## Chapter 6 — A hardware address is not a proof of identity ### Lesson map Lesson 06. Map, example, EX052. ```mermaid flowchart TD P["A label is presented"] --> L["DHCP records a lease"] L --> D{"Is the label in the known dictionary?"} D -->|Yes| N["Print the typed name"] D -->|No| U["Print UNKNOWN"] ``` The dictionary was typed by a person. The lease was not a credential check. ### Logical drawing ```text presented label --> lease row --> dictionary lookup aa:01 --> till-1 bb:77 --> UNKNOWN known but not seen: [] ``` ### Learning outcomes After this chapter, you should be able to: 1. Separate a presented hardware label from a proof of who holds the device. 2. Read the empty "known but not seen" side correctly. 3. Refuse to treat the synthetic abbreviations as a full address you can look up. ### 6.1 DHCP assigns an address. It does not authenticate the holder. Dynamic Host Configuration Protocol, specified in RFC 2131, is how a client asks a server for an address and related parameters, and how the server grants that assignment for a limited time. In ordinary practice the server records the hardware address the client presents. The bakery script models a smaller slice of that idea: each lease is a pair, a label and an IPv4 address, and the print looks the label up in a dictionary a person wrote. `aa:01` prints as `till-1` because the dictionary says so. `bb:77` prints as `UNKNOWN` because the dictionary has no such key. Nothing in the run checks a certificate, a password, or a user account. That distinction matters for the control Ellen can actually buy with this exercise. The CIS Controls start from an inventory you maintain. The dictionary is that inventory. The lease list is an observation of labels that asked for addresses. Agreement between them is evidence about this export. It is not a proof that the plastic box at the till is the one Ellen bought, and it is not a proof that no other device exists in the building. The empty side of the print, `known but not seen: []`, means every key in this dictionary appeared in this list. It does not mean the shop was watched all day. Chapter 3 already gives the operational reason for exporting after closing: customer phones have left, so the remaining rows are easier to discuss. The script does not print a time of day. The labels themselves are a teaching limit. A real IEEE hardware address is 48 bits, often written as six octets. The file uses short tokens such as `aa:01` and `bb:77`. Those tokens cannot be resolved to a manufacturer, and this book does not pretend they can. Treating them as a full address would invent evidence. NIST SP 800-153 discusses knowing which wireless devices you intend to allow. It does not turn a presented label into an identity document. A later design can add per-person sign-in. This file does not record one. ### 6.2 Worked example | Claim about the lease run | What the run actually did | Decision | |---|---|---| | "`aa:04` is the card reader because the dictionary says so." | A lookup | May stay | | "`known but not seen: []` means every known label appeared." | The second set difference | May stay | | "`bb:77` proved who carried the device." | No credential was checked | Refuse | | "The short tokens are full manufacturer addresses." | The file abbreviated them | Refuse | > **Synthetic case.** The dictionary and the leases are the synthetic pairs printed in chapter 3. ### Errors and limits An empty missing-side is a fact about this dictionary and this list. It is not a day-long census of the shop. ### Apply - **EX052 — What does the lookup prove?** The print maps `aa:01` to till-1 and `bb:77` to UNKNOWN, and it shows an empty known-but-not-seen list. Does that run authenticate the holder, and may you expand `aa:01` into a full manufacturer address? *Rubric:* 3 = no authentication and no expansion; the dictionary supplies the name; the empty side means every known label appeared in this list; the tokens stay abbreviated;; 2 = the lookup stays a lookup and the tokens stay short;; 1 = the empty side only;; 0 = none. ### Continue studying — lesson 06 (chapter 06 of 20) [← Chapter 05](#ch-05) · [Course chapter index](../SUBJECTS.md) · [Chapter 07 →](#ch-07) Continue to the next authored lesson. ## Worked answers **EX052.** No. The dictionary supplies the printed name. The empty side means every known label appeared in this list. The run does not authenticate the holder, and the short tokens stay abbreviated.