Subject: Re: [arch-d] Network security services: fundamentally broken

From: <[email-masked]>
Date: Fri, 4 Feb 2022 10:05:18 -0000

There is no eduroam identifier. The username component of the NAI (username@realm) has null semantics and is ignored by all parts of the system. The realm component is used for routing.

Best practice is to configure a username value of “@realm”. That’s because the NAI is transmitted in cleartext within the EAP-Identity/Response packet along the entire path, and not just the initial wireless segment, even with a WPA2/3 protected network. This is true for any 802.1X-authenticated network, not just eduroam.

(An identity provider can choose to return a persistent, targeted pseudonym identifying the user to the service provider; but this isn’t widely implemented).

From: Architecture-discuss <[email-masked]> On Behalf Of Henning Schulzrinne
Sent: 28 January 2022 22:36
To: Brian E Carpenter <[email-masked]>
Cc: [email-masked]
Subject: Re: [arch-d] Network security services: fundamentally broken

This is only peripherally related, but there seems to be a group of (east coast?) universities that all use xyNN@university as their default email. Mine is [email-masked] <mailto:[email-masked]> .

On Fri, Jan 28, 2022 at 3:10 PM Brian E Carpenter <[email-masked] <mailto:[email-masked]> > wrote:

Tom,

> The identifier for Eduroam is this <identifier>@<domain name of university> the e-mail address is typically jane.doe@ <mailto:jane.doe@%3cdomain> <domain name of university>.

In all the cases that I know, jane.doe@ <mailto:jane.doe@%3cdomain> <domain name of university> is just an alias for <identifier>@<domain name of university>. The <identifier> isn't particularly secret, either.

Regards
    Brian