eap Mailing List: Re: [Issue 200] channel binding threats

[Bernard Aboba (aboba]

It seems to me that the "false SSID" attack brought up by Michael
Richardson as part of the "network selection" thread is another variation
on the "channel binding" attack that is discussed in Issue 200.  That is,
the AP advertises an SSID to the user, but presumably does not include
this SSID in the Called-Station-Id sent to the AAA server.

Can someone take a look at the proposed resolution of Issue 200 and
determine whether the issue is being adequately handled?  My understanding
is that including an exchange of SSIDs within the EAP method would allow
the station and AAA server to determine that the AP had launched this
attack.