RADIUS for IEEE 802: RADIUS Attributes for IEEE 802 Networks
New RADIUS attributes that let Wi-Fi and wired access points tell a central server more and get more back.
Aboba, B., Malinen, J., Congdon, P., Salowey, J., and M. Jones, "RADIUS Attributes for IEEE 802 Networks", RFC 7268, DOI 10.17487/RFC7268, July 2014, <https://www.rfc-editor.org/info/rfc7268>.
@misc{rfc7268,
series = {Request for Comments},
number = 7268,
howpublished = {RFC 7268},
publisher = {RFC Editor},
doi = {10.17487/RFC7268},
url = {https://www.rfc-editor.org/info/rfc7268},
author = {B. Aboba and J. Malinen and P. Congdon and J. Salowey and M. Jones},
title = {{RADIUS Attributes for IEEE 802 Networks}},
pagetotal = 29,
year = 2014,
month = jul,
} RFC text
Contents
Internet Engineering Task Force (IETF) B. Aboba
Request for Comments: 7268 Microsoft Corporation
Updates: 3580, 4072 J. Malinen
Category: Standards Track Independent
ISSN: 2070-1721 P. Congdon
Tallac Networks
J. Salowey
Cisco Systems
M. Jones
Azuca Systems
July 2014
RADIUS Attributes for IEEE 802 Networks
Abstract
RFC 3580 provides guidelines for the use of the Remote Authentication
Dial-In User Service (RADIUS) within IEEE 802 local area networks
(LANs). This document defines additional attributes for use within
IEEE 802 networks and clarifies the usage of the EAP-Key-Name
Attribute and the Called-Station-Id Attribute. This document updates
RFCs 3580 and 4072.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc7268.
Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
This document may contain material from IETF Documents or IETF
Contributions published or made publicly available before November
10, 2008. The person(s) controlling the copyright in some of this
material may not have granted the IETF Trust the right to allow
modifications of such material outside the IETF Standards Process.
Without obtaining an adequate license from the person(s) controlling
the copyright in such materials, this document may not be modified
outside the IETF Standards Process, and derivative works of it may
not be created outside the IETF Standards Process, except to format
it for publication as an RFC or to translate it into languages other
than English.
Table of Contents
1. Introduction ....................................................3
1.1. Terminology ................................................4
1.2. Requirements Language ......................................4
2. RADIUS Attributes ...............................................5
2.1. Allowed-Called-Station-Id ..................................5
2.2. EAP-Key-Name ...............................................6
2.3. EAP-Peer-Id ................................................7
2.4. EAP-Server-Id ..............................................8
2.5. Mobility-Domain-Id .........................................9
2.6. Preauth-Timeout ...........................................10
2.7. Network-Id-Name ...........................................11
2.8. EAPoL-Announcement ........................................12
2.9. WLAN-HESSID ...............................................14
2.10. WLAN-Venue-Info ..........................................14
2.11. WLAN-Venue-Language ......................................16
2.12. WLAN-Venue-Name ..........................................17
2.13. WLAN-Reason-Code .........................................18
2.14. WLAN-Pairwise-Cipher .....................................19
2.15. WLAN-Group-Cipher ........................................20
2.16. WLAN-AKM-Suite ...........................................21
2.17. WLAN-Group-Mgmt-Cipher ...................................22
2.18. WLAN-RF-Band .............................................23
3. Table of Attributes ............................................24
4. IANA Considerations ............................................25
5. Security Considerations ........................................25
6. References .....................................................26
6.1. Normative References ......................................26
6.2. Informative References ....................................27
7. Acknowledgments ................................................28
1. Introduction
In situations where it is desirable to centrally manage
authentication, authorization, and accounting (AAA) for IEEE 802
[IEEE-802] networks, deployment of a backend authentication and
accounting server is desirable. In such situations, it is expected
that IEEE 802 authenticators will function as AAA clients.
"IEEE 802.1X Remote Authentication Dial In User Service (RADIUS)
Usage Guidelines" [RFC3580] provides guidelines for the use of the
Remote Authentication Dial-In User Service (RADIUS) within networks
utilizing IEEE 802 local area networks. This document defines
additional attributes suitable for usage by IEEE 802 authenticators
acting as AAA clients.
1.1. Terminology
This document uses the following terms:
Access Point (AP)
A Station that provides access to the distribution services via
the wireless medium for associated Stations.
Association
The service used to establish Access Point/Station mapping and
enable Station invocation of the distribution system services.
Authenticator
An entity that requires authentication from the Supplicant. The
authenticator may be connected to the Supplicant at the other end
of a point-to-point LAN segment or wireless link.
Authentication Server
An entity that provides an authentication service to an
authenticator. This service verifies the claim of identity made
by the Supplicant using the credentials provided by the Supplicant
Station (STA)
Any device that contains an IEEE 802.11 conformant Medium Access
Control (MAC) and Physical Layer (PHY) interface to the wireless
medium (WM).
Supplicant
An entity that is being authenticated by an authenticator. The
Supplicant may be connected to the authenticator at one end of a
point-to-point LAN segment or 802.11 wireless link.
1.2. Requirements Language
In this document, several words are used to signify the requirements
of the specification. The key words "MUST", "MUST NOT", "REQUIRED",
"SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY",
and "OPTIONAL" in this document are to be interpreted as described in
[RFC2119].
2. RADIUS Attributes
2.1. Allowed-Called-Station-Id
Description
The Allowed-Called-Station-Id Attribute allows the RADIUS server
to specify the authenticator MAC addresses and/or networks to
which the user is allowed to connect. One or more Allowed-Called-
Station-Id Attributes MAY be included in an Access-Accept, CoA-
Request, or Accounting-Request packet.
The Allowed-Called-Station-Id Attribute can be useful in
situations where pre-authentication is supported (e.g., IEEE
802.11 pre-authentication). In these scenarios, a Called-Station-
Id Attribute typically will not be included within the Access-
Request so that the RADIUS server will not know the network that
the user is attempting to access. The Allowed-Called-Station-Id
enables the RADIUS server to restrict the networks and attachment
points to which the user can subsequently connect.
A summary of the Allowed-Called-Station-Id Attribute format is
shown below. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
174
Length
>=3
String
The String field is one or more octets, specifying a Called-
Station-Id that the user MAY connect to; if the Called-Station-Id
that the user connects to does not match one of the Allowed-
Called-Station-Id Attributes, the Network Access Server (NAS) MUST
NOT permit the user to access the network.
In the case of IEEE 802, the Allowed-Called-Station-Id Attribute
is used to store the Medium Access Control (MAC) address,
represented as an uppercase ASCII character string in Canonical
format and with octet values separated by a "-", for example,
"00-10-A4-23-19-C0". Where restrictions on both the network and
authenticator MAC address usage are intended, the network name
MUST be appended to the authenticator MAC address, separated from
the MAC address with a ":", for example, "00-10-A4-23-19-C0:AP1".
Where no MAC address restriction is intended, the MAC address
field MUST be omitted, but ":" and the network name field MUST be
included, for example, ":AP1".
Within IEEE 802.11 [IEEE-802.11], the Service Set Identifier
(SSID) constitutes the network name; within IEEE 802.1X
[IEEE-802.1X] wired networks, the Network-Id Name (NID-Name)
constitutes the network name. Since a NID-Name can be up to 253
octets in length, when used with [IEEE-802.1X] wired networks,
there may not be sufficient room within the Allowed-Called-
Station-Id Attribute to include both a MAC address and a network
name. However, as the Allowed-Called-Station-Id Attribute is
expected to be used largely in wireless access scenarios, this
restriction is not considered serious.
2.2. EAP-Key-Name
Description
The EAP-Key-Name Attribute, defined in "Diameter Extensible
Authentication Protocol (EAP) Application" [RFC4072], contains the
EAP Session-Id, as described in "Extensible Authentication
Protocol (EAP) Key Management Framework" [RFC5247]. Exactly how
this attribute is used depends on the link layer in question.
It should be noted that not all link layers use this name. An
EAP-Key-Name Attribute MAY be included within Access-Request,
Access-Accept, and CoA-Request packets. A summary of the EAP-Key-
Name Attribute format is shown below. The fields are transmitted
from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
102 [RFC4072]
Length
>=3
String
The String field is one or more octets, containing the EAP
Session-Id, as defined in "Extensible Authentication Protocol
(EAP) Key Management Framework" [RFC5247]. Since the NAS operates
as a pass-through in EAP, it cannot know the EAP Session-Id before
receiving it from the RADIUS server. As a result, an EAP-Key-Name
Attribute sent in an Access-Request MUST only contain a single NUL
character. A RADIUS server receiving an Access-Request with an
EAP-Key-Name Attribute containing anything other than a single NUL
character MUST silently discard the attribute. In addition, the
RADIUS server SHOULD include this attribute in an Access-Accept or
CoA-Request only if an EAP-Key-Name Attribute was present in the
Access-Request. Since a NAS will typically only include an EAP-
Key-Name Attribute in an Access-Request in situations where the
attribute is required to provision service, if an EAP-Key-Name
Attribute is included in an Access-Request but is not present in
the Access-Accept, the NAS SHOULD treat the Access-Accept as
though it were an Access-Reject. If an EAP-Key-Name Attribute was
not present in the Access-Request but is included in the Access-
Accept, then the NAS SHOULD silently discard the EAP-Key-Name
Attribute. As noted in Section 6.2.2 of [IEEE-802.1X], the
Connectivity Association Key Name (CKN) is derived from the EAP
Session-Id, and, as described in Section 9.3.3 of [IEEE-802.1X],
the CKN is subsequently used in the derivation of the Key
Encrypting Key (KEK) and the Integrity Check Value Key (ICK),
which protect the Secure Association Keys (SAKs) utilized by Media
Access Control Security (MACsec). As a result, for the NAS to
acquire information needed in the MACsec Key Agreement (MKA)
exchange, it needs to include the EAP-Key-Name Attribute in the
Access-Request and receive it from the RADIUS server in the
Access-Accept.
2.3. EAP-Peer-Id
Description
The EAP-Peer-Id Attribute contains a Peer-Id generated by the EAP
method. Exactly how this name is used depends on the link layer
in question. See [RFC5247] for more discussion. The EAP-Peer-Id
Attribute MAY be included in Access-Request, Access-Accept, and
Accounting-Request packets. More than one EAP-Peer-Id Attribute
MUST NOT be included in an Access-Request; one or more EAP-Peer-Id
Attributes MAY be included in an Access-Accept.
It should be noted that not all link layers use this name, and
existing EAP method implementations do not generate it. Since the
NAS operates as a pass-through in EAP [RFC3748], it cannot know
the EAP-Peer-Id before receiving it from the RADIUS server. As a
result, an EAP-Peer-Id Attribute sent in an Access-Request MUST
only contain a single NUL character. A home RADIUS server
receiving an Access-Request with an EAP-Peer-Id Attribute
containing anything other than a single NUL character MUST
silently discard the attribute. In addition, the home RADIUS
server SHOULD include one or more EAP-Peer-Id Attributes in an
Access-Accept only if an EAP-Peer-Id Attribute was present in the
Access-Request. If a NAS receives EAP-Peer-Id Attribute(s) in an
Access-Accept without having included one in an Access-Request,
the NAS SHOULD silently discard the attribute(s). A summary of
the EAP-Peer-Id Attribute format is shown below. The fields are
transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
175
Length
>=3
String
The String field is one or more octets, containing an EAP Peer-Id
exported by the EAP method. For details, see Appendix A of
[RFC5247]. A robust implementation SHOULD support the field as
undistinguished octets. Only a single EAP Peer-Id may be included
per attribute.
2.4. EAP-Server-Id
Description
The EAP-Server-Id Attribute contains a Server-Id generated by the
EAP method. Exactly how this name is used depends on the link
layer in question. See [RFC5247] for more discussion. The EAP-
Server-Id Attribute is only allowed in Access-Request, Access-
Accept, and Accounting-Request packets. More than one EAP-Server-
Id Attribute MUST NOT be included in an Access-Request; one or
more EAP-Server-Id Attributes MAY be included in an Access-Accept.
It should be noted that not all link layers use this name, and
existing EAP method implementations do not generate it. Since the
NAS operates as a pass-through in EAP [RFC3748], it cannot know
the EAP-Server-Id before receiving it from the RADIUS server. As
a result, an EAP-Server-Id Attribute sent in an Access-Request
MUST contain only a single NUL character. A home RADIUS server
receiving an Access-Request with an EAP-Server-Id Attribute
containing anything other than a single NUL character MUST
silently discard the attribute. In addition, the home RADIUS
server SHOULD include this attribute in an Access-Accept only if
an EAP-Server-Id Attribute was present in the Access-Request. A
summary of the EAP-Server-Id Attribute format is shown below. The
fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
176
Length
>=3
String
The String field is one or more octets, containing an EAP Server-
Id exported by the EAP method. For details, see Appendix A of
[RFC5247]. A robust implementation SHOULD support the field as
undistinguished octets.
2.5. Mobility-Domain-Id
Description
A single Mobility-Domain-Id Attribute MAY be included in an
Access-Request or Accounting-Request in order to enable the NAS to
provide the RADIUS server with the Mobility Domain Identifier
(MDID), defined in Section 8.4.2.49 of [IEEE-802.11]. A summary
of the Mobility-Domain-Id Attribute format is shown below. The
fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
177
Length
6
Value
The Value field is four octets, containing a 32-bit unsigned
integer. The two most significant octets MUST be set to zero by
the sender and are ignored by the receiver; the two least
significant octets contain the Mobility Domain Identifier (MDID)
defined in Section 8.4.2.49 of [IEEE-802.11].
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | Mobility Domain Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2.6. Preauth-Timeout
Description
This attribute sets the maximum number of seconds that pre-
authentication state is required to be kept by the NAS without
being utilized within a user session. For example, when
[IEEE-802.11] pre-authentication is used, if a user has not
attempted to utilize the Pairwise Master Key (PMK) derived as a
result of pre-authentication within the time specified by the
Preauth-Timeout Attribute, the PMK MAY be discarded by the Access
Point. However, once the session is underway, the Preauth-Timeout
Attribute has no bearing on the maximum session time for the user
or the maximum time during which key state may be kept prior to
re-authentication. This is determined by the Session-Timeout
Attribute, if present.
A single Preauth-Timeout Attribute MAY be included within an
Access-Accept or CoA-Request packet. A summary of the Preauth-
Timeout Attribute format is shown below. The fields are
transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value (cont) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
178
Length
6
Value
The field is 4 octets, containing a 32-bit unsigned integer
encoding the maximum time in seconds that pre-authentication state
should be retained by the NAS.
2.7. Network-Id-Name
Description
The Network-Id-Name Attribute is utilized by implementations of
IEEE-802.1X [IEEE-802.1X] to specify the name of a Network-Id
(NID-Name).
Unlike the IEEE 802.11 SSID (which is a maximum of 32 octets in
length), the NID-Name may be up to 253 octets in length.
Consequently, if the MAC address is included within the Called-
Station-Id Attribute, it is possible that there will not be enough
remaining space to encode the NID-Name as well. Therefore, when
used with IEEE 802.1X [IEEE-802.1X], the Called-Station-Id
Attribute SHOULD contain only the MAC address, with the Network-
Id-Name Attribute used to transmit the NID-Name. The Network-Id-
Name Attribute MUST NOT be used to encode the IEEE 802.11 SSID; as
noted in [RFC3580], the Called-Station-Id Attribute is used for
this purpose.
Zero or one Network-Id-Name Attribute is permitted within an
Access-Request, Access-Challenge, Access-Accept or Accounting-
Request packet. When included within an Access-Request packet,
the Network-Id-Name Attribute represents a hint of the NID-Name to
which the Supplicant should be granted access. When included
within an Access-Accept packet, the Network-Id-Name Attribute
represents the NID-Name to which the Supplicant is to be granted
access. When included within an Accounting-Request packet, the
Network-Id-Name Attribute represents the NID-Name to which the
Supplicant has been granted access.
A summary of the Network-Id-Name Attribute format is shown below.
The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
179
Length
>=3
String
The String field is one or more octets, containing a NID-Name.
For details, see [IEEE-802.1X]. A robust implementation SHOULD
support the field as undistinguished octets.
2.8. EAPoL-Announcement
Description
The EAPoL-Announcement Attribute contains EAPoL-Announcement Type-
Length-Value (TLV) tuples defined within Table 11-8 of IEEE-802.1X
[IEEE-802.1X]. The acronym "EAPoL" stands for Extensible
Authentication Protocol over Local Area Network.
Zero or more EAPoL-Announcement Attributes are permitted within an
Access-Request, Access-Accept, Access-Challenge, Access-Reject,
Accounting-Request, CoA-Request, or Disconnect-Request packet.
When included within an Access-Request packet, EAPoL-Announcement
Attributes contain EAPoL-Announcement TLVs that the user sent in
an EAPoL-Announcement. When included within an Access-Accept,
Access-Challenge, Access-Reject, CoA-Request or Disconnect-Request
packet, EAPoL-Announcement Attributes contain EAPoL-Announcement
TLVs that the NAS is to send to the user in a unicast EAPoL-
Announcement. When sent within an Accounting-Request packet,
EAPoL-Announcement Attributes contain EAPoL-Announcement TLVs that
the NAS has most recently sent to the user in a unicast EAPoL-
Announcement.
A summary of the EAPoL-Announcement Attribute format is shown
below. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
180
Length
>=3
String
The String field is one or more octets, containing EAPoL-
Announcement TLVs in the format defined in Figure 11-8 of Section
11.12 of [IEEE-802.1X]. Any EAPoL-Announcement TLV Type MAY be
included within an EAPoL-Announcement Attribute, including
Organizationally Specific TLVs. If multiple EAPoL-Announcement
Attributes are present in a packet, their String fields MUST be
concatenated before being parsed for EAPoL-Announcement TLVs; this
allows EAPoL-Announcement TLVs longer than 253 octets to be
transported by RADIUS. Similarly, EAPoL-Announcement TLVs larger
than 253 octets MUST be fragmented between multiple EAPoL-
Announcement Attributes.
2.9. WLAN-HESSID
Description
The WLAN-HESSID Attribute contains a MAC address that identifies
the Homogenous Extended Service Set. The HESSID is a globally
unique identifier that, in conjunction with the SSID, encoded
within the Called-Station-Id Attribute as described in [RFC3580],
may be used to provide network identification for a subscription
service provider network (SSPN), as described in Section 8.4.2.94
of [IEEE-802.11]. Zero or one WLAN-HESSID Attribute is permitted
within an Access-Request or Accounting-Request packet.
A summary of the WLAN-HESSID Attribute format is shown below. The
fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
181
Length
19
String
The String field is encoded in uppercase ASCII characters with the
octet values separated by dash characters, as described in RFC
3580 [RFC3580], for example, "00-10-A4-23-19-C0".
2.10. WLAN-Venue-Info
Description
The WLAN-Venue-Info Attribute identifies the category of venue
hosting the WLAN, as defined in Section 8.4.1.34 of [IEEE-802.11].
Zero or more WLAN-Venue-Info Attributes may be included in an
Access-Request or Accounting-Request.
A summary of the WLAN-Venue-Info Attribute format is shown below.
The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
182
Length
6
Value
The Value field is four octets, containing a 32-bit unsigned
integer. The two most significant octets MUST be set to zero by
the sender, and are ignored by the receiver; the two least
significant octets contain the Venue Group and Venue Type fields.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | Venue Group | Venue Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Venue Group
The Venue Group field is a single octet and describes the broad
category of the venue, e.g., "Assembly". See Section 8.4.1.34
of [IEEE-802.11] for Venue Group codes and descriptions.
Venue Type
The Venue Type field is a single octet and describes the venue
in a finer granularity within the Venue Group, e.g., "Library".
See Section 8.4.1.34 of [IEEE-802.11] for Venue Type codes and
descriptions.
2.11. WLAN-Venue-Language
Description
The WLAN-Venue-Language Attribute is a string encoded by
ISO-14962-1997 [ISO-14962-1997] that defines the language used in
the WLAN-Venue-Name Attribute. Zero or more WLAN-Venue-Language
Attributes may be included in an Access-Request or Accounting-
Request, and each one indicates the language of the WLAN-Venue-
Name Attribute that follows it.
A summary of the WLAN-Venue-Language Attribute format is shown
below. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
String (cont) |
+-+-+-+-+-+-+-+-+
Type
183
Length
4-5
String
The String field is a two- or three-character language code
selected from ISO-639 [ISO-639]. A two-character language code
has a zero ("null" in ISO-14962-1997) appended to make it 3 octets
in length.
2.12. WLAN-Venue-Name
Description
The WLAN-Venue-Name Attribute provides additional metadata on the
Basic Service Set (BSS). For example, this information may be
used to assist a user in selecting the appropriate BSS with which
to associate. Zero or more WLAN-Venue-Name Attributes may be
included in an Access- Request or Accounting-Request in the same
or different languages.
A summary of the WLAN-Venue-Name Attribute format is shown below.
The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
184
Length
>=3
String
The String field is encoded in UTF-8 and contains the venue's
name. The maximum length of this field is 252 octets.
2.13. WLAN-Reason-Code
Description
The WLAN-Reason-Code Attribute contains information on the reason
why a Station has been refused network access and has been
disassociated or de-authenticated. This can occur due to policy
or for reasons related to the user's subscription.
A WLAN-Reason-Code Attribute MAY be included within an Access-
Reject or Disconnect-Request packet, as well as within an
Accounting-Request packet. Upon receipt of an Access-Reject or
Disconnect-Request packet containing a WLAN-Reason-Code Attribute,
the WLAN-Reason-Code value is copied by the Access Point into the
Reason Code field of a Disassociation or Deauthentication frame
(see Clauses 8.3.3.4 and 8.3.3.12, respectively, in
[IEEE-802.11]), which is subsequently transmitted to the Station.
A summary of the WLAN-Reason-Code Attribute format is shown below.
The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
185
Length
6
Value
The Value field is four octets, containing a 32-bit unsigned
integer. The two most significant octets MUST be set to zero by
the sender and are ignored by the receiver; the two least
significant octets contain the Reason Code values defined in Table
8-36 of Section 8.4.1.7 of [IEEE-802.11].
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | Reason Code |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2.14. WLAN-Pairwise-Cipher
Description
The WLAN-Pairwise-Cipher Attribute contains information on the
pairwise ciphersuite used to establish the robust security network
association (RSNA) between the AP and mobile device. A WLAN-
Pairwise-Cipher Attribute MAY be included within Access-Request
and Accounting-Request packets.
A summary of the WLAN-Pairwise-Cipher Attribute format is shown
below. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
186
Length
6
Value
The Value field is four octets, containing a 32-bit unsigned
integer, in Suite selector format as specified in Figure 8-187
within Section 8.4.2.27.2 of [IEEE-802.11], with values of OUI and
Suite Type drawn from Table 8-99.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OUI | Suite Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2.15. WLAN-Group-Cipher
Description
The WLAN-Group-Cipher Attribute contains information on the group
ciphersuite used to establish the robust security network
association (RSNA) between the AP and mobile device. A WLAN-
Group-Cipher Attribute MAY be included within Access-Request and
Accounting-Request packets.
A summary of the WLAN-Group-Cipher Attribute format is shown
below. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
187
Length
6
Value
The Value field is four octets, containing a 32-bit unsigned
integer, in Suite selector format as specified in Figure 8-187
within Section 8.4.2.27.2 of [IEEE-802.11], with values of OUI and
Suite Type drawn from Table 8-99.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OUI | Suite Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2.16. WLAN-AKM-Suite
Description
The WLAN-AKM-Suite Attribute contains information on the
authentication and key management suite used to establish the
robust security network association (RSNA) between the AP and
mobile device. A WLAN-AKM-Suite Attribute MAY be included within
Access-Request and Accounting-Request packets.
A summary of the WLAN-AKM-Suite Attribute format is shown below.
The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
188
Length
6
Value
The Value field is four octets, containing a 32-bit unsigned
integer, in Suite selector format as specified in Figure 8-187
within Section 8.4.2.27.2 of [IEEE-802.11], with values of OUI and
Suite Type drawn from Table 8-101:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OUI | Suite Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2.17. WLAN-Group-Mgmt-Cipher
Description
The WLAN-Group-Mgmt-Cipher Attribute contains information on the
group management cipher used to establish the robust security
network association (RSNA) between the AP and mobile device.
Zero or one WLAN-Group-Mgmt-Cipher Attribute MAY be included
within Access-Request and Accounting-Request packets. The
presence of the Attribute indicates that the Station negotiated to
use management frame protection during association.
A summary of the WLAN-Group-Mgmt-Cipher Attribute format is shown
below. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
189
Length
6
Value
The Value field is four octets, containing a 32-bit unsigned
integer, in Suite selector format as specified in Figure 8-187
within Section 8.4.2.27.2 of [IEEE-802.11], with values of OUI and
Suite Type drawn from Table 8-99:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OUI | Suite Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2.18. WLAN-RF-Band
Description
The WLAN-RF-Band Attribute contains information on the radio
frequency (RF) band used by the Access Point for transmission and
reception of information to and from the mobile device. Zero or
one WLAN-RF-Band Attribute MAY be included within an Access-
Request or Accounting-Request packet.
A summary of the WLAN-RF-Band Attribute format is shown below.
The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
190
Length
6
Value
The Value field is four octets, containing a 32-bit unsigned
integer. The three most significant octets MUST be set to zero by
the sender and are ignored by the receiver; the least significant
octet contains the RF Band field, whose values are defined by the
IEEE 802.11 Band ID field (Table 8-53a of [IEEE-802.11ad])
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | RF Band |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3. Table of Attributes
The following table provides a guide to which attributes may be found
in which kinds of packets and in what quantity.
Access- Access- Access- Access-
Request Accept Reject Challenge # Attribute
0 0+ 0 0 174 Allowed-Called-Station-Id
0-1 0-1 0 0 102 EAP-Key-Name
0-1 0+ 0 0 175 EAP-Peer-Id
0-1 0+ 0 0 176 EAP-Server-Id
0-1 0 0 0 177 Mobility-Domain-Id
0-1 0-1 0 0 178 Preauth-Timeout
0-1 0 0 0 179 Network-Id-Name
0+ 0+ 0+ 0+ 180 EAPoL-Announcement
0-1 0 0 0 181 WLAN-HESSID
0-1 0 0 0 182 WLAN-Venue-Info
0+ 0 0 0 183 WLAN-Venue-Language
0+ 0 0 0 184 WLAN-Venue-Name
0 0 0-1 0 185 WLAN-Reason-Code
0-1 0 0 0 186 WLAN-Pairwise-Cipher
0-1 0 0 0 187 WLAN-Group-Cipher
0-1 0 0 0 188 WLAN-AKM-Suite
0-1 0 0 0 189 WLAN-Group-Mgmt-Cipher
0-1 0 0 0 190 WLAN-RF-Band
CoA- Dis- Acct-
Req Req Req # Attribute
0+ 0 0+ 174 Allowed-Called-Station-Id
0-1 0 0 102 EAP-Key-Name
0 0 0+ 175 EAP-Peer-Id
0 0 0+ 176 EAP-Server-Id
0 0 0-1 177 Mobility-Domain-Id
0-1 0 0 178 Preauth-Timeout
0 0 0-1 179 Network-Id-Name
0+ 0+ 0+ 180 EAPoL-Announcement
0 0 0-1 181 WLAN-HESSID
0 0 0-1 182 WLAN-Venue-Info
0 0 0+ 183 WLAN-Venue-Language
0 0 0+ 184 WLAN-Venue-Name
0 0-1 0-1 185 WLAN-Reason-Code
0 0 0-1 186 WLAN-Pairwise-Cipher
0 0 0-1 187 WLAN-Group-Cipher
0 0 0-1 188 WLAN-AKM-Suite
0 0 0-1 189 WLAN-Group-Mgmt-Cipher
0 0 0-1 190 WLAN-RF-Band
The following table defines the above table entries.
0 This attribute MUST NOT be present in packet.
0+ Zero or more instances of this attribute MAY be present in the
packet.
0-1 Zero or one instance of this attribute MAY be present in the
packet.
4. IANA Considerations
This document uses the RADIUS [RFC2865] namespace; see
<http://www.iana.org/assignments/radius-types>. Per this
specification, RADIUS attribute types have been assigned for the
following attributes:
Attribute Type
========= ====
Allowed-Called-Station-Id 174
EAP-Peer-Id 175
EAP-Server-Id 176
Mobility-Domain-Id 177
Preauth-Timeout 178
Network-Id-Name 179
EAPoL-Announcement 180
WLAN-HESSID 181
WLAN-Venue-Info 182
WLAN-Venue-Language 183
WLAN-Venue-Name 184
WLAN-Reason-Code 185
WLAN-Pairwise-Cipher 186
WLAN-Group-Cipher 187
WLAN-AKM-Suite 188
WLAN-Group-Mgmt-Cipher 189
WLAN-RF-Band 190
Since this specification relies entirely on values assigned by IEEE
802, no registries are established for maintenance by the IANA.
5. Security Considerations
Since this document describes the use of RADIUS for purposes of
authentication, authorization, and accounting in IEEE 802 networks,
it is vulnerable to all of the threats that are present in other
RADIUS applications. For a discussion of these threats, see
[RFC2607], [RFC2865], [RFC3162], [RFC3579], [RFC3580], and [RFC5176].
In particular, when RADIUS traffic is sent in the clear, the
attributes defined in this document can be obtained by an attacker
snooping the exchange between the RADIUS client and server. As a
result, RADIUS confidentiality is desirable; for a review of RADIUS
security and crypto-agility requirements, see [RFC6421].
While it is possible for a RADIUS server to make decisions on whether
to accept or reject an Access-Request based on the values of the
WLAN-Pairwise-Cipher, WLAN-Group-Cipher, WLAN-AKM-Suite, WLAN-Group-
Mgmt-Cipher, and WLAN-RF-Band Attributes, the value of doing this is
limited. In general, an Access-Reject should not be necessary,
except where Access Points and Stations are misconfigured so as to
enable connections to be made with unacceptable values. Rather than
rejecting access on an ongoing basis, users would be better served by
fixing the misconfiguration.
Where access does need to be rejected, the user should be provided
with an indication of why the problem has occurred, or else they are
likely to become frustrated. For example, if the values of the WLAN-
Pairwise-Cipher, WLAN-Group-Cipher, WLAN-AKM-Suite, or WLAN-Group-
Mgmt-Cipher Attributes included in the Access-Request are not
acceptable to the RADIUS server, then a WLAN-Reason-Code Attribute
with a value of 29 (Requested service rejected because of service
provider ciphersuite or AKM requirement) SHOULD be returned in the
Access-Reject. Similarly, if the value of the WLAN-RF-Band Attribute
included in the Access-Request is not acceptable to the RADIUS
server, then a WLAN-Reason-Code Attribute with a value of 11
(Disassociated because the information in the Supported Channels
element is unacceptable) SHOULD be returned in the Access-Reject.
6. References
6.1. Normative References
[IEEE-802] IEEE, "IEEE Standard for Local and Metropolitan Area
Networks: Overview and Architecture. Amendment 2:
Registration of Object Identifiers", ANSI/IEEE Std 802,
2001.
[IEEE-802.11]
IEEE, "IEEE Standard for Information technology -
Telecommunications and information exchange between
systems - Local and metropolitan area networks - Specific
requirements Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) Specifications", IEEE Std
802.11-2012, 2012.
[IEEE-802.11ad]
IEEE, "IEEE Standard for Information technology -
Telecommunications and information exchange between
systems - Local and metropolitan area networks - Specific
requirements Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) Specifications, Amendment
3: Enhancements for Very High Throughput in the 60 GHz
Band", IEEE Std 802.11ad-2012, 2012.
[IEEE-802.1X]
IEEE, "IEEE Standard for Local and metropolitan area
networks - Port-Based Network Access Control", IEEE Std
802.1X-2010, February 2010.
[ISO-639] ISO, "Codes for the Representation of Names of Languages",
ISO 639.
[ISO-14962-1997]
ISO, "Space data and information transfer systems - ASCII
encoded English", 1997.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service (RADIUS)", RFC
2865, June 2000.
[RFC4072] Eronen, P., Ed., Hiller, T., and G. Zorn, "Diameter
Extensible Authentication Protocol (EAP) Application", RFC
4072, August 2005.
[RFC5247] Aboba, B., Simon, D., and P. Eronen, "Extensible
Authentication Protocol (EAP) Key Management Framework",
RFC 5247, August 2008.
6.2. Informative References
[RFC2607] Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy
Implementation in Roaming", RFC 2607, June 1999.
[RFC3162] Aboba, B., Zorn, G., and D. Mitton, "RADIUS and IPv6", RFC
3162, August 2001.
[RFC3579] Aboba, B. and P. Calhoun, "RADIUS (Remote Authentication
Dial In User Service) Support For Extensible
Authentication Protocol (EAP)", RFC 3579, September 2003.
[RFC3580] Congdon, P., Aboba, B., Smith, A., Zorn, G., and J. Roese,
"IEEE 802.1X Remote Authentication Dial In User Service
(RADIUS) Usage Guidelines", RFC 3580, September 2003.
[RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
Levkowetz, Ed., "Extensible Authentication Protocol
(EAP)", RFC 3748, June 2004.
[RFC5176] Chiba, M., Dommety, G., Eklund, M., Mitton, D., and B.
Aboba, "Dynamic Authorization Extensions to Remote
Authentication Dial In User Service (RADIUS)", RFC 5176,
January 2008.
[RFC6421] Nelson, D., Ed., "Crypto-Agility Requirements for Remote
Authentication Dial-In User Service (RADIUS)", RFC 6421,
November 2011.
7. Acknowledgments
The authors would like to acknowledge Maximilian Riegel, Dorothy
Stanley, Yoshihiro Ohba, and the contributors to the IEEE 802.1 and
IEEE 802.11 reviews of this document, for useful discussions.
Authors' Addresses
Bernard Aboba
Microsoft Corporation
One Microsoft Way
Redmond, WA 98052
US
EMail: bernard_aboba@hotmail.com
Jouni Malinen
EMail: j@w1.fi
Paul Congdon
Tallac Networks
6528 Lonetree Blvd.
Rocklin, CA 95765
US
Phone: +19167576350
EMail: paul.congdon@tallac.com
Joseph Salowey
Cisco Systems
EMail: jsalowey@cisco.com
Mark Jones
Azuca Systems
EMail: mark@azu.ca
ISO Plain Language
On this page
§1Why More RADIUS Attributes
When an organization wants to manage authentication, authorization and accounting (AAA) centrally for IEEE 802 networks, it deploys a backend authentication and accounting server, and the IEEE 802 authenticators act as AAA clients for it. RADIUS is the protocol they use.
RFC 3580 already provides guidelines for using RADIUS within IEEE 802 local area networks. This RFC adds to that: it defines additional attributes suitable for use by IEEE 802 authenticators acting as AAA clients, and it clarifies the usage of two attributes that already existed, the EAP-Key-Name Attribute and the Called-Station-Id Attribute. It updates RFC 3580 and RFC 4072.
Most of the document is a reference list. Each new attribute gets a description, a packet format, the type number it was assigned, and the rules for when it may and may not appear. The attributes fall into a few families: ones that restrict where a user may connect, ones that carry names and identifiers from the Extensible Authentication Protocol (EAP), and ones that describe the wireless network itself.
The RFC is mostly a catalogue. For each new piece of information it gives a format, a number, and the rule for when to send it.
§1.1The Parts of an 802 Login
Section 1.1 defines the words the rest of the document uses.
An Access Point (AP) is a station that provides access to the distribution services over the wireless medium for associated stations. A Station (STA) is any device with an IEEE 802.11 conformant Medium Access Control (MAC) and Physical Layer interface to the wireless medium. Association is the service used to establish the AP-to-station mapping and enable the station to use the distribution system services.
An Authenticator is the entity that requires authentication from the Supplicant; it may be connected to the Supplicant at the other end of a point-to-point LAN segment or wireless link. The Supplicant is the entity being authenticated by the authenticator. The Authentication Server is the entity that provides the authentication service to the authenticator, verifying the claim of identity made by the Supplicant using the credentials the Supplicant provides.
These roles come from the IEEE 802 standards themselves, not from this RFC. The RFC uses them to say which packet each attribute may travel in.
The RFC names the four roles in a network login: the device trying to get in, the device asking it to prove itself, the server that checks the proof, and the wireless link they share.
§2.1Allowed-Called-Station-Id
The Allowed-Called-Station-Id Attribute, type 174, lets the RADIUS server name the authenticator MAC addresses and networks that the user is allowed to connect to. One or more of these attributes may be included in an Access-Accept, a CoA-Request or an Accounting-Request packet. If the Called-Station-Id the user actually connects to does not match one of them, the Network Access Server (NAS) MUST NOT permit the user to access the network.
It is designed for pre-authentication. In IEEE 802.11 pre-authentication, a Called-Station-Id Attribute is typically not included in the Access-Request, so the RADIUS server does not know which network the user is trying to reach. Allowed-Called-Station-Id lets the server restrict the networks and attachment points the user may connect to afterwards.
For IEEE 802 the attribute holds the Medium Access Control (MAC) address as an uppercase ASCII character string in Canonical format, with octet values separated by a hyphen, for example 00-10-A4-23-19-C0. Where restrictions on both the network and the authenticator MAC address are wanted, the network name must be appended after a colon, for example 00-10-A4-23-19-C0:AP1. Where no MAC address restriction is wanted, the MAC address field must be omitted but the colon and the network name must still be there, for example :AP1.
The network name is the Service Set Identifier (SSID) within IEEE 802.11, and the Network-Id Name (NID-Name) within IEEE 802.1X wired networks. Because a NID-Name can be up to 253 octets, there may not be room in the attribute for both a MAC address and a network name when 802.1X wired networks are used. The RFC does not consider that serious, because the attribute is expected to be used largely in wireless access scenarios.
This attribute is the list of places a user may connect to. The server sends the list back with the access decision, and the access point refuses the user if the network they landed on is not on that list.
§2.2EAP-Key-Name and the MACsec Key
The EAP-Key-Name Attribute, type 102 as assigned in RFC 4072, carries the EAP Session-Id as described in the EAP Key Management Framework of RFC 5247. How the attribute is used depends on the link layer in question, and not all link layers use the name at all. It may be included in Access-Request, Access-Accept and CoA-Request packets.
The NAS operates as a pass-through in EAP, so it cannot know the EAP Session-Id before the RADIUS server sends it. That produces a set of rules. An EAP-Key-Name Attribute sent in an Access-Request MUST contain only a single NUL character. A RADIUS server that receives an Access-Request with an EAP-Key-Name Attribute containing anything other than a single NUL character MUST silently discard the attribute. The server SHOULD include the attribute in an Access-Accept or a CoA-Request only if one was present in the Access-Request. If it was present in the request but not in the Access-Accept, the NAS SHOULD treat the Access-Accept as though it were an Access-Reject. If it was not present in the request but is present in the Access-Accept, the NAS SHOULD silently discard it.
Why this matters is MACsec. As described in Section 6.2.2 of IEEE 802.1X, the Connectivity Association Key Name (CKN) is derived from the EAP Session-Id, and the CKN is then used in the derivation of the Key Encrypting Key (KEK) and the Integrity Check Value Key (ICK), which protect the Secure Association Keys used by Media Access Control Security. For the NAS to acquire the information it needs for the MACsec Key Agreement exchange, it has to include the EAP-Key-Name Attribute in the Access-Request and receive it back from the RADIUS server in the Access-Accept.
The session name cannot travel from the client to the server, because the access point does not know it either. So the client sends an empty placeholder and the server fills in the real name on the way back. Wired networks use that name to derive the keys that protect their traffic.
- Access-RequestEAP-Key-Name carries only a single NUL character.
- Access-AcceptThe server returns the EAP Session-Id in EAP-Key-Name.
- EAP exchangeThe NAS passes EAP through to the station.
§2.3EAP-Peer-Id and EAP-Server-Id
The EAP-Peer-Id Attribute, type 175, carries a Peer-Id generated by the EAP method, and the EAP-Server-Id Attribute, type 176, carries a Server-Id generated by the EAP method. Both have a length of at least 3 octets, and both are strings that a robust implementation SHOULD support as undistinguished octets. How each name is used depends on the link layer in question, and the RFC notes that not all link layers use these names and that existing EAP method implementations do not generate them.
Both attributes follow the same pass-through rules as EAP-Key-Name. The EAP-Peer-Id Attribute may be included in Access-Request, Access-Accept and Accounting-Request packets, but more than one MUST NOT be included in an Access-Request, while one or more may be included in an Access-Accept. An EAP-Peer-Id Attribute sent in an Access-Request MUST only contain a single NUL character; a home RADIUS server that receives anything else in it MUST silently discard the attribute; the server SHOULD include one or more EAP-Peer-Id Attributes in an Access-Accept only if one was present in the Access-Request; and a NAS that receives them in an Access-Accept without having included one in the Access-Request SHOULD silently discard them. Only a single EAP Peer-Id may be included per attribute.
The EAP-Server-Id Attribute is only allowed in Access-Request, Access-Accept and Accounting-Request packets. More than one MUST NOT be included in an Access-Request, while one or more may be included in an Access-Accept. The same single NUL rule applies to an EAP-Server-Id Attribute sent in an Access-Request, and a home RADIUS server that receives anything other than a single NUL character MUST silently discard it. The server SHOULD include it in an Access-Accept only if one was present in the Access-Request.
These two attributes hold names that the EAP method may produce. They follow the same rule as the session name: an empty placeholder goes out to the server, and the real name comes back.
§2.5Identifiers, Timers and Announcements
The next group of attributes carries small values, mostly in a four-octet field where the two most significant octets are set to zero by the sender and ignored by the receiver.
The Mobility-Domain-Id Attribute, type 177, lets the NAS give the RADIUS server the Mobility Domain Identifier defined in Section 8.4.2.49 of IEEE 802.11. Its value is a 32-bit unsigned integer whose two least significant octets carry the identifier. The Preauth-Timeout Attribute, type 178, is a 32-bit unsigned integer giving the maximum number of seconds that pre-authentication state must be kept by the NAS without being used. For example, when IEEE 802.11 pre-authentication is used and the user has not used the Pairwise Master Key derived from it within that time, the access point MAY discard the key. Once the session is underway the attribute has no bearing on the maximum session time, which is set by the Session-Timeout Attribute instead.
The Network-Id-Name Attribute, type 179, carries the NID-Name used by IEEE 802.1X implementations. It may be up to 253 octets long, where the IEEE 802.11 SSID is at most 32 octets, so the RFC says the Called-Station-Id Attribute SHOULD contain only the MAC address when used with IEEE 802.1X, and the Network-Id-Name Attribute carries the name. The attribute MUST NOT be used to encode the IEEE 802.11 SSID. Zero or one may be present in an Access-Request, Access-Challenge, Access-Accept or Accounting-Request; in an Access-Request it is a hint of the NID-Name the Supplicant should be granted access to, in an Access-Accept it is the NID-Name to which access is to be granted, and in an Accounting-Request it is the NID-Name to which access has been granted.
The EAPoL-Announcement Attribute, type 180, carries EAPoL-Announcement Type-Length-Value tuples as defined in IEEE 802.1X. EAPoL stands for Extensible Authentication Protocol over Local Area Network. Zero or more may appear in an Access-Request, Access-Accept, Access-Challenge, Access-Reject, Accounting-Request, CoA-Request or Disconnect-Request. In an Access-Request the attribute carries the announcements the user sent; in the other packets it carries what the NAS is to send to the user in a unicast EAPoL-Announcement; in an Accounting-Request it carries what the NAS most recently sent. Because RADIUS attributes are short, the String fields of several EAPoL-Announcement Attributes MUST be concatenated before the tuples are parsed, and any tuple longer than 253 octets MUST be fragmented across several attributes.
These attributes carry the small facts a server needs about a network: which mobility domain it belongs to, how long a pre-login may be kept, the name of the wired network, and any announcement the client made during the login.
| Field | Name | Size | Value | Description |
|---|---|---|---|---|
RESERVED | Reserved | 2 bytes | Set to zero by the sender and ignored by the receiver. | |
REASON-CODE | Reason Code | 2 bytes | Reason Code values from IEEE 802.11 Table 8-36. |
§3Which Attributes Go in Which Packet
Section 3 of the RFC is a table showing, for every attribute, how many copies may appear in each kind of RADIUS packet. Three notations are used. A zero means the attribute MUST NOT be present in that packet. Zero or more means any number of instances MAY be present. Zero or one means a single instance MAY be present.
The table makes the intended direction of travel clear. WLAN-Reason-Code, which says why access was refused, may appear only in an Access-Reject or a Disconnect-Request. Allowed-Called-Station-Id appears in none of the four Access packets but may appear any number of times in an Access-Accept, a CoA-Request or an Accounting-Request. EAPoL-Announcement is the only attribute that may appear in all four Access packets.
Section 4 records the IANA side. The document uses the RADIUS namespace, and type numbers were assigned for the new attributes: Allowed-Called-Station-Id 174, EAP-Peer-Id 175, EAP-Server-Id 176, Mobility-Domain-Id 177, Preauth-Timeout 178, Network-Id-Name 179, EAPoL-Announcement 180, WLAN-HESSID 181, WLAN-Venue-Info 182, WLAN-Venue-Language 183, WLAN-Venue-Name 184, WLAN-Reason-Code 185, WLAN-Pairwise-Cipher 186, WLAN-Group-Cipher 187, WLAN-AKM-Suite 188, WLAN-Group-Mgmt-Cipher 189, and WLAN-RF-Band 190. Because the specification relies entirely on values assigned by IEEE 802, no registries are established for maintenance by the IANA.
The table is a delivery instruction sheet: it says which pieces of information may travel in which kind of message, and how many copies are allowed.
- 102EAP-Key-Name — EAP Session-Id, assigned in RFC 4072.
- 174Allowed-Called-Station-Id — Networks the user may connect to.
- 175EAP-Peer-Id — Peer-Id generated by the EAP method.
- 176EAP-Server-Id — Server-Id generated by the EAP method.
- 177Mobility-Domain-Id — Mobility Domain Identifier.
- 178Preauth-Timeout — Seconds to keep pre-authentication state.
- 179Network-Id-Name — The NID-Name of the wired network.
- 180EAPoL-Announcement — EAPoL-Announcement TLV tuples.
- 181WLAN-HESSID — MAC address of the extended service set.
- 182WLAN-Venue-Info — Venue group and venue type.
- 183WLAN-Venue-Language — Language of the venue name that follows.
- 184WLAN-Venue-Name — Name of the venue, in UTF-8.
- 185WLAN-Reason-Code — Why access was refused.
- 186WLAN-Pairwise-Cipher — Pairwise ciphersuite in use.
- 187WLAN-Group-Cipher — Group ciphersuite in use.
- 188WLAN-AKM-Suite — Authentication and key management suite.
- 189WLAN-Group-Mgmt-Cipher — Group management cipher.
- 190WLAN-RF-Band — Radio frequency band in use.
| Attribute | Access-Request | Access-Accept | Access-Reject | Access-Challenge |
|---|---|---|---|---|
| Allowed-Called-Station-Id | 0 | 0+ | 0 | 0 |
| EAP-Key-Name THIS RFC | 0-1 | 0-1 | 0 | 0 |
| EAPoL-Announcement | 0+ | 0+ | 0+ | 0+ |
| WLAN-Reason-Code | 0 | 0 | 0-1 | 0 |
§5Security Considerations
Because this document describes the use of RADIUS for authentication, authorization and accounting in IEEE 802 networks, it is vulnerable to all of the threats that are present in other RADIUS applications. The RFC points at RFC 2607, RFC 2865, RFC 3162, RFC 3579, RFC 3580 and RFC 5176 for a discussion of those threats.
One point is called out directly. When RADIUS traffic is sent in the clear, the attributes defined in this document can be obtained by an attacker snooping the exchange between the RADIUS client and server. RADIUS confidentiality is therefore desirable, and the RFC refers to RFC 6421 for a review of RADIUS security and crypto-agility requirements.
The RFC also discusses using the WLAN attributes to make access decisions. A RADIUS server can decide whether to accept or reject an Access-Request based on the values of the WLAN-Pairwise-Cipher, WLAN-Group-Cipher, WLAN-AKM-Suite, WLAN-Group-Mgmt-Cipher and WLAN-RF-Band attributes, but the value of doing so is limited. In general an Access-Reject should not be necessary, except where access points and stations are misconfigured so as to enable connections with unacceptable values, and in that case users would be better served by fixing the misconfiguration than by having their access rejected on an ongoing basis.
Where access does need to be rejected, the user should be given a reason. If the WLAN-Pairwise-Cipher, WLAN-Group-Cipher, WLAN-AKM-Suite or WLAN-Group-Mgmt-Cipher values in the Access-Request are not acceptable to the RADIUS server, then a WLAN-Reason-Code Attribute with a value of 29, requested service rejected because of service provider ciphersuite or AKM requirement, SHOULD be returned in the Access-Reject. If the WLAN-RF-Band value is not acceptable, then a WLAN-Reason-Code Attribute with a value of 11, disassociated because the information in the Supported Channels element is unacceptable, SHOULD be returned in the Access-Reject.
Sending RADIUS traffic in the clear exposes everything in these attributes to anyone watching the exchange. The RFC also says that rejecting a user for using a weak cipher is usually the wrong fix: the access point should be reconfigured instead.