Subject: RE: [eap] network discovery & selection: problem definition

From: "Adrangi, Farid" <[email-masked]>
Date: Sun, 30 Nov 2003 05:15:59 -0800

Hi Michael,
Please see my reply inline (marked by Farid>).
BR,
Farid

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Michael Richardson
Sent: Saturday, November 29, 2003 3:35 PM
To: [email-masked]
Subject: Re: [eap] network discovery & selection: problem definition 

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Jari" == Jari Arkko <[email-masked]> writes:
    Jari> Michael Richardson wrote:

    >> An additional area, maybe out of scope:
    >> how do I know that these intermediaries are legitimate, vs MITM?

    Jari> I suppose they still have to be legitimate AAA proxies.
    Jari> That is, an access network should not send your request to
    Jari> an unknown intermediary. If it has a business relationship
    Jari> with three intermediaries int1.com, int2.com, and int3.com,
    Jari> it will route your request through one of them, even if you
    Jari> tried to request routing through mitm.org.

  It is more immediate than that.

  Let's assume that there are two competing hotspots, physically
adjacent
to each other. The signal is available in both locations. Both are using
NAT. 

  Call the two operators DeltaCoffee and GammaCoffee. They are using
ESSID
"delta" and "gamma". Both make deals with arkohotspotproxy.com, the most
popular clearing house for EAP-AKA based payments.

  However, GammaCoffee has found a way to make money without spending
much.
  They set their ESSID to "delta", and respond to EAP.

Farid> Is this a legal thing to do?  That is, having two overlapping
hotspots whose ESSID values are the same.  It seems that this will
create other problems ...!  But, let's go on with this assumption.

  As a supplicant, one could get a EAP Request from either one. Let's
say
that I get one from GammaCoffee's AP. It takes my request, goes back on
the
wireless, authenticates against arkohotspotproxy.com using radius.

Farid> Okay - here is my interpretation of the above paragraph:  the
GammaCoffee's AP takes the EAP-Response from the supplicant and puts
into an Access-Request and sends it arkohoptsportproxy.com (assuming
that there is a business relationship between the two).  After a few EAP
and EAP-over-RADIUS exchanges, the supplicant authenticates itself to
its home service network through GammaCoffee's AP and the
arkohotsportproxy.com (the intermediary proxy).

 Yes,
passing the packets to DeltaCoffee's AP, to which it has already
authenticated *itself* with.

Farid> Here you losing me!  Are we still talking about authentication
packets here?  Who is passing the packets to DeltaCoffee's AP?

  The supplicant and authenticator do their thing, and then the
supplicant
gets an IP address from GammaCoffee's AP. supplicant's packets are
NAT'ed by
Gamma, and sent to Delta (who NATs them again).

Farid> How do supplicant's IP packets get sent to Delta hotspot?  If it
double NATed, I assume that the packets are forwarded by some Access
Router within Gamma to Delta.  That means that there has to be some
business agreement between Gamma and Delta, otherwise Delta can simply
drop the packets.  

  The result:
      Gamma gets a revenue stream from arkohotspotproxy.com
      Delta pays for the bandwidth

  If the charges are based upon per-byte, then maybe Gamma has to pay
Delta
as much as it takes in. If they are based upon time, then Gamma wins. 
  (Best is if Gamma manages to steal a username/password along the way,
from some user that is willing to do username/password instead of
something
that is secure)

]       ON HUMILITY: to err is human. To moo, bovine.           |
firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net
architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device
driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security
guy"); [

  
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Michael Richardson <[email-masked]>
Date: Sun, 30 Nov 2003 16:23:01 -0500

-----BEGIN PGP SIGNED MESSAGE-----

    mcr>   However, GammaCoffee has found a way to make money without spending
    mcr> much.
    mcr>   They set their ESSID to "delta", and respond to EAP.

    Farid> Is this a legal thing to do?  That is, having two overlapping
    Farid> hotspots whose ESSID values are the same.  It seems that this will
    Farid> create other problems ...!  But, let's go on with this assumption.

  It is unlicensed space. Everything is legal, as long as you don't exceed
the transmit power. 
  Further, multiple APs on the same ESSID - well, that's how we arrange to
cover more space. This is a feature of 802.11.

  At this point, Farid's choice of non-Usenet anti-quoting loses me
completely, so he'll have to ask his question again.
	    (see http://www.lemis.com/email/fixing-outlook.html)

    Farid> Here you losing me!  Are we still talking about authentication
    Farid> packets here?  Who is passing the packets to DeltaCoffee's AP? 

  GammaCoffee's AP takes the packets from the client machine, NATs them,
and then *retransmits* them to Delta.

    Farid> How do supplicant's IP packets get sent to Delta hotspot?  If it
    Farid> double NATed, I assume that the packets are forwarded by some
    Farid> Access Router within Gamma to Delta.  That means that there has to
    Farid> be some business agreement between Gamma and Delta, otherwise
    Farid> Delta can simply drop the packets.  

  Delta thinks that Gamma is just another flat-rate customer.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap