is binary: It either allows access or denies access based on membership in a group.

NOTE

Extending access control, especially to the wireless world, means a more finely grained authorization; for example, you can allow access to the network and its resources for internal employees and allow Internet access for guests. Employees are also working on federations, so access can be allowed based on the entity's membership in identity federations—for example, intercollege access to researchers, interorganization access based on collaboration on certain projects, and other similar groups and roles.

The different layers, standards, and conceptual entities in the EAP/802.1x world are seen in Figure 7-1.

Figure 7-1 Layered Authentication Framework

The Three-Party Model

The authentication is based on a three-party model: the supplicant, which requires access; the authenticator, which grants access; and the authentication server, which gives permission.

The supplicant has an identity and some credentials to prove that it is who it claims to be. The supplicant is connected to the network through an authenticator's port that is access controlled. The port concept is important because it acts as the choke point for the supplicant's access to the network resources. The access to the network can be controlled at a single point. The supplicant is called a peer in the IETF RFCs and drafts.

NOTE

In the wireless world, the most common supplicant is the STA (Station) (laptop or PDA), and the authenticator is the access point (AP). The STA to AP cardinality is 1:1. (That is, one STA can, at one time, connect to the network through only one AP.) This restriction is tailor made for the EAP/802.1x concept of an access-controlled port.

The authenticator itself does not know whether an entity can be allowed access; that is the function of the authentication server. In the IETF world, the authenticator is referred to as the network access server (NAS) or Remote Address Dial-In User Service (RADIUS) client.

NOTE

In many cases, the authenticator and the authentication server roles can be performed by one device, such as the 802.11 AP.

Let's look at the big picture before discussing the details. The supplicant initiates an access request, and the authenticator starts an EAP message exchange. (In the stricter sense of the standards, such as 802.1x, the supplicant does not necessarily alwaysinitiate the access request; the authenticator can initiate an authentication request when it senses a disabled-to-enabled state transition of a port.) At some point, the authenticator communicates with the authenticator server, which decides on an authentication protocol. A set of exchanges then occurs between the supplicant, the authenticator, and the server; at the end of this exchange, a success or failure state is reached. If the authentication succeeds, the authenticator allows network access to the supplicant through the port. The authenticator also keeps a security context with the supplicant-port pair. This context could trigger many things, including timeout if the authentication is only for a period of time (for example, the billed access in public WLAN scenario).

Layered Framework for Authentication

As shown in Figure 7-1, the authentication model is a layered one and has well-defined functionalities and protocols defining each layer and the interfaces between them. The access media (Step 1 in Figure 7-1) can be any of the 802 media: Ethernet, Token Ring, WLAN, or the original media in the serial Point-to-Point Protocol (PPP) link. The EAP specifications provide a framework for exchanging authentication information (Step 2 inFigure 7-1) after the link layer is established. The exchange does not even need IP. It is the function of the transport protocol layer (Step 3 in Figure 7-1) to specify how EAP messages can be exchanged over LAN, which is what 802.1x (and to some extent some parts of 802.11i) does. The actual authentication process (Step 4 in Figure 7-1) is the one that defines how and what credentials should be exchanged. Bear in mind that this framework still does not say how the authorization should be done, such as what decisions are made and when. This functionality is completely left to the domain.

Table 7-1 lists the major standards and efforts in the authentication framework domain. This chapter covers the different flavors of EAP. Hopefully, this table will enable you to dig deeper into the areas in which you are interested.

Table 7-1 Specifications and Standards in the Authentication Framework Domain

Mechanism

Specification

Description

Domain: Access Method

 

 

PPP

RFC 1661: The Point-to-Point Protocol (PPP)

 

802.3, 802.5, 802.11 and other standards

Various

IEEE access media standards

Transport Layer Security (TLS)

RFC 2246: Transport Layer Security Version 1.0

 

 

RFC 3268: AES Cipher Suit for TLS

 

 

RFC 3546: TLS extensions

 

Domain: Authentication Exchange

 

 

EAP

RFC 2284: PPP Extensible Authentication Protocol (EAP)

Original 1998 EAP standard

 

RFC 3579: RADIUS Support for EAP

Was RFC 2284bis

Will supersede RFC 2284

 

draft-urien-eap-smartcard-03.txt

EAP-Support in SmartCard

 

draft-funk-eap-md5-tunneled-00.txt

EAP MD5-tunneled authentication protocol

 

draft-mancini-pppext-eap-ldap-00.txt

EAP-LDAP protocol

 

draft-haverinen-pppext-eap-sim-12.txt

EAP SIM authentication

 

draft-arkko-pppext-eap-aka-11.txt

EAP AKA authentication

 

draft-tschofenig-eap-ikev2-02.txt

EAP IKEv2 method

 

draft-salki-pppext-eap-gprs-01.txt

EAP GPRS protocol

 

draft-aboba-pppext-key-problem-07.txt

EAP key management framework

 

draft-jwalker-eap-archie-01.txt

EAP Archie protocol

 

draft-ietf-eap-statemachine-01

State machines for EAP peer and authenticator

802.1x

IEEE Std. 802.1X-2001

Port-based network access control

 

802.1aa

Revision of the 802.1x, work-in-progress

Domain: Authentication Process

 

 

RADIUS

RFC 2865: RADIUS

Current RADIUS specification

Supersedes RFC 2138, which in turn supersedes RFC 2058

 

RFC 2866: RADIUS Accounting

Defines protocol for carrying accounting information between authenticator and authentication server

Supersedes RFC 2139, which in turn supersedes RFC 2059

 

RFC 2867: RADIUS Accounting Modifications for Tunnel Protocol Support

Updates RFC 2866

 

RFC 2868: RADIUS Attributes for Tunnel Protocol Support

Updates RFC 2865

 

RFC 2809: Implementation of L2TP Compulsory Tunneling via RADIUS

 

 

RFC 2869: RADIUS Extensions

Adds attributes for carrying AAA information between the authenticator (NAS) and authentication server (shared accounting server)

 

RFC 3576: Dynamic Authorization Extensions to RADIUS

 

 

RFC 2548: Microsoft Vendor-Specific RADIUS Attributes

 

 

RFC 3575: IANA Considerations for RADIUS

Describes best practices for registering RADIUS packet types

Updates Section 6 of RFC 2865

 

RFC 3580: IEEE 802.1x Remote Authentication Dial-In User Service (RADIUS) Usage Guidelines

 

 

RFC 3162: RADIUS and IPV6

 

 

RFC 2881: Network Access Server Requirements Next Generation (NASREQNG) NAS Model

Proposes a model for NAS—the authenticator

 

RFC 2882: Extended RADIUS Practices

 

 

RFC 2618, 2619, 2620, and 2621

Various RADIUS MIBs

 

RFC 2607: Proxy Chaining and Policy Implementation in Roaming

 

One-Time Password (OTP)

RFC 2289: A One-Time Password System

 

 

RFC 2243: OTP Extended Responses

 

EAP TLS (EAP Transport Layer Security)

RFC 2716: PPP EAP TLS Authentication Protocol

 

EAP TTLS (EAP Tunneled TLS)

draft-ietf-pppext-eap-ttls-03.txt

EAP tunneled TLS authentication protocol

Kerberos

RFC 1510: Kerberos V5

 

 

RFC 2712: Addition of Kerberos Cipher Suites to Transport Layer Security (TLS)

 

 

RFC 3244: Microsoft Windows 2000 Kerberos Change Password and Set Password Protocols

 

 

RFC 3546: TLS Extensions

Updates RFC 2246

 

RFC 3268: AES for TLS

 

CHAP

RFC 1994: PPP Challenge Handshake Authentication Protocol (CHAP)

 

 

RFC 2433: Microsoft PPP CHAP Extensions

 

 

RFC 2759: Microsoft PPP CHAP Extensions, Version 2

 

Protected EAP (PEAP)

draft-josefsson-pppext-eap-tls-eap-07.txt

PEAP V2

 

draft-kamath-pppext-peapv0-00.txt

Microsoft PEAP version 0 (implementation in Windows XP SP1)

 

draft-puthenkulam-eap-binding-04.txt

The compound authentication binding problem

Diameter

RFC 3588: Diameter Base Protocol

 

 

draft-ietf-aaa-diameter-nasreq-13.txt; Diameter Network Access Server Application

Diameter application in the AAA domain

 

draft-ietf-aaa-diameter-cms-sec-04.txt

Diameter CMS security application

EAP

The EAP, a flexible protocol used to carry arbitrary authentication information, is defined in RFC 2284. (Incidentally, RFC 2284 is only 16 pages long!) A set of RFCs also defines the various authentication processes over EAP, including TLS, TTLS, SmartCard, and SIM. The IETF EAP workgroup is working on a revision of the EAP RFC and has submitted the new document as RFC 3579 (was RFC 2284bis).

EAP has two major features. First, it separates the message exchange from the process of authentication by providing an independent exchange layer. By doing so, it achieves the second characteristic: orthogonal extensibility, meaning that the authentication processes can extend the functionality by adopting a newer mechanism without necessarily effecting a corresponding change in the EAP layer.

EAP Frames, Messages, and Choreography

The basic EAP consists of a set of simple constructs: four message types, two message frames, and an extensible choreography.

The four message types are request, response, success, and failure. Figure 7-2 shows the EAP frame format.

As shown in Figure 7-3, EAP also defines a packet to negotiate the EAP protocol configuration. The EAP protocol is identified by C227 (Hex). This packet will be included in the data field of the EAP frame in Figure 7-2.

Figure 7-2 EAP Frame Format

Figure 7-3 EAP Configuration Negotiation Packet

Depending on the type, the request and response packets include the type field and data, as shown in Figure 7-4.

Figure 7-4 EAP Request/Response Frame

NOTE

The RFC assigns eight request/response types. The rest are assigned by the Internet Assigned Numbers Authority (IANA). The current assignments are shown in Table 7-2.

Table 7-2 EAP Packet Types Assigned by IANA

Type

Description

1–6

Assigned by RFC

1

Identity

2

Notification

3

Nak (response only)

4

MD5-Challenge

5

One-Time Password (OTP)

6

Generic Token Card (GTC)

7

Not assigned

8

Not assigned

9

RSA Public Key Authentication

10

DSS Unilateral

11

KEA

12

KEA-VALIDATE

13

EAP-TLS

14

Defender Token (AXENT)

15

RSA Security SecurID EAP

16

Arcot Systems EAP

17

EAP-Cisco Wireless (LEAP)

18

Nokia IP SmartCard authentication

19

SRP-SHA1 Part 1

20

SRP-SHA1 Part 2

21

EAP-TTLS

22

Remote Access Service

23

UMTS Authentication and Key Agreement

24

EAP-3Com Wireless

25

PEAP

26

MS-EAP-Authentication

27

Mutual Authentication w/Key Exchange (MAKE)

28

CRYPTOCard

29

EAP-MSCHAP-V2

30

DynamID

31

Rob EAP

32

SecurID EAP

33

EAP-TLV

34

SentriNET

35

EAP-Actiontec Wireless

36

Cogent Systems Biometrics Authentication EAP

37

AirFortress EAP

38

EAP-HTTP Digest

39

SecureSuite EAP

40

DeviceConnect EAP

41

EAP-SPEKE

42

EAP-MOBAC

43

EAP-FAST

44–191

Not assigned; can be assigned by IANA on the advice of a designated expert

192–253

Reserved; requires standards action

254

Expanded types

255

Experimental usage

NOTE

The expanded type (254) frame includes a vendor ID; therefore, it is not deemed interoperable.

Figure 7-5 shows the success/failure frame.

Figure 7-5 EAP Success/Failure Frame

The EAP message exchange is basic, as shown in Figure 7-6. EAP starts after the supplicant has data and link layer connectivity (Step 0 in Figure 7-6). The communication between the authenticator and the supplicant is done as a request-response paradigm, meaning a message is sent and the sender waits for a response before sending another message.

NOTE

Generally, either side should be able to start EAP, not just the authenticator. But in this case, notice that the authenticator starts the EAP message, not the supplicant/client. EAP does not assume a specific protocol such as IP, so the messages are "lock-step"—an ordered exchange of messages in which a reply is sent only after receiving the earlier message. Another important observation is that EAP is a point-to-point (peer-to-peer) exchange at the transport layer, not multicast or any other many-to-many mechanism. The choreography is just a minimal framework facilitating further RFCs to define the exact processes. That is what many of the RFCs do: define EAP over various authentication processes such as EAP-SIM, EAP-over-LDAP, EAP-over-GPRS, and of course, EAP-over-802, which is the 802.1x specification.

The first exchange (Step 1 in Figure 7-6) could be an identity exchange. Even though there is an identity message type, the RFC does not guarantee identity semantics and encourages that the authentication mechanisms not depend on this exchange for identity and have their own identity-recognition mechanisms. Moreover, the initial exchange would most likely be in cleartext; therefore, it is a security vulnerability.

Figure 7-6 EAP Message Exchange Framework

In Step 2, all the exchanges between the supplicant, authenticator, and back-end authentication systems are defined by a wide variety of specific RFCs or drafts and authentication mechanisms.

Finally, at some point, the authenticator determines whether the authentication is a success or failure and sends an appropriate message to the supplicant (Step 3 inFigure 7-6).

EAP Authentication Mechanisms

This section examines in detail some of the most relevant EAP authentication frameworks. The typical mechanisms using EAP over LANS are EAP-MD5, EAP-One-Time Password (EAP-OTP), EAP-TLS, EAP-TTLS, EAP-Generic Token Card (EAP-GTC), Microsoft CHAP (EAP-MSCHAPv2), and EAP-FAST.

EAP-MD5

The EAP-MD5 is a Challenge Handshake Authentication Protocol (CHAP), as defined in RFC 1994. Figure 7-7 shows the choreography of the EAP-MD5 mechanism.

Figure 7-7 EAP-MD5 Choreography

For EAP-MD5 to work, the client and the authentication server must have a shared secret, usually a password associated with an identity/username. This needs to be established out of band (Step 1 in Figure 7-7). The connectivity (Step 2 in Figure 7-7) and identity exchange (Step 3 in Figure 7-7) are required before the EAP-MD5 process. The EAP-MD5 method consists of a random challenge to the supplicant (Step 4-a in Figure 7-7) and a response from the supplicant (Step 4-c, Step 4-d in Figure 7-7), which contains the hash of the challenge created using the shared secret (Step 4-b in Figure 7-7). The authentication server verifies the hash (Step 4-e in Figure 7-7) and accepts or rejects the authentication. The authenticator allows or disallows access (Step 5 in Figure 7-7) based on this decision. If successful, the supplicant gains access (Step 6 in Figure 7-7).

EAP-MD5 is a pure authentication protocol; after the authentication, the messages are transmitted in cleartext. It is also a client authentication protocol—the server side (authenticator) is not authenticated; therefore, it cannot detect a rogue AP.

EAP-MD5 also contains a set of good features: It requires only lightweight processing (which translates to less hardware) and does not require a key/certificate infrastructure. Although pure EAP-MD5 has some value in the PPP world, it is of limited use in the wireless world. For example, Microsoft has dropped the support for EAP-MD5 for the wireless interface in Windows XP. Support was dropped because of security problems; EAP-MD5 is vulnerable to dictionary and brute-force attacks when used with Ethernet and wireless.

EAP-OTP

EAP-OTP is similar to MD5, except it uses the OTP as the response. The request contains a displayable message. The OTP method is defined in RFC 2289. The OTP mechanism is employed extensively in VPN and PPP scenarios but not in the wireless world.

EAP-GTC

The EAP-GTC (Generic Token Card) is similar to the EAP-OTP except with hardware token cards. The request contains a displayable message, and the response contains the string read from the hardware token card.

EAP-TLS

As you have seen, methods such as EAP-MD5 and EAP-GTC are specific to authentication and are confined to authenticating only the client. EAP-TLS adds more capabilities such as mutual authentication, which provides an encrypted transport layer and the capability to dynamically change the keys. On the other hand, EAP-TLS is based on digital certificates and thus requires an infrastructure to manage—issue, revoke, and verify—certificates and keys.

EAP-TLS is based on the TLS protocol that is defined in RFC 2246. The following section talks a little bit about TLS, and then you will look at which of its features carry over into EAP-TLS.

NOTE

The origin of the transport level protocol was SSLv1, proposed and implemented by Netscape for securing browser traffic. SSL 1.0 was superseded by SSL 2.0, which was the original SSL. SSL 3.0, which, of course, superseded SSL 2.0, is the most common security protocol used today. IETF chartered a working group in 1996, accepted submissions from Netscape (SSL 3.0) and Microsoft (PCT), and delivered RFC 2246—TLS 1.0.

A Brief Introduction to TLS

TLS has the concept of sessions and connection. A connection is a channel, whereas a session is governed by security context—session identifier, peer certificate, compression method, cipher spec for the session key, and MAC algorithm parameters and the shared master secret. TLS can and will securely negotiate different session parameters while maintaining the same connection—usually a TCP connection. The handshake phase establishes a session, and the session keys (symmetric) encrypt the transport during the data transfer phase. In addition to providing confidentiality, TLS provides integrity check. TLS, of course, is a point-to-point method.

TLS defines two layers: a record layer (which exchanges messages dealing with things such as fragmentation, MAC, and encryption) and a message layer (which defines different types of messages). The four message types are as follows:

• Change cipher spec—Used to signify change in the session context to be used by the record layer. This is an independent content type that is used to avoid getting trapped in specific protocol messages, at which point the pipe could stall.

• Alert—Could be warning or fatal. The alert message subtypes (approximately 26 sub-types) include close notify, decryption failed, certificate revoked, access denied, and so on.

• Handshake protocol—You will see these messages in Figure 7-8. The subtypes include the following:

  • Hello messages (hello_request, client_hello, and server_hello)

  • Server authentication and key exchange messages (certificate, server_key_exchange, certificate_request, and server_hello_done)

  • Client authentication and key exchange messages (certificate_verify and client_key_exchange)

  • Handshake finalization message (finished)

• Application data—The records themselves are transmitted over a reliable protocol such as TCP. TLS also defines a handshake protocol for authentication, exchanging cryptographic parameters and establishing session context.

Figure 7-8 shows the TLS choreography, through the lifetime of a connection, in some detail.

Figure 7-8 TLS Choreography

The handshake protocol (Steps 3, 4, 5, and 6 in Figure 7-8) accomplishes server authentication, algorithm negotiation, establishing session context, and (optional) client authentication. Of course, to successfully complete the handshake and arrive at the keys and secrets, the client and server should have digital certificates (Step 1 in Figure 7-8) and connectivity (Step 2 in Figure 7-8).

After the handshake is successfully completed, the client and server can exchange application data (Step 7 in Figure 7-8) using the established secure transport. Occasionally, renegotiation of session context might happen, usually for new session keys. Finally, the client or server with the close message closes the connection (Step 8 inFigure 7-8).

EAP-TLS Choreography

EAP-TLS employs selected parts of the TLS. For example, it uses the TLS handshake for mutual authentication, cipher suit negotiation, and to derive session keys; however, it does not use all parts of the TLS record protocol.

Figure 7-9 EAP-TLS Frame Format

Figure 7-9 shows the frame format for EAP-TLS. The EAP type is 13 (see Table 7-2). The EAP data frame consists of TLS-specific fields. A similar approach is taken for the choreography, as shown in Figure 7-10. As expected, Figure 7-10 is a combination ofFigures 7-6 and 7-8.

After the EAP identity request and response, a TLS-START request is sent (this is where Bit 2 of the TLS flag is used) to the supplicant (Step 3-a in Figure 7-10). This initiates the TLS handshake protocol (remember, TLS starts with a client-hello), which, in the end, results in authentication and establishing session keys for securing (confidentiality and integrity) the transport layer. As you saw in the TLS section, the session context contains all the relevant information. After the handshake is done, EAP-TLS does not use any of the TLS record protocols; that is, the application data is not exchanged using the TLS record protocol.

Figure 7-10 EAP-TLS Choreography

NOTE

As you can see, this still does not satisfy all the requirements of the wireless world because EAP-TLS is written for PPP, where a key and authentication are sufficient for communication and the client authenticates the server. The wireless world also has the authenticator/AP, which has to be authenticated, and the server is a RADIUS server.

In the wireless world, EAP-TLS is used as a strong and secure means for authentication and key establishment. After that, the native WEP mechanisms are used to encrypt the data. In fact, the WEP encryption key is derived from the TLS session key.

EAP-TTLS

EAP-TTLS is similar to EAP-TLS, but the client authentication is extended after the secure transport has been established. Then the client can be authenticated using any of the methods like username/PW, CHAP, and MSCHAPv2. This is called tunneled authentication. What this achieves is that the client does not require a digital certificate; only the authentication server needs one. This capability simplifies the client credential management. Organizations can also use currently available/legacy authentication methods (usually password-based schemes).