Subject: [eap] Re: AUP

From: [email-masked] (Bernard Aboba)
Date: Thu, 5 Jun 2003 21:23:43 -0700 (PDT)

> >a) Since the AUP needs to be displayed regardless of the authentication
> >scheme chosen (open, WEP, WPA, RSN), it seems like this needs to occur
> >prior to EAP authentication. In the December 2002 NIST review, we
> >recommended addition of an Information Element in the Beacon and Probe
> >Response to handle this.
>
> Having done AUPs back at Chrysler in the mid-90s (and so I kick myself on
> this too), it takes much more than a flag.

I was thinking of an IE containing a string.
Example: "This is a private network;  if you are not authorized DISCONNECT
NOW".

The advantage of doing this in the Beacon or Probe Response is that the
AUP gets to be communicated *before* the user attempts authentication.
This is important because the act of attempted authentication itself can
be construed as an attempted breakin.

> >b) If it is desired to transmit a displayable message to the user, the
> >EAP-Request/Identity can be used for this purpose.
>
> This is how I see it. Either here or in the EAPoL-Start.  Here it provides
> more functionality; AUP is then provided to all applications of EAP.

Yes. With the limitation that the user may already have associated by the
time the message is delivered.

> Just some descriptive text about how to implement AUP in your EAP peers by
> its inclusion in the EAP-Req/Ident.

Yes. We need some additional text anyway (to document existing usage of
the EAP-Request/Identity field.  I'll submit an issue.