Subject: [eap] authentication of EAP-Logoff

From: "Ehsan Sakhaee" <[email-masked]>
Date: Fri, 10 Oct 2003 00:08:57 +1000

How can a EAP-Logoff message be authenticated ? 
Like how would an AP know that the EAP-Logoff is coming from the
legitimate client and not from a rogue one which is trying to cause a
denial of service attack ?
 
Regards,
 
Ehsan

---

From: Nick Petroni <[email-masked]>
Date: Thu, 9 Oct 2003 10:25:05 -0400 (EDT)

I believe you are talking about the EAPOL-Logoff message, correct?

> How can a EAP-Logoff message be authenticated ?
It can't unless the underlying medium provids some sort of protection.

> denial of service attack ?
802-1X-REV-d7-0, section 7.9 states

802.1X takes no steps to provide either reliable authentication or data
confidentiality in a shared medium environment. Attempting to use EAPOL in
a shared medium environment that does not support reliable authentication
and/or data confidentiality renders Port-based network access control
highly vulnerable to attack; for example, station A can mount a successful
denial of service attack on station B simply by issuing an EAPOL-Logoff
packet using station B's individual MAC address.

Nick

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap