Subject: Resolution for Issue 24: Does 802.1X help against issues not handled by SEND

From: "James Kempf" <[email-masked]>
Date: Wed, 10 Sep 2003 09:52:20 -0700

Suggested resolution for Issue 24 is to include the following text as the
second paragraph in the Security Considerations section:

   Specifically, the 802.1x standard [ref] provides a mechanism by which a
host can be authenticated to a particular point of attachment to a LAN
(called a "port" in the standard). If the MAC on frames sent by a host does
not correspond to the MAC of the host originally authenticated to this port,
then the point of attachment drops the frames. Authorization to use the port
is determined by the MAC address of the host that originally authenticated
to the port. The way 802.1x protects against this attack is that, if a host
authenticated to a particular port attempts to spoof the MAC address of
another host, the port will drop the frames. Naturally, this requires that
all ports by which hosts can attach to the LAN use 802.1x authentication,
and that all hosts physically attach through a port, as is the case with
802.3 switched LAN. For shared media such as multiple hosts authenticated
through the same 802.11 AP (which acts as a single port for all hosts) other
measures are necessary, since an attacker on the wireless link can spoof the
MAC address of a victim on the same wireless link.

  802.1x does not provide protection for the layer 2 frame - layer 3 packet
address binding in traffic (that is, real time filtering to check this
binding), and neither does SEND. 802.1x provides authentication and
filtering of MAC address to port, SEND provides protection for the layer 2 -
layer 3 binding information in the Neighbor Discovery packet, via the CGA
address (authorization to use the address via the public key) and the
signature on the packet (authentication of contents as from authorized IP
address possessor).

            jak

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------