[radext] New Draft: RADIUS attribute for IEEE 802.11 security profiles

["Rich, Ken (Federal CTO)" <[e-mail]>]

I have submitted draft-rich-radext-wlan-security-profile-00.

https://datatracker.ietf.org/doc/draft-rich-radext-wlan-security-profile/

RFC 7268 already gives a RADIUS server WLAN-AKM-Suite and
WLAN-Pairwise-Cipher. IEEE 802.11, as amended, now also defines security
profiles. A security profile is an atomic set of AKM, pairwise cipher,
and related security capabilities.

The problem is that two security profiles can use the same AKM and
the same pairwise cipher while differing in other security-relevant
behavior. In that case the WLAN-AKM-Suite and WLAN-Pairwise-Cipher pair
are not unique. The server cannot tell which security profile was accepted.

The draft defines one attribute, WLAN-Security-Profile. It carries a
four-octet Security Profile Selector in the same form as WLAN-AKM-Suite
And WLAN-Pairwise-Cipher.

The document depends on the IEEE amendment defining security
profiles, which is still in ballot, so publication would follow
ratification. I anticipate requesting an early allocation under RFC 7120
so implementation is not blocked in the meantime.

Regards,

Ken Rich
HPE