Re: [radext] FW: New Version Notification for draft-henry-radext-stable-mac-identifier-00.txt

[Bernard Aboba <[e-mail]>]

On Nov 17, 2021, at 05:34, Jerome Henry (jerhenry) <jerhenry=[e-mail]> wrote:
> 
> Good morning Benjamin,
> 
> (disclaimer: I am not Nancy __)
> 
> This changed behavior causes the failure of multiple assumptions that have been made over the past 3 decades on the idea that one client = 1 MAC. In the case we address in this draft, we look into bringing back stability in the exchanges between an authenticator (AP/Wireless LAN controller) and RADIUS, when one side or the other gets a stable identifier (I fully agree that the context is not clear in the draft, we'll expand it).

[BA] The idea that one client = 1 MAC (or one client = 1 IP address) became suspect once multi-homing became common and even more so once virtualization took off. 

As noted in RFC 8016, multiple approaches have been tried to “bring back stability”. One approach is to attempt to make it appear as if the address has not changed (e.g. mobile IP).  

However, another approach is to provide “stability” by making the upper layer protocol agnostic to the IP address change.  If properly executed, this approach can make it more difficult for an observer on the wire to link the multiple addresses.

Examples of this approach include TLS 1.3 and protocols built on it (such as EAP TLS 1.3).  The TURN protocol initially made an assumption that a relay allocation was linked to the IP address.  Once the disadvantages became clear, TURN mobility (RFC 8016) was developed.