Subject: Re: SEND with link-layer security

From: <[email-masked]>
Date: Mon, 1 Dec 2003 13:45:51 +0200

> I believe that there are significant issues if we do not eventually work on
> ways to bind link layer security (1x) and network layer security (SEND).

I agree.

But first some background on this issue. I think Michael
is thinking about this based on the discussions we have had in
the EAP mailing list. Michael presented an attack where someone
offers WLAN access to clients. This offer is legitimate in the
sense that this someone has a contract with a roaming group. But
he is not providing the full service by himself. He simply
attracks the customers, NATs their traffic, and sends it off
to another WLAN service provider using his own flat fee
account. The attacker then collects the roaming fees for a
number of users, but leaves all bandwidth cost to the
other provider.

Anyway, one proposal is that if L2 security would provide
the certs for SEND RAs, then we would have a tighter
binding between what is happening at L2 and L3. Then
an attempt to provide L3 services from someone else
would be detected. However, we are still discussing
whether this works. It would not prevent NATting,
for instance, so it doesn't seem to fix the original
attack.

Anyway, I personally believe something like this
will eventually be needed. So we should work on it...
but I fear that it might take some time before we
figure out what to do here. Maybe even IETF-IEEE
etc discussions. (And it should not hold up SEND.)

--Jari

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: "James Kempf" <[email-masked]>
Date: Mon, 1 Dec 2003 12:58:41 -0800

> number of users, but leaves all bandwidth cost to the

I'm not sure I understand the attack. How would the other WLAN provider have
to bear the bandwidth cost unless their AP was utilized? It sounds here like
you are saying that the rogue has its own APs, right? If that is so, where
is the problem with the bandwidth cost going to the other provider?

> for instance, so it doesn't seem to fix the original

Certs with L2 info on the router would allow this.

> etc discussions. (And it should not hold up SEND.)

Yes.

       jak

---

From: Jari Arkko <[email-masked]>
Date: Mon, 01 Dec 2003 23:42:54 +0200

> is the problem with the bandwidth cost going to the other provider?

The rogue provider has a node with two wireless
interfaces: one to attrack clients, and another
one to connect to the real provider's AP. The
rogue provider has to pay for his node and the
flat fee account, but the real provider pays all
costs related to Internet connectivity.

This would not fly as a business if you had to
deploy the rogue nodes. But folks might put the
required software in their laptops that they carry
around anyway. This would also not fly if the
cost of flat fee accounts is higher than what
you can get as roaming fees.

Anyway, we discussed this a bit further on the
EAP WG mailing list and agreed with Michael that
we need L2 to authenticate advertised access
point properties, such as the SSID. (This currently
*not* done.) We would also like to get a binding between
L2 and L3, to ensure that the L3 services are provided
by the same entity that we authenticated to. However,
there are limits to what these two measures can achieve.
The SSID authentication is useless if the user is
not paying attention to the identifier, and the L3
service binding does not prevent someone from NATting
the results to another L3 service.

--Jari

---

From: Michael Richardson <[email-masked]>
Date: Mon, 01 Dec 2003 16:52:43 -0500

>>>>> "James" == James Kempf <[email-masked]> writes:
    James> I'm not sure I understand the attack. How would the other WLAN
    James> provider have to bear the bandwidth cost unless their AP was
    James> utilized? It sounds here like you are saying that the rogue has
    James> its own APs, right? If that is so, where is the problem with the
    James> bandwidth cost going to the other provider?

http://mail.frascone.com/pipermail/eap/2003-November/001936.html

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------