Subject: Re: [homenet] [Int-area] Evaluate impact of MAC address randomization to IP applications

From: Michael Richardson <[email-masked]>
Date: Tue, 22 Sep 2020 16:34:33 -0400

This thread was started today on the INTAREA WG ML.

While I don't object to a BOF, I don't know where it goes.
What I see is that much of this problem needs to be resolved through 
increased use of 802.1X: making WPA-Enterprise easier to use and setup, 
this changing core identity from MAC Address to IDevID.

My understanding is that Apple intends to randomize MAC every 12 hours, 
even on the same "LAN" (ESSID), and that they will just repeat the WPA 
authentication afterwards to get back on the network.   If the 
per-device unique policy (including CAPPORT authorization) can be tied 
to the device better, than the MAC address based "physical" exception 
can be updated.

But, WPA-PSK doesn't work, because it does not, in general, distinguish 
between different devices.

It can be made to work if every device is given a unique PSK, and there 
are some successful experiments doing exactly that.  Mostly it just 
works, but the challenge is communicating the unique PSK through an 
unreliable human.
BRSKI can certainly do this, and it can leverage that unencrypted ESSID 
present at most hospitality locations to get onto the encrypted 
WPA-Enterprise.  Or BRSKI-TEEP, or some other BRSKI-EAP method.  The 
unencrypted SSID is not going away at those locations.

Thus QR-code based methods are best, yet those do not work for many IoT 
devices.   EMU's EAP-NOOB can help in certain cases, but we, as a 
community need be clear on what direction we want to go.  One answer is 
that IoT devices have little reason to randomize their MAC if they are 
not generally ported.

On 2020-09-22 3:49 p.m., Lee, Yiu wrote:
> Hi team,
> 
> We proposed a BoF. The agenda is in 
> https://github.com/jlivingood/IETF109BoF/blob/master/109-Agenda.md and 
> the proposal is in 
> https://github.com/jlivingood/IETF109BoF/blob/master/BoF-Proposal-20200918.md. 
> You can also find the draft here 
> https://tools.ietf.org/html/draft-lee-randomized-macaddr-ps-01.
> 
> At this stage, we are looking for inputs for more use cases and 
> interests of working together in this domain. Please post your comments 
> in the mailing list.
> 
> Thanks
>

---

From: "Lee, Yiu" <[email-masked]>
Date: Tue, 22 Sep 2020 21:23:53 +0000

Hi Michael,

Thanks for the notes. At this stage, our #1 objective is to document the use cases that may broke and propose best practice to transition to dynamic mac-address. We don't have the full picture of the impact. We think IETF is a good platform to gather more information.

Thanks,
Yiu

On 9/22/20, 4:34 PM, "Int-area on behalf of Michael Richardson" <[email-masked] on behalf of [email-masked]> wrote:

    On 2020-09-22 3:49 p.m., Lee, Yiu wrote:
    > https://urldefense.com/v3/__https://github.com/jlivingood/IETF109BoF/blob/master/109-Agenda.md__;!!CQl3mcHX2A!Q_PTTc2RNhOPB-gus0u3ooXdg-Iikb-pUUpLp51UR3uOG41s6to-KpgWZ_LjWDQ$  and
    > the proposal is in
    > https://urldefense.com/v3/__https://github.com/jlivingood/IETF109BoF/blob/master/BoF-Proposal-20200918.md__;!!CQl3mcHX2A!Q_PTTc2RNhOPB-gus0u3ooXdg-Iikb-pUUpLp51UR3uOG41s6to-KpgWZbxZn_w$ .
    > https://urldefense.com/v3/__https://tools.ietf.org/html/draft-lee-randomized-macaddr-ps-01__;!!CQl3mcHX2A!Q_PTTc2RNhOPB-gus0u3ooXdg-Iikb-pUUpLp51UR3uOG41s6to-KpgWBEXWl54$ .
    >

    _______________________________________________
    Int-area mailing list
    [email-masked]
    https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/int-area__;!!CQl3mcHX2A!Q_PTTc2RNhOPB-gus0u3ooXdg-Iikb-pUUpLp51UR3uOG41s6to-KpgW20rPBDw$

---

From: "Ralf Weber" <[email-masked]>
Date: Wed, 23 Sep 2020 07:26:50 +0200

Moin!

On 22 Sep 2020, at 22:34, Michael Richardson wrote:

> increased use of 802.1X: making WPA-Enterprise easier to use and 
> setup, this changing core identity from MAC Address to IDevID.
>
> My understanding is that Apple intends to randomize MAC every 12 
> hours, even on the same "LAN" (ESSID), and that they will just repeat 
> the WPA authentication afterwards to get back on the network.
I of course don’t know Apples intentions, but what you are describing 
is the behaviour of early iOS 14 beta versions. However this behaviour 
has changed in later beta versions and the released iOS 14.0 version to 
have a random Mac per ESSID and not change that over the lifetime of the 
device (at least no so far on my devices at home), which I think is more 
in line what the rest of the industry does.

So long
-Ralf
——-
Ralf Weber

---

From: Michael Richardson <[email-masked]>
Date: Wed, 23 Sep 2020 08:32:30 -0400

Ralf Weber <[email-masked]> wrote:
    >> authentication afterwards to get back on the network.

    > I of course don’t know Apples intentions, but what you are describing is the
    > behaviour of early iOS 14 beta versions. However this behaviour has changed
    > in later beta versions and the released iOS 14.0 version to have a random Mac
    > per ESSID and not change that over the lifetime of the device (at least no so
    > far on my devices at home), which I think is more in line what the rest of
    > the industry does.

That's interesting news.
Why did they try something different in the beta?  Maybe they thought that
the industry was ready for this, but were wrong?
I heard about this change from Tiru Reddy.

It would be great if this BOF elicited public statements and/or public policies about
Google and Apple's intentions in this space.  If it's their goal to go in the
direction I outlined, then it would be good to know.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide