The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <stefan.winter AT restena.lu>]

Hello,

> Just an academic question: If you had a mobile OS landscape all
> capable of EAP-PWD and only allow this in the server, would you
> be able to achieve the same level of security as with EAP-TLS? 


No. It does not matter what the genuine server allows: when the client
device is communicating with an attacker, that rogue server will
conveniently *not* support EAP-pwd, simply because it wouldn't be able
to do anything useful with the EAP payload then. A good attacker would
suggest TTLS-PAP as EAP method of choice, and then maybe PEAP. If the
device accepts that, the damage is done.


The only way to prevent this from being a useful attack vector is by
configuring the *client* to exclusively talk EAP-pwd with any server it
encounters.


Which means the client needs to be actively configured. E.g. by a CAT
profile. But then: if there is a need for a CAT profiile deployment
anyway - that profile can just as well securely configure TTLS or PEAP
instead.


That makes EAP-pwd a less interesting thing than one would hope :-(


Greetings,


Stefan Winter

Attachment: OpenPGP_signature
Description: OpenPGP digital signature