eap Mailing List: RE: Re: comments on draft-groeting-eap-netselection-results -00.txt

[Bernard Aboba (aboba]

> since these identifiers are used for a few things (such as identification,
> authentication and authorization) you might want to have a more convient
> identifier which means something to an end user. otherwise you could just
> use the hash of a public key and truncate it to 48 bits. such an identifier
> would look ugly (for a user) but would have some security properties.

The problem with hashes is that at some point the user may want to know
what they are connected to.  We've already concluded that the SSID can be
confusing;  does "linksys" mean you are at home, or in a cafe within reach
of a small business that also purchased an AP from the same vendor?
Displaying a hash to the user probably wouldn't help the user, even though
it might be quite useful to the machine.

That is I think one of the motivations behind the use of NAIRealms as
identifiers.  Because they are FQDNS, the registration is handled by IANA
and so some level of uniqueness is provided.