Man-in-the-middle attacks in tunneled authentication protocols
In September 2002, we discovered a rather obvious flaw that shows up when
a remote authentication protocol is tunneled within a server-authenticated
channel. Surprisingly this approach is used in many existing or
proposed protocols.
Here is the paper: