Qin said:
"Based on this, impersonation issue seems to overlap with channel binding or lying NAS issue."
RFC 3748 Section 7.15 describes the distinction between the two problems:
" Section 4.3.7 of [RFC3579] describes how an EAP pass-through
authenticator acting as a AAA client can be detected if it attempts
to impersonate another authenticator (such by sending incorrect NAS-
Identifier [RFC2865], NAS-IP-Address [RFC2865] or NAS-IPv6-Address
[RFC3162] attributes via the AAA protocol). However, it is possible
for a pass-through authenticator acting as a AAA client to provide
correct information to the AAA server while communicating misleading
information to the EAP peer via a lower layer protocol.
"
|
