IEEE 802 Privacy Threat Analysis Brian Weis, Jerome Henry Cisco Systems 01/15/17 1 Introduction ..................................................................................................................................................... 2 2 Scope .................................................................................................................................................................. 2 3 Terms ................................................................................................................................................................. 2 4 Goals of Adversaries ..................................................................................................................................... 3 5 IEEE 802 PII ...................................................................................................................................................... 3 5.1 IEEE 802 Common fields ..................................................................................................................... 3 5.2 IEEE 802.1 ................................................................................................................................................ 4 5.2.1 Encapsulated MAC address ......................................................................................................................... 4 5.2.2 Priority Code Point ......................................................................................................................................... 4 5.2.3 VLAN Identifier (IEEE 802.1Q) .................................................................................................................. 5 5.2.4 Congestion Notification Tag (IEEE 802.1Q) ......................................................................................... 5 5.2.5 LLDP (IEEE 802.1AB) .................................................................................................................................... 5 5.2.6 Port-Based Network Access Control (IEEE 802.1X) ......................................................................... 6 5.3 IEEE 802.3 ................................................................................................................................................ 7 5.4 IEEE 802.11 .............................................................................................................................................. 7 5.4.1 IEEE 802.11 Common fields ....................................................................................................................... 7 5.4.2 IEEE 802.11 Beacon frames ........................................................................................................................ 8 5.4.3 IEEE 802.11 DMG Beacon frames ............................................................................................................. 9 5.4.4 IEEE 802.11 Probe responses .................................................................................................................... 9 5.4.5 IEEE 802.11 ATIM Frame ............................................................................................................................. 9 5.4.6 IEEE 802.11 Disassociation Frame ........................................................................................................ 10 5.4.7 IEEE 802.11 Association Request Frame (Management frame) ............................................... 10 5.4.8 IEEE 802.11 Association Response Frame (Management frame) ............................................ 10 5.4.9 IEEE 802.11 Reassociation Request Frame (Management frame) .......................................... 11 5.4.10 IEEE 802.11 Reassociation Response Frame (Management frame) ....................................... 11 5.4.11 IEEE 802.11 Probe Request Frame (Management frame) .......................................................... 11 5.4.12 IEEE 802.11 Authentication Frame (Management frame) .......................................................... 11 5.4.13 IEEE 802.11 Deauthentication Frame (Management frame) ..................................................... 12 5.4.14 IEEE 802.11 Action Frames (Management frame) ......................................................................... 12 5.4.15 IEEE 802.11 Action no ACK Frames (Management frame) ......................................................... 12 5.4.16 IEEE 802.11 Timing Advertisement Frame (Management frame) .......................................... 12 5.5 IEEE 802.15 ........................................................................................................................................... 12 5.5.1 IEEE 802.15 management frames .......................................................................................................... 13 6 Acknowledgments ...................................................................................................................................... 13 7 References ..................................................................................................................................................... 13 Appendix A Detailed Privacy Threat Analysis ......................................................................................... 14 A.1 IEEE 802 Destination MAC Address and Source MAC Address ............................................ 14 A.2 802.1 Threat Analyses ...................................................................................................................... 14 A.2.1 802.1Q Frames ................................................................................................................................................ 14 A.2.2 IEEE 802.1AB Frames .................................................................................................................................. 16 A.2.3 IEEE 802.1X EAPOL Frames ..................................................................................................................... 17 A.2.4 IEEE 802.1AE frame ..................................................................................................................................... 18 A.3 IEEE 802.3 frame ................................................................................................................................ 18 1/15/17 1 Brian Weis A.4 IEEE 802.11 ........................................................................................................................................... 18 A.4.1 Beacon Frame (Management frame) .................................................................................................... 18 A.4.2 DMG Beacon Frame (Management frame) ......................................................................................... 23 A.4.3 Probe Response Frame (Management frame) .................................................................................. 24 A.4.4 ATIM Frame (Management frame) ........................................................................................................ 25 A.4.5 Disassociation Frame (Management frame) ..................................................................................... 25 A.4.6 Association Request Frame (Management frame) .......................................................................... 27 A.4.7 Association Response Frame (Management frame) ...................................................................... 29 A.4.8 Reassociation Request Frame (Management frame) ..................................................................... 32 A.4.9 Reassociation Response Frame (Management frame) .................................................................. 32 A.4.10 Probe Request Frame (Management frame) ..................................................................................... 33 A.4.11 Authentication Frame (Management frame) .................................................................................... 34 A.4.12 Deauthentication Frame (Management frame) ................................................................................ 35 A.4.13 Action Frame (Management frame) ...................................................................................................... 36 A.4.14 Action no Ack Frame (Management frame) ....................................................................................... 50 A.4.15 Timing Advertisement Frame (Management frame) ..................................................................... 50 FIGURE 1. IEEE 802.1AE SYSTEM CHANNEL IDENTIFIER ........................................................................................................ 4 FIGURE 2. VLAN TCI FORMAT ....................................................................................................................................................... 5 FIGURE 3. LLDP PDU ...................................................................................................................................................................... 5 FIGURE 4. EAPOL TYPES ................................................................................................................................................................. 6 FIGURE 5. IEEE 802.3 FRAME ........................................................................................................................................................ 7 1 Introduction IEEE 802 standards are a set of protocols that provide network communication for frame-based data networks. Various protocol frame formats and data fields provide