Subject: Re: [Pana] [issue131] Proposed text, solicitation for comments.

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 13 Dec 2004 16:15:02 -0500

I think that the relationship between EAP peer, EAP authenticator, EAP
server, PaC and PAA should be defined in the definition of PaC and
PAA, since the relationship does not depend on whether a AAA-Key is
derived from the EAP authentication method.  So I'd suggest revising
the definition of PaC and PAA as follows (and suggest keep the current
AAA-Key definition as it is):

from (pana-pana-07b):

"
   PANA Client (PaC):

      The client side of the protocol that resides in the access device
      (e.g., laptop, PDA, etc.).  It is responsible for providing the
      credentials in order to prove its identity (authentication) for
      network access authorization.

   PANA Authentication Agent (PAA):

      The protocol entity in the access network whose responsibility is
      to verify the credentials provided by a PANA client (PaC) and
      authorize network access to the device associated with the client
      and identified by a Device Identifier (DI).  Note the
      authentication and authorization procedure can, according to the
      EAP model, be also offloaded to the backend AAA infrastructure.
"

to:

"
   PANA Client (PaC):

      The client side of the protocol that resides in the access device
      (e.g., laptop, PDA, etc.).  It is responsible for providing the
      credentials in order to prove its identity (authentication) for
      network access authorization.  The PaC and the EAP peer are
      co-located in the same access device.

   PANA Authentication Agent (PAA):

      The protocol entity in the access network whose responsibility is
      to verify the credentials provided by a PANA client (PaC) and
      authorize network access to the device associated with the client
      and identified by a Device Identifier (DI).  The PAA and the EAP
      authenticator (and optionally the EAP server) are co-located in
      the same node.  Note the authentication and authorization
      procedure can, according to the EAP model, be also offloaded to
      the backend AAA infrastructure.
"

What do you think?

Yoshihiro Ohba

On Mon, Nov 29, 2004 at 03:06:18PM +0200, [email-masked] wrote:
> Solicitation for comments, if any.
> - Dan
> 
> http://danforsberg.info:8080/pana-issues/issue131
> Issue131: Clarify AAA-Key "end-points" 
> Dan:
> 
> "   AAA-Key:"
> Change from:
> 
>       "A key derived by the EAP peer and EAP server and transported to
>       the authenticator [I-D.ietf-eap-keying]."
> 
> To:
> 
>       "A key derived by the EAP peer and EAP server and transported to
>       the authenticator [I-D.ietf-eap-keying].  In this document PaC is
>       assumed to be an EAP peer and PAA the authenticator or the EAP
>       server."
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: [email-masked]
Date: Tue, 14 Dec 2004 10:03:41 +0200

Ok, agreed.
- Dan

> -----Original Message-----
> From: ext Yoshihiro Ohba [mailto:[email-masked]]
> Sent: 13 December, 2004 23:15
> To: Forsberg Dan (Nokia-NRC/Helsinki)
> Cc: [email-masked]
> Subject: Re: [Pana] [issue131] Proposed text, solicitation 
> for comments.
> 
> 
c