On Mon, 14 Feb 2022 09:58:12 +0100 Hans Schultz wrote:

On fre, feb 11, 2022 at 14:59, Jakub Kicinski [off-list ref] wrote:

quoted

On Wed,  9 Feb 2022 14:05:32 +0100 Hans Schultz wrote:  

quoted

The most common approach is to use the IEEE 802.1X protocol to take
care of the authorization of allowed users to gain access by opening
for the source address of the authorized host.  

noob question - this is 802.1x without crypto? I'm trying to understand
the system you're describing.  

No, user space will take care of authentication, f.ex. hostapd, so in a
typical setup the supplicant and the authentication daemon will take
care of all crypto related stuff in their communication.
So the authentication daemon will open the port for the authenticated
supplicant.

To be clear - I'm talking about wire crypto after all the communication
with the control plane and after the connection the port is opened. Not
crypto in whatever authentication method gets used. Does the device get
the keys somehow from user space?

See the cover letter.

Which part of it?