Subject: RE: Personal drafts, e.g. eap-ske, and future of PPPEXT

From: "Glen Zorn" <[email-masked]>
Date: Thu, 31 Jan 2002 22:06:17 -0800

Erik Nordmark [mailto:[email-masked]] writes:

...

> > >Carrying EAP over foo might be better done in the foo working group.
> >
> > Are there IP and ICMP working groups? :-) Some EAP encapsulations might
> > just be generic enough to not fit within any other working group. But I
> > still have to read all the PANA stuff which might render those
> redundant :-/
>
> EAP over ICMP is a potential solution for PANA (even though the
> WG shouldn't
> look at solutions right now).
> Is EAP over IP the IPSRA PIC stuff or something else?

Yes, PIC but also see
http://www.ietf.org/internet-drafts/draft-engelstad-pana-eap-over-ip-00.txt

...

---

From: Luca Salgarelli <[email-masked]>
Date: 01 Feb 2002 09:27:29 -0500

Hello Erik.

[ I have removed yours and other people's addresses because I figured
that you are subscribed to the pppext mailing list anyway ]

I have added some comments inline:

> Such WGs don't tend to work well.
> It isn't the "scenario" that is important, be it satelite communication,
> IP over wireless, or public WLANs. When new forms of communication add
> new attributes or change the value range for existing attributes it
> makes sense to have a WG looking at the problem.
> 
> Thus TCP over long delay links with or without packet loss makes sense.
> Also, header compression over lossy links.
> 
> And looking at security issues for the case when everybody on the same
> LAN are not trusted as much as they are in a university or corporate
> setting also makes sense.
> But whether this LAN is built using 802.11 or IP over avian carriers
> doesn't have any bearing on the problem statement.

Right. My understanding of PANA is that it is developing requirements
for a protocol, and eventually the protocol itself, that will transport
user authentication information back and forth from the user's device to
authentication servers, regardless of the underlying L3 (IPv4 or IPv6)
and lower layers.

I see this (correct me if I am wrong) as a "generalized EAP", i.e. the
protocol will specify how to carry authentication information, but will
not specify what kind of information will be transported or the
authentication algorithm itself. This "generalized EAP" might as well be
some evolution of EAP.

The problem is that once you have defined that you still need to write
requirements, analyze security issues and write protocols that will
actually perform authentication over [protocol that PANA will define].

The need for these new protocols seems evident to me, given that open
and public networks based on IP, where people roam, are becoming more
and more available. Applying existing authentication protocols to these
networks might not work well at all. The number of proposals that have
been submitted to ppp-ext in this sense also say that a number of
entities (myself included) do see the need for these new protocols. Or
at least they suggest that existing protocols don't seem to be enough
for these new scenarios.

If you agree on this assessment, the question is: will PANA be
responsible for the work on requirement, analysis and protocol
specification for these authentication protocols? If not, shouldn't a WG
exist in the IETF to do such work?

Thanks
Luca

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 5 Feb 2002 16:58:29 +0100 (CET)

> that you are subscribed to the pppext mailing list anyway ]

Yes, but that might mean it takes a week longer for me to get to the email
compared to if my name is in the to or cc lines. This time you were lucky :-)
 
> authentication algorithm itself. This "generalized EAP" might as well be

I see PANA more as figuring how to carry EAP well on a multi-access link
and perhaps also over several router hops to the PAA (which has the same
role in authentication as the NAS does for PPP).

> at least they suggest that existing protocols don't seem to be enough

What you call "protocols" above I think is what is referred to as "EAP
methods".

> exist in the IETF to do such work?

There has been suggestions that there be an EAP working group
that take on the responsibility of specifying new EAP methods.
But exactly what such a WG would and would not deliver is not well-understood
(at least not by me).
If you have comments you can send the to me.
(Or if others on pppext are interested we can have this discussion on this
list. The best would be for somebody to setup an eap mailing list for such
scope discussions.)

  Erik

---

From: Jacques Caron <[email-masked]>
Date: Tue, 05 Feb 2002 17:12:56 +0100

>list. The best would be for somebody to setup an eap mailing list for such

Oh, an informal WG :-)

Jacques.

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

---

From: Luca Salgarelli <[email-masked]>
Date: 05 Feb 2002 11:14:24 -0500

Hello Erik.

> compared to if my name is in the to or cc lines. This time you were lucky :-)

Ouch, I didn't think about that. This time your address is in.

> role in authentication as the NAS does for PPP).

Ok. That still means that they will not undertake the standardization of
EAP methods, right?

> What you call "protocols" above I think is what is referred to as "EAP

Right. I guess I personally do not completely agree on the term "method"
as it is used in EAP, but of course I'll conform to that terminology.
"EAP methods" was what I meant with "protocols" above.

> But exactly what such a WG would and would not deliver is not well-understood

I guess the major goal of such WG should be to write requirements and
specifications for new EAP methods. Wouldn't this be enough already?

> list. The best would be for somebody to setup an eap mailing list for such

I would suggest to keep the discussion for now on PPPEXT, since the all
of the proposed new EAP schemes where originally circulated in this WG.

Regards
Luca

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 5 Feb 2002 17:21:07 +0100 (CET)

> >list. The best would be for somebody to setup an eap mailing list for such

More like a place to do prepwork before there can be a BoF.

  Erik

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 5 Feb 2002 17:22:58 +0100 (CET)

> Ok. That still means that they will not undertake the standardization of

Correct. (I think there are words in the PANA charter that tries to
say it is explicitly out of scope.)

   Erik