Prudent Engineering Practice for Cryptographic Protocols
IEEE Transactions on Software Engineering
Tussle in cyberspace: defining tomorrow's internet
Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
Man-in-the-middle in tunnelled authentication protocols
Proceedings of the 11th international conference on Security Protocols
| Hi-index | 0.00 |
Security protocols typically employ an authentication phase followed by a protected data exchange. In some cases, such TLS, these two phases are tightly integrated, while in other cases, such as EAP (Extensible Authentication Protocol) and Kerberos, they are separate and often implemented in different endpoints. However, careless application of this separation has lead to several vulnerabilities. In this paper we discuss reasons why this separation is often useful, what mistakes have been made, and what these mistakes have in common. We then describe some approaches how these problems could be avoided, especially focusing on EAP in wireless LANs. We also present some engineering observations that should be taken into account when designing reusable authentication components in the future.