Subject: RE: [eap] Re: comments on draft-groeting-eap-netselection-results -00.txt

From: Tschofenig Hannes <[email-masked]>
Date: Tue, 20 Jul 2004 18:51:40 +0200

hi bernard, 

i fully agree with you. 
the ssid is unstructured and the bssid has no meaning to the user. 
the introduction of the NAIRealms as an identifier is certainly useful.

ciao
hannes

> > since these identifiers are used for a few things (such as 
> > identification, authentication and authorization) you might want to 
> > have a more convient identifier which means something to an 
> end user. 
> > otherwise you could just use the hash of a public key and 
> truncate it 
> > to 48 bits. such an identifier would look ugly (for a user) 
> but would have some security properties.
> 
> The problem with hashes is that at some point the user may 
> want to know what they are connected to.  We've already 
> concluded that the SSID can be confusing;  does "linksys" 
> mean you are at home, or in a cafe within reach of a small 
> business that also purchased an AP from the same vendor?
> Displaying a hash to the user probably wouldn't help the 
> user, even though it might be quite useful to the machine.
> 
> That is I think one of the motivations behind the use of 
> NAIRealms as identifiers.  Because they are FQDNS, the 
> registration is handled by IANA and so some level of 
> uniqueness is provided.
> 
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Alper Yegin <[email-masked]>
Date: Tue, 20 Jul 2004 13:03:35 -0700

The usage of EAP the Extensible Authentication Protocol in
   IEEE 802.1x/IEEE 802.11i or also PANA never aimed to allow
   authentication of the access network to the end host.

I think what we really care is the authorization: Is this NAS authorized
to serve the client for network access service? AS should make this
determination, looking at the ID of the NAS and authenticating it as a
part of the RADIUS/Diameter exchange.

At the end of the full round of AAA, NAS has the blessing of the AS. By
the virtue of having the right crypto key (AAA-Key), it can prove that
to the client as well. 

Alper

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Mon, 26 Jul 2004 10:11:23 +0200

hi alper, 
 
you are certainly right with your comment that authorization is one of the
most important aspects. many flavors of network access never cared about the
authentication of the access network to the user. the reason for this is
historical and the de-facto keying framework does not offer this capability.

with a large number of networks, the lower trust between the visited and the
home network, the 'lying nas' problem and things like non-transparent cost
infrastructure it  is more important to learn the identity of the visited
network. in order to determine the identity  different approaches can be
chosen. the fact that the network is equipped with an identity is, as
discussed with bernard, also an important fact.

ciao
hannes

> -----Original Message-----
> From: Alper Yegin [mailto:[email-masked]] 
> Sent: Dienstag, 20. Juli 2004 22:04
> To: [email-masked]
> Subject: [eap] A comment on 
> draft-groeting-eap-netselection-results-00.txt
> 
> I think what we really care is the authorization: Is this NAS 
> authorized to serve the client for network access service? AS 
> should make this determination, looking at the ID of the NAS 
> and authenticating it as a part of the RADIUS/Diameter exchange.
> 
> At the end of the full round of AAA, NAS has the blessing of 
> the AS. By the virtue of having the right crypto key 
> (AAA-Key), it can prove that to the client as well. 
> 
> Alper
> 
>