Subject: RE: Comments on draft-ietf-dhc-aaa-ra-00.txt

From: George Tsirtsis <[email-masked]>
Date: Mon, 5 Feb 2001 11:39:11 -0500

Hi Bernard,

I just had a look at draft-congdon-radius-8021x-09.txt and I think I know
understand your comments in relation to the relevance to this proposal.

The congdon draft provides a vehicle for authenticating nodes that use 802
types of  link layers. Even if we assume the above L2 approach satisfies the
urp requirements of these layers, what should we do about the non-802 L2s?

-One approach is to say that L2s are either shared in which case probably
802 based or point to point in which case PPP should be used. I would
disagree with both of the above assumptions.
-Another approach would say that non-802 L2s should also have their own
'congdon' like authentication mechanisms, which I think would be difficult
and is at least as difficult with the idea of having per L3 authentication
mechanisms
-Alternatively, a L3 mechanism may need to be invented that can run over any
L2 and ensure authentication per L3...as you suggest below IPCP and IPCPv6
like...which is I think what I support.

Regards
George
P.S.: note that whether the L3 authentication mechanisms should ride on DHCP
messages or not is beside the point here...my related proposal was born in
isolation to BURP, trying to solve a specific engineering problem. If we
find a generic protocol to do this I am happy to drop the DHCP
proposal....but not just yet :-)
-----Original Message-----
From: Bernard Aboba [mailto:[email-masked]]
Sent: Saturday, February 03, 2001 8:08 AM
To: Erik Nordmark; Subir Das
Cc: DHCPv4 discussion list; [email-masked]
Subject: RE: Comments on draft-ietf-dhc-aaa-ra-00.txt

>I understand the above.
>But, in order for access control to be affective, doesn't access control
>have to be implemented at L2 (or L1)?

If access control is done at L3, then you would presumably need
access control within every L3 protocol, or risk attack on the protocols
for which there was no access control. Whereas if you did access control
at L2 then it would apply to all L3 protocols.

Also, one needs to be clear about *what* is being controlled -- in
L2 access control, it is typically access to the port. Whereas with
L3 access control, it is typically access by the host. The latter
implies more state kept on the NAS.

These would be strong arguments for L2 in a traditional multi-protocol
environment (IPv4, AppleTalk, DECNET, IPX, NetBEUI, SNA, etc.) where
device cost is an important concern.

However, in an all-IP network (IPv4, IPv6), where devices can be
much more capable than they were in the 90s, I'm not clear that the
argument remains compelling. One can think of access control at each L3 as
somewhat akin to negotiating both IPCP and IPv6CP within PPP.

So the question that comes to mind is "what advantages does one
gain by this approach?" For example, can access control be done better
at L3 than at L2 due to facilities existing in IP or TCP? (e.g.
fragmentation,
reliable transport, etc.) And are any important L2 facilities lost as
a result? (L2 negotiations)

>Otherwise an unauthenticated entity can just spoof its IP address to be
that
>of an already authenticated entity and gain access.

That's why authenticated DHCP isn't an access control mechanism ;) But
the need to link BURP to DHCP is far from clear.

---

From: "Bernard Aboba" <[email-masked]>
Date: Mon, 5 Feb 2001 12:21:55 -0800

>One approach is to say that L2s are either shared in which case probably

Just curious about the problem space. Are we talking about access
control for L2s like ATM, Frame Relay, or wireless WAN? 

Note that with 802.11 and Ethernet over DSL, 802 is being used as the
link layer for wireless LANs and xDSL. 

I'm also curious as to the type of access control that you want. 
Is it per-station access control? Per port access control? For
example, on a shared medium do *all* hosts need to authenticate?
Or is the medium assumed to be point to point?