1. emu wg, IETF 70 Steve Hanna, shanna@juniper.net
EAP-TTLS draft-funk-eap-ttls-v0-02.txt draft-hanna-eap-ttls-agility-00.txt
emu wg, IETF 70
Steve Hanna,

2. EAP-TTLS for IETF EMU WG
TLS-based tunneled EAP method
Phase 1: like EAP-TLS
Phase 2: AVP exchange
Supports
Tunneled authentication via many methods
Multiple forms of authentication
Endpoint integrity checks
Other extensions
Documented in Internet-Drafts since 2001
Widely implemented and deployed (eduroam, etc.)
Cited by SDOs like WiMAX & 3GPP
Heading for RFC status
December 4, 2007
EAP-TTLS for IETF EMU WG

3. EAP-TTLS for IETF EMU WG
EAP-TTLS AVPs
Diameter AVP format
32-bit type, 24-bit length
M bit for Mandatory to support
V bit and Vendor-ID for vendor-specific AVPs
RADIUS and Diameter attributes carry over
Easy to integrate with RADIUS servers
Can translate AVPs into RADIUS packets
Easy to tunnel existing EAP methods
Easy to tunnel non-EAP authentication
Easy to add new capabilities
December 4, 2007
EAP-TTLS for IETF EMU WG

4. Changes in eap-ttls-v0-02
Added IANA Considerations
Updated references
Minor clarifications in response to reviews
December 4, 2007
EAP-TTLS for IETF EMU WG

5. EAP-TTLS for IETF EMU WG
eap-ttls-agility-00
Optional AVPs for use with EAP-TTLS
Provide
Cryptographic algorithm agility
Cryptographic binding of inner and outer auth
Intermediate key confirmation
Protected results
December 4, 2007
EAP-TTLS for IETF EMU WG

6. Cryptographic Algorithm Agility
EAP-TTLSv0 already fairly agile
Uses TLS ciphersuite negotiation
But MSK and EMSK computation algorithm always uses TLS 1.1 PRF (based on SHA-1 and MD5)
Solution
New MSK-Computation AVP to negotiate alternative MSK and EMSK computation algorithms
New MSK and EMSK computation algorithm (“Mixed”)
Uses TLS PRF (negotiable in TLS 1.2)
Based on new Composite Key, which mixes in MSKs exported by inner authentications
December 4, 2007
EAP-TTLS for IETF EMU WG

7. Cryptographic Binding of Inner and Outer Authentications
Protect against MITM attacks like [Asokan]
Mixed MSK computation gives some protection
But only after EAP authentication completed, so...
Key-Confirmation-Option AVP
Negotiates use of Key-Confirmation AVP
Key-Confirmation AVP
Server MAY send any time, MUST send at end
Server sends POP for Composite Key
Client responds with similar POP
December 4, 2007
EAP-TTLS for IETF EMU WG

8. EAP-TTLS for IETF EMU WG
Secure Completion
Ensure secure completion of handshake
Detect truncation attacks
Detect forged EAP-Success or EAP-Failure
Secure-Completion-Option AVP
Negotiates use of Secure Completion
TTLS-Success and TTLS-Failure AVPs
Final exchange WITHIN tunnel
December 4, 2007
EAP-TTLS for IETF EMU WG

9. Evaluation Against Requirements
Transport of encrypted password for support of legacy password databases: YES
2. Mutual authentication (specifically authentication of the server): YES
3. Resistance to offline dictionary attacks, man-in-the-middle attacks: YES
4. Compliance with RFC 3748, RFC 4017 and EAP keying (including EMSK and MSK generation): YES
5. Peer identity confidentiality: YES
December 4, 2007
EAP-TTLS for IETF EMU WG

10. Evaluation Against Requirements
6. Crypto agility and ciphersuite negotiation: YES w TLS 1.2
7. Session resumption: YES
8. Fragmentation and reassembly: YES
9. Cryptographic binding: YES
10. Password/PIN change: YES when authentication method supports
December 4, 2007
EAP-TTLS for IETF EMU WG

11. Evaluation Against Requirements
11. Transport Channel binding data: Can support with new AVPs
12. Protected result indication: YES
13. Support for certificate validation protocols: YES w TLS CertStatus extn
14. Extension mechanism: YES
December 4, 2007
EAP-TTLS for IETF EMU WG

12. EAP-TTLS for IETF EMU WG
Summary
EAP-TTLS
Well-established EAP method
Specified in Internet-Drafts since 2001
Widely implemented
Used by other standards bodies
No known substantial IPR problems
Meets all stated requirements
Easy to integrate with RADIUS servers
Offers many other features
Tunneled authentication via many methods
Multiple forms of authentication
Endpoint integrity checks (for NEA)
December 4, 2007
EAP-TTLS for IETF EMU WG