moving ahead with eap-sim under 3.0.11

[Arran Cudbard-Bell]

> On Mar 4, 2016, at 10:09 AM, Michael Martinez <mwtzzz at gmail.com> wrote:
> 
> I've done some research and now I understand how eap-sim works: in
> theory the server generates a random number (RAND) and gives this to
> the client. The client uses it along with some secret key Ki to
> generate response values RES and Kc. It gives these back to the
> server. If the server also knows what Ki is, then it can generate
> those response values itself and check to make sure they match. But in
> practice the only two places where Ki is known is on the SIM card and
> the mobile network operator.

The Mobile Operator's AuC (Authentication Centre).

The 3GPP/GSM standard probably prohibit it, but some AuCs will probably
have an export interface for the Ki.

I found the example code for Milenage when browsing the 3GPP specs, so
we could implement that as well.

> The mobile network operator will probably
> never give out those values (and if they did it would probably be a
> bureaucratic nightmare to get them).

Yes, if you're not the mobile operator...

> So the next best thing is the
> following workaround: obtain a SIM card reader and some reader
> software, feed some different RAND numbers to it to get the RES and Kc
> values and hard code these into the Radius server.

Sure but you'd never do this for an actual commercial setup, or if you did
you'd probably want to read a few thousand GSM Triplets from the SIM as
part of an onboarding process.

Both EAP-SIM and EAP-AKA expressly prohibit the re-use of SIM triplets.

> The radius server
> will then know what the expected RES and Kc values are for said RANDs.
> The drawback is that it is not truly randomizing the numbers,it's
> picking from a small set of hardcoded values every time. But it's the
> only thing we can do. That's my understanding to this point; hopefully
> I am understanding correctly.

You could automate the extraction so long as there was no kind of
rate limiting thing on the card.

> Here's where I'm stuck. It appears there is a scarcity of SIM card
> readers. I found one at my local electronics store: a Sunpak 72-in-1
> high speed card reader - a $10 piece of junk (i guess USB 2.0 is "high
> speed" to these folks) that not only fails to read any sort of card I
> put into it, but also rather consistently locks up both my Window 8
> laptop and my Windows 7 PC.

You definitely get what you pay for with this stuff.

There's a circuit diagram for a serial (RS232) one here:

	http://www.circuitsarchive.org/index.php/SmartCard_PC_Serial_Reader_/_Writer_%28Phoenix%29

Looks fairly simple, and could probably be built on a breadboard.

Apparently compatible with Magic SIM:

	http://openbsc.osmocom.org/trac/wiki/MagicSIM

Which could be used to get the results of A3 and A8.

Actually, looking at what that's doing, you may even be able to get away with just
using something like a Bus Pirate, I know that supports RS232 to TTL and you could
one of the GPIO pins for RST.

-Arran



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20160304/ea0586fe/attachment-0001.sig>