On Mon, Jan 18, 2010 at 10:43:56PM -0600, Eric Volker wrote: > Is EAP version 1 secure? It is not EAP version; it is EAPOL version.. In practice, there is no difference in how hostapd behaves as far as version 1 and 2 are concerned apart from the value in the header. > In light of this issue, why is version 2 default? Is there any way to > negotiate the version level? Which version do off-the-shelf consumer > routers use? hostapd is implemented based on 802.1X-2004 and version 2 and as such, version number 2 is the correct value to use. I would expect off-the-shelf consumer products use a mix of both version 1 and 2. I haven't checked this lately, but version 2 started showing up years ago in many devices. IEEE 802.1X-2004 (and already the earlier -2001 version) described version negotiation mechanism for EAPOL. There are some implementations that did not do this correctly and had problems when -2004 was introduced (over fixe years ago!). > Based on the comments in hostapd.conf, EAP only seems to be used for > 802.1X authentication. I'm using WPA/WPA2 (wpa=3) Personal > authentication, so why does the EAP version matter? Because it is not "EAP version", but "EAPOL version" and WPA/WPA2-Personal uses EAPOL frames. > Why is an OS as recent as Snow Leopard (10.6) using a protocol version > that the hostapd.conf comments imply is outdated? It would be fine to use protocol version 1, but the real question here is why does it not implement IEEE 802.1X version negotiation correctly.. Anyway, I do not think I've seen this with OS X tests myself (both 10.4 and 10.6), but do not remember details.. In other words, this could be an issue in a component (just the driver?) and not the generic supplicant in the OS. -- Jouni Malinen PGP id EFC895FA -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
