RE: RE: [LinkSec] Requirements
> And yet, the real problem is that the MAC address is not
> fixed, and can easily be spoofed.
Authentication of MAC addresses is a flaw not a feature. MAC addresses should NOT be used as the authenticated identity. Reasons:
1) The MAC address may not be 'end-to-end' over a 'link'
example - IPsec with NAT
2) MAC addresses can be media specific
ok for 802, but limits wider architectural application
3) Limits user mobility (versus device mobility)
4) Does not allow anonymous MAC addresses
(802.11 currently allows easy tracking of users)
5) Spoofing of MAC addresses is not a risk when pair-wise keys are used
(authentication is provided of originator and data without using addresses)
6) Devices may have multiple MAC addresses
7) Prevent architectural usage of vlan tags with cryptographic mechanisms
(much longer discussion ... several vlan/partitioning options)