Subject: RE: [eap] PANA and EAP keying framework

From: "Walker, Jesse" <[email-masked]>
Date: Tue, 10 Jan 2006 13:42:38 -0800

Yoshihiro,

> On Tue, Jan 10, 2006 at 12:59:33PM -0800, Walker, Jesse wrote:
> > There are numerous places, but you can start with clause 5.9.2.1,
which
> > gives an expository overview of the process.
> 
> This partially answers to my questions, but I think the 802.11i
> specification is vague about the behavior you mentioned.
> 
> For example, in the following text in clause 5.9.2.1:
> 
> "
> Upon successful completion of the 4-Way Handshake, the Authenticator
> and Supplicant have authenticated each other; and the IEEE 802.1X
> Controlled Ports are unblocked to permit general data traffic.
> "
> 
> - What is the definition of "general data traffic"?
[Walker, Jesse] General data traffic are MSDUs received through the
UNITDATA.request interface that have an Ethertype different from 802.1X.
> 
> - The above text does not say anything about whether any data frame
> other than 802.1X messages is not allowed to pass through uncontrolled
> port.
[Walker, Jesse] You can find the answer reading 802.1X Clause 8. The
answer is no. All data traffic passes through the control port. The
uncontrolled port passes only frames of Ethertype 802.1X.

> 
> Yoshihiro Ohba
> 
> >
> > > -----Original Message-----
> > > From: Yoshihiro Ohba [mailto:[email-masked]]
> > > Sent: Tuesday, January 10, 2006 12:47 PM
> > > To: Walker, Jesse
> > > Cc: Yoshihiro Ohba; Bernard Aboba; [email-masked]
> > > Subject: Re: [eap] PANA and EAP keying framework
> > >
> > > Jesse,
> > >
> > > On Tue, Jan 10, 2006 at 12:30:58PM -0800, Walker, Jesse wrote:
> > > > Yoshihiro
> > > >
> > > > > I don't think 802.11i prohibits any IP traffic to pass throuth
> > > > > uncontrolled port before 4-way handshake.  In fact, there is a
> > > > > description in section 5.4.2.2 of IEEE 802.11i 2004
specification:
> > > > [Walker, Jesse] This is not true. 802.1X frames are the only
type of
> > > > data 802.11i allows to pass over the link prior to key
confirmation.
> > IP
> > > > traffic is not encapsulated with the 802.1X Ethertype, so is
> > expressly
> > > > blocked.
> > >
> > > Can you point out which text in the 802.11i specification states
this
> > > specific behavior?  How can we interpret the quoted text in
section
> > > 5.4.2.2?
> > >
> > > In any case, another way is to use multiple (virtual) APs, one
> > > operating in 'open' authentication running PANA and the other
> > > operating in 802.11i, and switching from the former AP to the
latter
> > > after PANA authentication.
> > >
> > > Regards,
> > > Yoshihiro Ohba
> >
> >
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 10 Jan 2006 18:24:21 -0500

Jesse,

> UNITDATA.request interface that have an Ethertype different from 802.1X.

(This should have been clearly stated in the specification.)

> uncontrolled port passes only frames of Ethertype 802.1X.

I read clause 8 of 802.1aa-D6.1 (sorry, I don't have the latest 802.1X
draft standard), but I was not able to find the description on the
behavior you answered.  I rather found the following text in clause
6.4 of 802.1aa-D6.1:

"
It is expected that most protocol exchanges conducted by other
functions of the System will make use of one or more of the System's
controlled Ports. However, a given protocol may need to bypass the
authorization function and make use of the uncontrolled Port. 
"

I also found several descriptions in Appendix C of 802.1aa-D6.1 on
allowing DHCP traffic to be forwarded to unauthenticated VLAN after
authentication failure.  Isn't the DHCP traffic in this case passing
throuth the uncontrolled port?

Regards,
Yoshihiro Ohba