Subject: [eap] Re: draft-walker-ieee802-req-00.txt

From: Bernard Aboba <[email-masked]>
Date: Sun, 8 Feb 2004 11:30:35 -0800 (PST)

> [3]  Synchronization of state.  This corresponds to the "Protected
>      result indication" security claim defined in [RFC2284bis], Section
>      7.2.1.
>
> why is this suddenly a MUST requirement?

IEEE 802.11 has lower layer retransmission (ACK),  lower layer indications
(Deauthenticate, Disassociate) and a 4-way handshake.  These facilities
decrease packet loss, and help with state synchronization.  So from the
point of view of accidental lack of synchronization, I think that we are
well covered.

The one issue that IEEE 802.11 does have is additional vulnerability to
EAP attacks due to support for pre-authentication.  This means that a
Failure or Success packet can be spoofed from a distance.  Given that this
is an optional feature, I don't think that the risk is sufficient to make
Protected Result Indications a MUST.  Maybe a SHOULD or MAY would be more
appropriate.

Note that in a technology without retransmission, lower layer indications
or a 4-way handshake this might be a greater concern.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap