Subject: Re: [Emu] Channel Binding Discussion at IETF 77

From: Stefan Winter <[email-masked]>
Date: Mon, 16 Aug 2010 09:50:52 +0200

Hi,

>    Agreed.  However, SSIDs are *likely* to be unique within a roamin
> consortium.  This is because the parties talk to each other, and can
> complain when the SSIDs are unknown, or re-used.

Umm. We use the SSID eduroam wherever possible for brand recognition, 
but even we have to deviate from that at times. The big reason being: 
two hotspots have overlapping coverage, and client devices get confused 
when the same SSID has different IP subnets. Proprietary extensions 
(Cisco controllers and LWAPP most notably) can be a way around this, but 
generally, "eduroam-$FOO" can show up at places, with arbitrary values 
for $FOO. Other reqasons also exist; but I won't bother you with them here.

I don't think we are unique with these sorts of considerations; and I 
don't think it's safe to assume that everybody knows all SSIDs 
throughout a consortium.

Greetings,

Stefan Winter

>> Assuming that the SSID is actually in the Called-Station-ID Attribute (see
>> above) and that the NAS didn't just lie in the RADIUS message, too (given
>> that there is no way to detect such a lie in a>1 hop AAA scenario) and that
>> there is no collusion between X&  Z.  We seem to be assuming a _lot_ of
>> honesty from our thieves.
>    Yes.
>
>    There are mitigating circumstances.  AAA relationships leverage trust.
>   Continued trust depends on the parties continuing to meet expectations.
>   Lying about SSIDs violates trust.
>
>    Alan DeKok.
> _______________________________________________
> Emu mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/emu

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

---

From: Stefan Winter <[email-masked]>
Date: Mon, 16 Aug 2010 09:54:50 +0200

Hi,

>    3580 says Called-Station-Id SHOULD include the SSID.  Most APs do
> include the SSID.

s/Most/Some

There's a painful variety in what comes inside Calling-Station-Id, which 
is *very* unfortunate. A set of RADIUS attributes to convey things like 
the SSID in a proper place would be very handy (IEEE 802.11 attributes 
draft in radext!).
And a FIXED syntax about MAC addresses in Calling-Station-Id, too. The 
"SHOULD" canonical form that you both quoted isn't honoured by many.

Greetings,

Stefan Winter

>>>    However, SSIDs are *likely* to be unique within a roamin
>> What parties?  The BSSs?  Why?
>    The parties in a roaming consortium talk to each other.
>
>> But fraud doesn't?
>    Yes, fraud violates trust.  My original post included an example of
> fraud, stated why this was bad, and how channel bindings could help.
>
>    Alan DeKok.

Tel: +352 424409 1
Fax: +352 422473