Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the CISSP books, SSL/TLS has been through the arguments and fell rest onto the transport layer 2 instead of the session. OK - Fine.

Port security 802.1X and EAP is a data link layer 2 authentication mechanism. Since EAP is a framework, it consists of EAP-TLS (among others like EAP-TTLS, PEAP and LEAP).

There maybe something silly I am missing here, but how can the book call EAP-TLS a layer 2 authentication mechanism when TLS doesn't even kick into the picture until layer 4?

share|improve this question
1  
I'm not sure I understand your question clearly. Could you perhaps elaborate a bit as to what "arguments" there have been over SSL/TLS, and your current understanding of SSL/TLS vs. EAP-TLS? –  Iszi May 2 '11 at 12:18
    
@Iszi - Putting real life into OSI layers is not cool, but passing tests (CISSP) makes me do it. SSL has to go into 1 layer. My text book mentioned that some professionals said it should go into Layer 5 (session) while others said it should go into Layer 4 (transport). Layer 4 won. Any question on an exam that asks "Which layer of the OSI does SSL/TLS fall into" will have a correct answer (earning one a higher grade) of LAYER 4 (Transport). –  Abdu May 3 '11 at 16:17
    
@Isza - Pornin answered my question: It doesn't matter what layer the text book calls it. A layer 2 authentication (802.1x) can use a (text book) layer 4 protocol (TLS in the EAP-TLS combo) without actually (physically) TRAVELLING UP THROUGH THE LAYERS to make the TLS handshakes happen. I was just thinking that if TLS is involved, the incoming streams of data remain insecure passing through Layer 2 and 3 (Data Link and Network) until it reaches Layer 4 (Transport) for the TLS handshakes of authentication, confidentiality and integrity. –  Abdu May 3 '11 at 16:26
    
CONTINUED..... So I questioned the text book - why call 802.1x/EAP-TLS a layer 2 operation (which is secure because it secures the data stream as soon as the electrons are pulled off the wire) when TLS makes me think it is a layer 4 operation. –  Abdu May 3 '11 at 16:26

1 Answer 1

up vote 9 down vote accepted

The "layers" are from an old ISO abstract classification which has been applied to how things really run in the physical world, often with the rhetorical equivalent of a sledgehammer. You should not try to follow layers as gospel, it will often lead to confusion.

SSL/TLS is a protocol which can be applied over a bidirectional data tunnel, and which provides a bidirectional data tunnel, with authentication (server by client, or mutual), confidentiality (through encryption) and verified integrity. In terms of "layers", it goes right between layer 4 and layer 6 of the OSI model, which shows that the concept of "layers" fails to capture the actual position of SSL/TLS.

It so happens that the authentication part of SSL/TLS (the "handshake") consists in a series of messages, which are exchanged in an alternate sequence; see the TLS specification, page 36, for a diagram showing that sequence. In "normal" SSL/TLS, the messages are exchanged over whatever bidirectional data tunnel SSL/TLS is applied on, usually a TCP connection. However, the cryptographic properties of the handshake come from the message contents, not from how they are sent. At that point, consider EAP: this is a framework for authentication protocols, consisting in messages; EAP is meant to be used over any transport mechanism which can send messages ("layer 2" if you really want to think about it in layers). Hence EAP-TLS has been defined: this is an authentication protocol, consisting in a sequence of messages which are the ones specified for the SSL/TLS handshake -- but sent as so many messages over the transport mechanism used by EAP. EAP-TLS is not TLS, it does not provide a tunnel for data; it is a protocol which reuses parts of the handshake which occurs at the beginning of a TLS connection.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.