Subject: RE: The Emperor Has No Clothes: Is PANA actually useful?

From: "Narayanan, Vidya" <[email-masked]>
Date: Fri, 26 May 2006 11:05:12 -0700

> 
> >>>>> "Bernard" == Bernard Aboba <[email-masked]> writes:
> 
>     >> My question is more why do they need EAP in situations where
>     >> they are not running at the link layer than why do they want or
>     >> not want PANA.
> 
>     Bernard> The simple answer is that there are situations which IEEE
>     Bernard> 802.1X cannot handle on wired networks.  As specified,
>     Bernard> IEEE 802.1X is "network port control", which means that
>     Bernard> authorization is controllable only at the port level.  If
>     Bernard> there is more than one host connected to a switch port,
>     Bernard> then that model no longer applies.
> 
> Yeah.  I guess I wonder whether you are actually getting 
> network access authenticatino at that point or whether you 
> are getting a service that allows you to check posture.  It 
> seems that a service that simply allows you to check posture 
> should be not EAP.
> 

I fully agree. As far as I can tell, using EAP in this manner merely
reduces it to a posture transport protocol. The level of security
provided by EAPoUDP does not seem to be any greater than a
kerberos-based authentication done today in most enterprise networks,
considering the presence of switched ethernet. Hence, the only reason to
move to EAPoUDP would be to check posture and I agree with Sam that
making EAP the posture transport protocol is a bad idea. 

Vidya

> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ietf
> 

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Sam Hartman <[email-masked]>
Date: Fri, 26 May 2006 17:23:24 -0400

>>>>> "Narayanan," == Narayanan, Vidya <[email-masked]> writes:
    Narayanan,> I fully agree. As far as I can tell, using EAP in this
    Narayanan,> manner merely reduces it to a posture transport
    Narayanan,> protocol. The level of security provided by EAPoUDP
    Narayanan,> does not seem to be any greater than a kerberos-based
    Narayanan,> authentication done today in most enterprise networks,
    Narayanan,> considering the presence of switched ethernet. Hence,
    Narayanan,> the only reason to move to EAPoUDP would be to check
    Narayanan,> posture and I agree with Sam that making EAP the
    Narayanan,> posture transport protocol is a bad idea.

Hey!
Speaking as MIT's manager for Kerberos, I'm insulted:-)

We certainly recommend and the Kerberos protocols I'm aware of almost
all support using Kerberos to actually key integrity protection or
confidentiality.  Use in enterprise networks for LDAP, SMTP, file
sharing all support and use binding of integrity or confidentiality.

We strongly discourage the use of Kerberos without integrity bound to
the authentication.

There are a number of cases where Kerberos is used in a manner similar
to radius/diameter, but that's really more for convenience to have
your passwords in one place than because you're making good use of
Kerberos.  You're not making bad use of Kerberos per se, but you
certainly could be providing a lot better security.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 26 May 2006 21:02:06 -0400

> certainly could be providing a lot better security.

I prefer not to ever describe those use cases as "using Kerberos for 
authentication".  It's really using passwords for authentication, where 
password verification happens to be done by obtaining and validating a 
Kerberos ticket, instead of by computing a hash a la unix passwd, or 
looking them up in an LDAP database.

That form of authentication provides a limited level of security, and it 
doesn't provide keying material for IPsec or link-layer security.  Using 
EAP over UDP with passwords (I admit, I can't remember if a password-based 
EAP mechanism even exists) doesn't provide much more.

However, there are two distinct advantages to be gained by running some 
form of EAP over UDP instead of the current usurp-HTTP techniques that are 
so widely deployed.  The first is the existance of a standard means of 
authentication, which means my workstation can prompt me for the username 
and password needed to access the network.  Compare that to the current 
model, where I get an environment in which a bunch of things are broken 
because the system thinks I have network connectivity when I really don't, 
and then have to start up a web browser and navigate some broken 
authentication UI that's different for every network I connect to.

The second advantage is that it provides a clear path to replacing 
password-based authentication with _real_ Kerberos, or whatever else people 
have deployed.  From where I sit, that's pretty compelling.

BTW, Carnegie Mellon has a single campus-wide 802.11 wireless network.  The 
access points are completely open, and access to the network is controlled 
by a combination of pre-registration and authentication via a web page. 
The mechanism used to actually restrict access to the network is filter 
between the wireless subnet and the rest of the campus network, which 
passes only traffic form authorized MAC addresses or to specific services 
used in the process of authentication and network registration.  In that 
model (which, I admit, has its flaws), the ability to handle authentication 
for network access using protocols that run on IP is extremely valuable.

-- Jeff