Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
In the CISSP books, SSL/TLS has been through the arguments and fell rest onto the transport layer 2 instead of the session. OK - Fine.
Port security 802.1X and EAP is a data link layer 2 authentication mechanism. Since EAP is a framework, it consists of EAP-TLS (among others like EAP-TTLS, PEAP and LEAP).
There maybe something silly I am missing here, but how can the book call EAP-TLS a layer 2 authentication mechanism when TLS doesn't even kick into the picture until layer 4?
The "layers" are from an old ISO abstract classification which has been applied to how things really run in the physical world, often with the rhetorical equivalent of a sledgehammer. You should not try to follow layers as gospel, it will often lead to confusion.
SSL/TLS is a protocol which can be applied over a bidirectional data tunnel, and which provides a bidirectional data tunnel, with authentication (server by client, or mutual), confidentiality (through encryption) and verified integrity. In terms of "layers", it goes right between layer 4 and layer 6 of the OSI model, which shows that the concept of "layers" fails to capture the actual position of SSL/TLS.
It so happens that the authentication part of SSL/TLS (the "handshake") consists in a series of messages, which are exchanged in an alternate sequence; see the TLS specification, page 36, for a diagram showing that sequence. In "normal" SSL/TLS, the messages are exchanged over whatever bidirectional data tunnel SSL/TLS is applied on, usually a TCP connection. However, the cryptographic properties of the handshake come from the message contents, not from how they are sent. At that point, consider EAP: this is a framework for authentication protocols, consisting in messages; EAP is meant to be used over any transport mechanism which can send messages ("layer 2" if you really want to think about it in layers). Hence EAP-TLS has been defined: this is an authentication protocol, consisting in a sequence of messages which are the ones specified for the SSL/TLS handshake -- but sent as so many messages over the transport mechanism used by EAP. EAP-TLS is not TLS, it does not provide a tunnel for data; it is a protocol which reuses parts of the handshake which occurs at the beginning of a TLS connection.
