Subject: EAP is not a good fit for non-trivial PANA

From: Sam Hartman <[email-masked]>
Date: Mon, 18 Mar 2002 21:14:39 -0500 (EST)

Hi.  I brought up the issue of SASL or GSSAPI as a better fit than EAP
for PANA's requirements at the meeting today and I'd like to discuss
that here.

First, I acknowledge that if EAP is a complete solution for PANA--that
is, if PANA needs to add no additional functionality not provided in
EAP, then using EAP is reasonable.  I don't think that EAP without
additional information is sufficient for PANA's needs, but if for some
reason PANA is trimmed sufficiently that EAP meets its requirements
without modifications then it seems reasonable to use EAP.

However, if PANA needs to add functionality to EAP, then EAP is not a
good fit.  This is because EAP does not provide integrity protection
or confidentiality for anything outside the EAP messages themselves;
some EAP mechanisms may not even provide this protection for parts of
the EAP exchange.

If PANA wanted to use EAP, it could attempt to extend EAP to provide
this functionality, or violate the EAP abstraction and take advantage
of the keying inherent in some of the EAP mechanisms.
-
However it seems silly to do that given that there are IETF protocols
that better fit PANA's needs.  As far as I can tell reading the PANA
requirements drafts SASL provides everything that PANA needs from a
lower-layer authentication mechanism, and does not have the defects of
EAP from PANA's usage.

Thus I propose that PANA use SASL rather than EAP as the basis for its
authentication.

I'm sure there are going to be a lot of questions about this.  One
possible direction would be to specifically enumerate the requirements
for a protocol on which we build PANA.  Then we can  evaluate IETF
technologies based on these requirements.

--Sam

---

From: Reinaldo Penno <[email-masked]>
Date: Tue, 19 Mar 2002 05:38:55 -0800 (PST)

You mean 

draft-myers-saslrev-01.txt?

thanks,

Reinaldo Penno

> technologies based on these requirements.

__________________________________________________
Do You Yahoo!?
Yahoo! Sports - live college hoops coverage
http://sports.yahoo.com/

---

From: Sam Hartman <[email-masked]>
Date: 19 Mar 2002 14:26:31 -0500

>>>>> "Reinaldo" == Reinaldo Penno <[email-masked]> writes:

    Reinaldo> You mean draft-myers-saslrev-01.txt?

    Reinaldo> thanks,

You can certainly look at that draft, although RFC 2222 is also fairly
reasonable.