Subject: [eap] EAP 2284bis last call issues

From: [email-masked] (John Vollbrecht)
Date: Tue, 17 Jun 2003 15:16:40 -0400

some notes below -

--On Tuesday, June 17, 2003 6:17 PM +0300 Jari Arkko <[email-masked]> 
wrote:

> John Vollbrecht wrote:
>
> > I think the idea that there should be only one id for each
> > authentication method is too restrictive.  The same user should be able
> > to get on in different places, with different rights, using different
> > authentication methods.  The user could have different ids for each
> > authentication method and try to match the id to the access type,
> > geographic location, etc. - but this seems unlikely in practice.
>
> I can see your argument.
>
> But I'm still worried that without a specific model
> for what policies are possible, there'll be bidding down
> problems. For instance, the AP identity does not appear to be
> a good source for the policy, but link type (wired/wireless)
> might be slightly better.
>
> So, I'd rather err on the safe side and not allow such
> flexibility. The downside is that it might make things
> hard for some cases. But I'm not sure how typical the
> per-AP or per-link type credential policies are. Do
> you have any information on that? Compared to the SSID
> and other information presented by the authenticator?
>
I think there can be specific models and policies.  Creating a draft that 
does not allow them seems to be a problem.  For example, while an attacking 
AP may claim to be someone else, it won't be able to authenticate as 
someone else.  If , for example, the AP claims to be X but can't prove it, 
then there is no connection.  A claim that a peer may choose only one 
method seems reasonable, but that it must always be the same seems not so 
reasonable.

In this case the user my have two identities.  Depending on who the AP is 
it may used a selected identity.  If it chooses based on the AP id, then it 
is no different than policy, and the AP can try to negotiate down.

What I hear is that people would like to be able to use the same identity 
to authenticate from multiple places - e.g. from a wireless location, from 
a dialup location, from a hot spot, from a visitor lounge, from their desk. 
Seems reasonable to me - am I missing something?

John