How secure is Eduroam?

Csillag Tamás <cstamas(a)ppke.hu>
http://cstamas.hu/

HBONE Networkshop 2013, Sopron

Overview

Eduroam is everywhere

More mobile devices than before

Android

phone

phone

How secure is eduroam? (EAP)

eap

eap

How secure is eduroam? (PEAP)

PEAP eapol

PEAP eapol

About PEAP security

MS-CHAPv2?

vulnerability

vulnerability

MS-CHAPv2

But, we still have TLS

do we?

Linux wpasupplicant

network={
  ssid="eduroam"
  ...
  ca_cert="/etc/ssl/certs"
  subject_match="/C=HU/ST=Budapest/L=Budapest
    /O=Pazmany Peter Katolikus Egyetem/CN=tutela.itk.ppke.hu"
  ...
}

Windows supplicant

security switch

security switch

another bit

another bit

Implementations Android

Not sure about iOS

iOS cert chain

ios cert

ios cert

Eduroam crack test @ PPKE

5 Minutes test

EAP-TLS as an answer?