Subject: To EAP or Not To EAP?

From: "James Kempf" <[email-masked]>
Date: Wed, 6 Mar 2002 16:12:51 -0800

Ok, folks, as Alper requested, here is a thread to start the discussion.

My 0.02 euro: we should EAP. Every other authentication protocol is
using EAP. IETF is about to spin up a WG to standardize EAP independent
of PPP. Unless we can find a really good reason not to (and I can't
think of one right now), then I think we ought to do it. Can anyone come
up with a good reason not to?

            jak

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 07 Mar 2002 11:59:26 +0100

"James Kempf" <[email-masked]> writes:

> My 0.02 euro: we should EAP.

I think this is a good idea as well.

> Every other authentication protocol is using EAP. IETF is about to
> spin up a WG to standardize EAP independent of PPP. Unless we can
> find a really good reason not to (and I can't think of one right
> now), then I think we ought to do it. Can anyone come up with a good
> reason not to?

Not really.

It seems as if the charter excludes working on aspects of the
authentication protocol that is crucial for PANA: "The WG will not
invent new security protocols and mechanism but instead will use
existing mechanisms".

It seems as if PANA cannot move forward unless it provides input to
other working groups (e.g., EAP) that work on the security protocol.
As Bernard pointed out, EAP is not suitable as a solution to PANA as
it stands right now.  There is no key hierarchy definition, there is
no discussion on how mobility is supported in re-authentication, there
is no discussion on how to locate the IP of the PAA, there are
technical problems in how the protocol works, and I'm sure there are
more issues.

I agree with Bernard that time would be well spent on working on
security requirements for PANA, which can be input to a EAP working
group so that it can design a security protocol that will fit PANA.

/Simon