eap Mailing List: Re: Re: Issue 352: Channel Binding Issue

[Yoshihiro Ohba (yohba]

On Mon, May 08, 2006 at 10:09:34PM -0700, Salowey, Joe wrote:
> > 
> > If EAP keying material is not used for secure association at all, I
> > don't think CB is possible because an attacker authenticator can
> > simply spoof legitimate authenticator's parameters.  This can happen
> > in the case of wired 802.1X as well.  Am I wrong?
> > 
> [Joe] The same argument applies to peer entity authentication without
> ongoing data authentication.  However this is still deployed and appears
> to be somewhat useful.  I don't think this is the place to discuss the
> merits of 802.1x.  

Perhaps you miss my point.  I did not discuss the merit of 802.1X.  My
point is that having a Channel Binding solution for lower layers that
do not use cryptographic per-packet acess control does not really make 
sense to me.

Yoshihiro Ohba