Subject: Re: [pcp] #72 (authentication): PCP server discovery & PCP authentication

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Fri, 18 Apr 2014 11:54:37 +0000

> -----Original Message-----
> From: Sam Hartman [mailto:[email-masked]]
> Sent: Friday, April 18, 2014 7:57 AM
> To: Tirumaleswar Reddy (tireddy)
> Cc: Ted Lemon; Zhangdacheng (Dacheng); [email-masked]; pcp issue tracker;
> Stephen Farrell
> Subject: Re: [pcp] #72 (authentication): PCP server discovery & PCP
> authentication
> 
> >>>>> "Tirumaleswar" == Tirumaleswar Reddy (tireddy) <[email-masked]>
> writes:
> 
>     Tirumaleswar> We may want to explore the third option. EAP-FAST
> (http://tools.ietf.org/html/rfc5422) also has a similar problem and uses A-ID is
> used to uniquely identify the authentication server.
> 
> If this is something that some EAP methods do, then it seems like a bad choice
> for PCP to also do.  

But A-ID is sent in PAC TLV within EAP Method EAP-FAST that enables secure communication between a peer and a server by using the Transport Layer Security (TLS). In PCP authentication, EAP method will not be EAP-FAST.
So why is it a bad method for PCP authentication to solve the problem similarly i.e. give hint of the server's identity that would be useful in helping the PCP client in selecting the appropriate credential to use ?

-Tiru

> Clark's original end to end argument generalizes to the idea
> that it is rarely a good idea to do the same thing at multiple layers.
> That seems to apply here.