Subject: [eap] Proposed Resolution to Issue 149: Reject

From: [email-masked] (Bernard Aboba)
Date: Thu, 10 Jul 2003 10:12:32 -0700 (PDT)

The text of Issue 149 (and subsequent discussion) is included below. Based
on discussion it would appear that there is no consensus for the change.
The recommendation is that the change advocated in Issue 149 be rejected.

-----------------------------------------------------
Issue 149: Peer Policy
Submitter name: John Vollbrecht
Submitter email address: [email-masked]
Date first submitted: June 16, 2003
Reference:
Document: EAP-04
Comment type: T
Priority: 2
Section: 7.8 Paragraph 2
Rationale/Explanation of issue:

Peers may include policy, especially when
connecting subnets.  Additionally the same identity may have different
permissions at different Access Points.

Requested change: In paragraph 2 make the following  2 changes noted in
quotes below -

Within or associated with each authenticator, it is not anticipated that a
particular named peer will support a choice of methods "for a given
connection". This would make the peer vulnerable to attacks that negotiate
the least secure method from among a set. Instead, for each named peer
there SHOULD be an indication of exactly one method used to authenticate
that peer name "at an access point". If a peer needs to make use of
different authentication methods under different circumstances, then
distinct identities SHOULD be employed, each of which identifies exactly
one authentication method.

[Jari Arkko]
Hmm... I don't have a warm and fuzzy feeling about this.
What if the attacker spoofs the name of the access point
to get the bidding down attack started?

[JRV]
This is where policy must be involved.  if the attacker AP bids up, the
authentication should go up.  If the attacker AP bids down, the
authentication and also the rights should go down.

Additional info may be involved, depending whether the AP is wireless or
wired.  Wireless may require Keys and a different authentication method
than wired.

I think the idea that there should be only one id for each authentication
method is too restrictive.  The same user should be able to get on in
different places, with different rights, using different authentication
methods.  The user could have different ids for each authentication method
and try to match the id to the access type, geographic location, etc. -
but this seems unlikely in practice.

[Jari Arkko]
I can see your argument.

But I'm still worried that without a specific model
for what policies are possible, there'll be bidding down
problems. For instance, the AP identity does not appear to be
a good source for the policy, but link type (wired/wireless)
might be slightly better.

So, I'd rather err on the safe side and not allow such
flexibility. The downside is that it might make things
hard for some cases. But I'm not sure how typical the
per-AP or per-link type credential policies are. Do
you have any information on that? Compared to the SSID
and other information presented by the authenticator?

---

From: [email-masked] (John Vollbrecht)
Date: Mon, 14 Jul 2003 10:36:03 -0400

I continue to think people will want to use the same id from different 
locations.  If they do then different authentication methods may be 
accepted at different locations, with different permissions.  I don't think 
we should require different ids for different locations even if the 
locations require different authentications.

I don't agree with dropping this without conversation.

John

--On Thursday, July 10, 2003 10:12 AM -0700 Bernard Aboba 
<[email-masked]> wrote:

> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap