Subject: RE: Device ID and MitM attacks

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 6 Nov 2002 21:25:18 +0100

Any chance you could turn off HTML? thanks.

  How do you tie the IP address  to the L2 security credential ?
  Access Point (that verifes the L2 credential) need not be the
  same as the EP that verifies the DI.

=> Well, link layers that have point to point link
layer security (cellular) also have signalling 
from "APs" to "ARs" so that they can maintain 
this association. On an abstract sense, you're correct,
but in practice this situation does not exist
(i.e. p2p l2 encryption where the AR cannot bind 
the IP address to the source). 

Hesham

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Wed, 6 Nov 2002 12:44:24 -0800

>   same as the EP that verifies the DI.

In that case, DI should be the link-layer address of the PaC.
L2 security mechanism can ensure that the sender is authorized
to use the particular L2 address to get on the link. By the time
the packets are received by the L3 EP, they are already verified
for legitimate use of L2 address (no DI spoofing possible). 
Now this EP can do further enforcement, such as whether packets can 
get on the Internet, or tunneling them to specific ISP, etc.

alper