eap Mailing List: Re: Re: Issue 352: Channel Binding Issue

[Yoshihiro Ohba (yohba]

On Mon, May 08, 2006 at 10:42:44AM -0700, Salowey, Joe wrote:
>  
> 
> > -----Original Message-----
> > From: Yoshihiro Ohba [mailto:yohba [at] tari.toshiba.com] 
> > Sent: Monday, May 08, 2006 9:35 AM
> > To: Salowey, Joe
> > Cc: Yoshihiro Ohba; Bernard Aboba; eap [at] frascone.com
> > Subject: Re: [eap] Re: Issue 352: Channel Binding Issue
> > 
> > On Mon, May 08, 2006 at 09:17:35AM -0700, Salowey, Joe wrote:
> > > > > [Joe] Obsoleted by what?
> > > > 
> > > > I'd say by CB with key mixing.
> > > > 
> > > [Joe] I don't agree. For one there are usages of EAP which 
> > do not use
> > > EAP keying material so key mixing will not work for them. 
> > > 
> > 
> > Can you elaborate on the usages you mentioned above?
> > 
> [Joe] 802.1x

If EAP keying material is not used for secure association at all, I
don't think CB is possible because an attacker authenticator can
simply spoof legitimate authenticator's parameters.  This can happen
in the case of wired 802.1X as well.  Am I wrong?

Yoshihiro Ohba