eap Mailing List: Issue 286: Security

[Bernard Aboba (aboba]

It seems that the crux of the issue here is the appropriateness of the
network disclosure mechanisms.

For example, as I understand it in 802.11u, there is a proposal whereby
the STA would disclose the networks with which it has a relationship in
the Probe Request, and the AP would respond with the subset of that list
that it supports in the Probe Response.

The discovery mechanism in this draft is somewhat different:  the AAA
proxy discloses its roaming relationships to the peer without the peer
first indicating what networks it supports.

The questions this issue raises are:

1. Is the disclosure negotiation described in this document appropriate?
   What are the security implications?

2. Does the document need to be modified so as to have the peer indicate
   the networks it supports?