Subject: [eap] Re: AUP

From: [email-masked] (Simon Barber)
Date: Fri, 27 Jun 2003 14:57:29 -0700

Under the 802.11 1999 standard the user can send the EAPoL-Start to the
AP before authentication or association.

(Data frames sent from a client to an AP - and not further on to the
distribution system are class 1 frames and can be sent at any time
including before association).

Does anyone have any idea how many clients and APs support this
correctly? Perhaps it should be added to the Wi-Fi tests.

Simon

-----Original Message-----
From: Bernard Aboba [mailto:[email-masked]]=20
Sent: Thursday, June 05, 2003 9:24 PM
To: [email-masked]
Subject: [eap] Re: AUP

> >a) Since the AUP needs to be displayed regardless of the=20
> >authentication scheme chosen (open, WEP, WPA, RSN), it seems like=20
> >this needs to occur prior to EAP authentication. In the December 2002

> >NIST review, we recommended addition of an Information Element in the

> >Beacon and Probe Response to handle this.
>
> Having done AUPs back at Chrysler in the mid-90s (and so I kick myself

> on this too), it takes much more than a flag.

I was thinking of an IE containing a string.
Example: "This is a private network;  if you are not authorized
DISCONNECT NOW".

The advantage of doing this in the Beacon or Probe Response is that the
AUP gets to be communicated *before* the user attempts authentication.
This is important because the act of attempted authentication itself can
be construed as an attempted breakin.

> >b) If it is desired to transmit a displayable message to the user,=20
> >the EAP-Request/Identity can be used for this purpose.
>
> This is how I see it. Either here or in the EAPoL-Start.  Here it=20
> provides more functionality; AUP is then provided to all applications=20
> of EAP.

Yes. With the limitation that the user may already have associated by
the time the message is delivered.

> Just some descriptive text about how to implement AUP in your EAP=20
> peers by its inclusion in the EAP-Req/Ident.

Yes. We need some additional text anyway (to document existing usage of
the EAP-Request/Identity field.  I'll submit an issue.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: [email-masked] (Bernard Aboba)
Date: Fri, 27 Jun 2003 20:57:13 -0700 (PDT)

> AP before authentication or association.

Yes, this would be a class 1 frame sent in state 1. The state machine
diagram talks about this being allowed.

However, elsewhere in 802.11-1999 I believe that it talks about use of
this with IBSS.  My understanding is that class 1 data
frames in state 1 are inconsistently supported today.  It is something
that might be worth a request for interpretation.