Subject: Secure Remote Password SASL

From: "Robert Boxall" <[email-masked]>
Date: Tue, 19 Mar 2002 07:59:35 -0600

Take a look at Secure Remote Password SASL Mechanism draft

This is well written draft with SRP and mutual authentication and some
framework for other important issues that we face. 

http://search.ietf.org/internet-drafts/draft-burdis-cat-srp-sasl-06.txt

-----Original Message-----
From: Reinaldo Penno [mailto:[email-masked]] 
Sent: Tuesday, March 19, 2002 7:39 AM
To: Sam Hartman; [email-masked]
Subject: Re: EAP is not a good fit for non-trivial PANA

You mean 

draft-myers-saslrev-01.txt?

thanks,

Reinaldo Penno

--- Sam Hartman <[email-masked]> wrote:
> 
> 
> 
> Hi.  I brought up the issue of SASL or GSSAPI as a
> better fit than EAP
> for PANA's requirements at the meeting today and I'd
> like to discuss
> that here.
> 
> First, I acknowledge that if EAP is a complete
> solution for PANA--that
> is, if PANA needs to add no additional functionality
> not provided in
> EAP, then using EAP is reasonable.  I don't think
> that EAP without
> additional information is sufficient for PANA's
> needs, but if for some
> reason PANA is trimmed sufficiently that EAP meets
> its requirements
> without modifications then it seems reasonable to
> use EAP.
> 
> However, if PANA needs to add functionality to EAP,
> then EAP is not a
> good fit.  This is because EAP does not provide
> integrity protection
> or confidentiality for anything outside the EAP
> messages themselves;
> some EAP mechanisms may not even provide this
> protection for parts of
> the EAP exchange.
> 
> 
> If PANA wanted to use EAP, it could attempt to
> extend EAP to provide
> this functionality, or violate the EAP abstraction
> and take advantage
> of the keying inherent in some of the EAP
> mechanisms.
> -
> However it seems silly to do that given that there
> are IETF protocols
> that better fit PANA's needs.  As far as I can tell
> reading the PANA
> requirements drafts SASL provides everything that
> PANA needs from a
> lower-layer authentication mechanism, and does not
> have the defects of
> EAP from PANA's usage.
> 
> Thus I propose that PANA use SASL rather than EAP as
> the basis for its
> authentication.
> 
> I'm sure there are going to be a lot of questions
> about this.  One
> possible direction would be to specifically
> enumerate the requirements
> for a protocol on which we build PANA.  Then we can 
> evaluate IETF
> technologies based on these requirements.
> 
> --Sam
> 

__________________________________________________
Do You Yahoo!?
Yahoo! Sports - live college hoops coverage
http://sports.yahoo.com/