eap Mailing List: RE: Re: EAP Key Binding

[Alper Yegin (alper.yegin]

> > So, the issue is about binding PMK to NAS ports (WTPs in this case).
> > Unless the NAS explicitly informs the host about the list of ports,
how
> > can this be handled? I think this is an issue for the EAP lower
layer to
> > handle.
> 
> The NAS doesn't have to inform the host of the list of ports, it just
has
> to provide the host with the same NAS-ID that it provides to the AAA
> server.  You are correct that it is a lower layer issue.

Dorothy can correct me if I'm wrong, but shared knowledge of NAS-ID does
not seem to solve the problem she is describing. Unless both the host
and the NAS agree on the list of ports (WTPs) associated/bound to the
PMK (or, its derivatives), host cannot distinguish between a legitimate
WTP and one that's using a compromised PMK (or, a derivative). In fact,
what I'm talking about is further binding that not only includes the NAS
ID but also the port IDs.

Alper