Subject: RE: [eap] Re: comments on draft-groeting-eap-netselection-results -00.txt

From: Tschofenig Hannes <[email-masked]>
Date: Tue, 20 Jul 2004 18:34:15 +0200

hi bernard, 

i know that there is a problem when you use a non-unique identifier. 
with the goal of assigning certain properties or capabilities to a network
you might want to identify it somehow. 

as you said, you could use the pair <SSID + BSSID> for this purpose (or even
the bssid alone).

since these identifiers are used for a few things (such as identification,
authentication and authorization) you might want to have a more convient
identifier which means something to an end user. otherwise you could just
use the hash of a public key and truncate it to 48 bits. such an identifier
would look ugly (for a user) but would have some security properties. 

ciao
hannes

> -----Original Message-----
> From: Bernard Aboba [mailto:[email-masked]] 
> Sent: Tuesday, July 20, 2004 6:17 PM
> To: Tschofenig Hannes
> Cc: [email-masked]
> Subject: RE: [eap] Re: comments on 
> draft-groeting-eap-netselection-results -00.txt
> 
> > even automatic processing might be complicated if you have 
> to carry a 
> > 10mb file of <SSID + BSSID> identifiers and their services with you.
> > this also requires that you register your <SSID + BSSID> identifier 
> > pair somewhere.
> >
> > what do you think?
> 
> The SSID is a non-unique identifier.  This will affect all 
> schemes that attempt to use the SSID as an identifier of a 
> network configuration.
> It does not matter whether the schemes are dynamic or static.
> 
> In particular, there are SSIDs that ship by default on APs.  
> For those "default" SSIDs, the SSID isn't just a non-unique 
> identifier with *some* potential for duplication;  
> duplication is the intent, making the SSID meaningless for 
> network identification.  One potential mechanism for 
> dis-ambiguating "default" SSIDs is to use the BSSID ot 
> distinguish them.
> However, the implicit assumption here is that "default" SSIDs 
> are not used in large networks, but rather in situations 
> where only a small number (usually one) AP is deployed.  Thus 
> the SSID + BSSID combination may uniquely identify a single 
> AP network.
> 
> If this assumption does not hold, a host of problems arise.  
> But these problems will also afflict dynamic as well as 
> static techniques that rely on the SSID as a means of network 
> identification.
> 
> The solution to this problem is probably to utilize another 
> mechanism with guaranteed uniqueness to identify WLAN 
> networks.  However, given that the problem is fundamental to 
> 802.11, it seems likely that 802.11 will wish to become 
> involved in the solution.  The recent "straw poll" indicating 
> a desire to standardize Network Selection within 802.11 is a 
> likely indication of this.
> 
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 20 Jul 2004 09:41:09 -0700 (PDT)

> would look ugly (for a user) but would have some security properties.

The problem with hashes is that at some point the user may want to know
what they are connected to.  We've already concluded that the SSID can be
confusing;  does "linksys" mean you are at home, or in a cafe within reach
of a small business that also purchased an AP from the same vendor?
Displaying a hash to the user probably wouldn't help the user, even though
it might be quite useful to the machine.

That is I think one of the motivations behind the use of NAIRealms as
identifiers.  Because they are FQDNS, the registration is handled by IANA
and so some level of uniqueness is provided.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap