topic Re: Questions regarding ISE Key Wrap functionality in Network Access Control

Questions regarding ISE Key Wrap functionality

coolsaurabh.hrc — Tue, 15 Mar 2022 06:10:31 GMT

Hi Team,

Could someone please provide details on how ISE calculates message-authentication-code AVP and insert into Access-accept packet when Key Wrap is enabled?

The problem we have is that the HMAC calculation on the Access-accept received from ISE does not match with inserted 20 bytes of hmac sha1 value in AVP.

Note: ISE sends access-accept, so ISE likes access-request packet (from us) and ISE’s hmac validation on access-request packet is correct.

Regards,

Saurabh

Re: Questions regarding ISE Key Wrap functionality

Arne Bier — Sun, 20 Mar 2022 21:39:38 GMT

Hello @coolsaurabh.hrc

I haven't used key wrap feature. Just curious, why you're using it, and whether you have discovered a weakness in the existing MPPE key exchange?

It sounds like the Access-Accept is being returned to the NAS, and all is well? Perhaps the HMAC in the Access-Accept should not match that sent in the Access-Request. Have you tried analysing this in Wireshark?