Foraging for Goodies

Foraging for Goodies

By CWNP On 08/07/2007 - 19 Comments

In my daily foraging for goodies in the 802.11 standard, I tripped across what seemed to be something routine, but upon deeper inspection (the reading of several RFCs), it seems that PAP, CHAP, and MS-CHAP cannot be used between an authenticator and authentication server in an RSN.

 

5.8.4 Authenticator-to-AS protocol
The Authenticator-to-AS authentication definition is out of the scope of this standard, but, to provide security assurances, the protocol must support the following functions:

a) Mutual authentication between the Authenticator and AS
b) A channel for the Supplicant/AS authentication
c) The ability to pass the generated key from the AS to the Authenticator in a manner that provides authentication of the key source, ensures integrity of the key transfer, and preserves data confidentiality of the key from all other parties

Methinks that items "b" and "c" are AOK, but item "a" is a whole other matter.  Just because the authenticator and authentication server have a shared secret does not mean that they perform mutual authentication.  The protocol that verifies the shared secret must perform mutual authentication to meet this requirement.  PAP, CHAP, and MS-CHAP do not perform mutual authentication.  MS-CHAPv2 and EAP-MSCHAP-v2 both do perform mutual authentication and can be used.

That's just my $0.02, but hey, am I wrong?

Devin Akin

CTO, The CWNP Program 

Blog Disclaimer: The opinions expressed within these blog posts are solely the author’s and do not reflect the opinions and beliefs of the Certitrek, CWNP or its affiliates.