Re: [saag] time to authenticate dhcp?

On Fri, 12 Dec 2008 02:54:06 +0200
"Alper Yegin" <alper.yegin@yegin.org> wrote:

>  
> > --On Thursday, December 11, 2008 01:49:07 AM +0200 Alper Yegin
> > <alper.yegin@yegin.org> wrote:
> > 
> > >> > For example, a wireless base station could drop the following
> > >> incoming
> > >> > packets on the wireless link:
> > >> >
> > >> > 1. IPv6 Router Advertisement packets (ICMP Type 134)
> > >> > 2. DHCPv4 packets sent to the client port (68)
> > >> > 3. DHCPv6 packets sent to the client port (546)
> > >>
> > >> That doesn't make things worse, but it also doesn't help if the
> > >> attacker's system is acting as a base station (bridging selected
> > >> traffic
> > >> through to the legitimate base station).
> > >
> > >
> > > The rogue entity inserting itself between the victim host and
> > legitimate
> > > base station (Mitm) is a much harder attack. So, the filtering has
> > > considerable value.
> > >
> > > Furthermore, one way to address this "MitM" attack is to use L2
> > access
> > > authentication. That way the host knows it is connected to a
> > legitimate
> > > network.
> > 
> > What's a "legitimate network"?  I don't share any authentication
> > secrets
> > with my local Panera Bread.
> 
> I was referring to "L2 authentication." In cases where L2
> authentication is used, you host has either a PSK with the WiFi AP
> (e.g., home gateway), or a PSK/cert with a AAA server that has a
> direct (or hop-by-hop) PSK with the AAA client on the AP (e.g.,
> enterprise/operator WiFi). 
> 
Again, what about Panera?  They don't charge; they don't have much need
for that sort of infrastructure.

Besides, how do people register in the first place?  Is this the real
AP, or is it an evil twin pointing at a credit card-stealing service?

		--Steve Bellovin, http://www.cs.columbia.edu/~smb
_______________________________________________
saag mailing list
saag@ietf.org
https://www.ietf.org/mailman/listinfo/saag