Subject: Re: [saag] PILC IETF-51 discussion on LINK Security Considerations

From: [email-masked]
Date: Sun, 19 Aug 2001 16:38:51 -0400 (EDT)

Isn't 802.1x also applicable (to the extent that any of that stuff is)?

/ji

---

From: Bernard Aboba <[email-masked]>
Date: Sun, 19 Aug 2001 14:35:11 -0700 (PDT)

> Isn't 802.1x also applicable (to the extent that any of that stuff is)?

Before improved authentication and key management would help, there
is some basic infrastructure that needs to be put in place first:

a) per-session keys (most current 802.11 Access Points can't handle
   per-session keying, only per-enterprise keys)

b) a keyed MIC, so that you can support per-packet authentication, avoid
   hijacking  and tie the derived session key to subsequent packets.

c) a credible cipher (e.g. not WEP)

Unfortunately, current 802.11b chipsets are so inflexible and typical
AP processors are so slow that it is very difficult to deliver this on
legacy APs. So I think it is more likely that we will need new chipsets
(and new faster AP processors) before anything defensible emerges.

For example, the Intersil Prism II chipset sends the frame as soon as it
is encrypted so the best that can be done is to calculcate the MIC prior
to encryption, not after. Even this is hard because there are so few
cycles available on a typical AP processor that even UMAC may  be
infeasible.