Subject: RE: Comments on draft-ietf-dhc-aaa-ra-00.txt

From: George Tsirtsis <[email-masked]>
Date: Thu, 8 Feb 2001 19:19:17 -0500

-----Original Message-----
From: Erik Nordmark [mailto:[email-masked]]
Sent: Wednesday, February 07, 2001 11:50 AM
To: George Tsirtsis
Cc: [email-masked]'; DHCPv4 discussion list; Erik
Nordmark; [email-masked]
Subject: RE: Comments on draft-ietf-dhc-aaa-ra-00.txt

> GT> Lets get this straight. If AAA is triggered at the DHCP RA as I
suggest
> then an attacker would have to spoof IP AND MAC addresses...which I think
is
> a bit harder....Furthermore, unless we get per packet/frame authentication
> anything can be spoofed...so while DHCP is not an access control mechanism
> today, it can certainly be made to be...

802.1X does per-port access control (great for switched Ethernets)
and has some laguage (which I don't quite understand) about tying the access
control to 802.11 per-station encryption with per-station keys.
[The reason I don't quite understand it is because I thought 802.11 was
using a single shared key for all the stations.]

Thus 802.1X is an existence proof of an access control mechanism
that is more fine grained than what you could ever do at L3 whether
in a DHCP relay or somewhere else.

GT> And I agree with you ...the counter argument of course is that you can
not make a 802.X protocol work in non-802 link layers and so the  potential
need for a L3 mechanism. I do not think we disagree, do we?

George

---

From: Erik Nordmark <[email-masked]>
Date: Sun, 11 Feb 2001 18:36:51 +0100 (CET)

> need for a L3 mechanism. I do not think we disagree, do we?

I think we sort of disagree.
My point is that any L3 mechanism will always provide weaker enforcement
of access control. Thus if there is a critical link layer that doesn't have
L2 support for this, it would seem prudent to add the access control at
the link layer.

Given that PPP, 802, and the various cellular radio protocols presumably
already have this, what other link layers do people worry about?

  Erik