[admin-discuss] Re: Update on IETF 125 meeting network

[Alan DeKok <[e-mail]>]

On Feb 11, 2026, at 6:07 PM, Stephen Farrell <[e-mail]> wrote:
> On 11/02/2026 17:35, Eric Rescorla wrote:
>> To the best of your knowledge, will third parties
>> be able to use the information we provide, potentially in concert with other
>> data they could foreseeably gather, to associate IP traffic with specific
>> users?
> 
> Yes, IMO that is a question the answer to which ought be available to
> people using the meeting network before they establish connections.

  I won't speak for the NOC, but I can give a short summary of the technology.  I'll try to keep it straightforward, so it's at least not wrong.

  802.1X authentication uses an identity.  In this case, something provided by the IETF, such as "[e-mail] <mailto:[e-mail]>".  That identity goes into RADIUS, generally along with the MAC address of the authenticating device.  This allows the RADIUS server to correlate the MAC address and identity.  So long as that correlation isn't shared off-box, it's not easy for any third party to correlate the two bits of information.

  If the APs enable protection for management frames, then the 802.1X data can be protected at the Wi-Fi layer.  Otherwise, it's literally broadcast publicly for everyone to see.

  Some access points can be configured to not send the device MAC address in the RADIUS packets.  Whether or not this is possible depends on the APs which are used.

  The device then does DHCP, which of course correlates MAC address to IP address.  That information is public, because anyone on the local network can do ARP scans.

  Depending on the access point configuration of the access point, there may be RADIUS accounting packets which contain the above identity, plus MAC address and any IP address which was assigned via DHCP.  Since the IETF isn't doing billing, it's not important to do billing, and the stream of accounting packets can be administratively disabled.

  Over all, it's not immediately trivial to correlate the supplied identity with a public IP address.  However...

  We can also assume that the local network will be available for everyone to use.  Which means that it's trivial to scan / fingerprint all devices on the network, locate them physically, etc.

  In addition, many people will be carrying phones, which will broadcast bluetooth IDs, often including things like 'Alan's Google Pixel 10 Pro Fold'.  If those phones are on WiFi, additional correlation is possible.

  Which means for me, I wouldn't worry much about correlation between IETF issued identity, personal name, and IP address.  Any correlations between personal name and IP address are likely already possible, independent of whatever the IETF does.  So the IETF supplying some information as required is likely to change the cost of obtaining the data, but is not likely to change the contents of the data itself.

  I would still recommend that the NOC keep the minimal legally required information, of course.  

  Sad to say for business reasons, I won't be attending in person.

  Alan DeKok.