Subject: [Pana] EAP-Request/Identity & PANA-Start-Request

From: [email-masked]
Date: Fri, 10 Oct 2003 15:53:06 +0300

PANA folks,

We have PANA-Start-Request/Answer messgae pair carrying Cookie.
Then we have the first PANA-Auth-Request/Answer message pair 
carrying EAP-Request/Identity and EAP-Response/Identity. The 
EAP-Request/Identity is generated in the PAA/NAS, because/which 
at that point doesn't know the realm for the user. EAP header 
also contains the identifier field which is somewhat analoguous 
to PANA cookie. Why not to put the first EAP payload AVP into 
the PANA-Start-Request message? This doesn't bring any new 
requirements for the PAA to create state information, because 
the EAP header identifier field can act similarly to PANA cookie 
AVP... or in the extreme we could drop the cookie AVP and use 
the EAP identifier field as the "cookie".

Let me hear your comments.

Br,
- Dan

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 10 Oct 2003 08:34:44 -0700

> the EAP identifier field as the "cookie".

There are two things we need to consider here:

o The first EAP Request sent by the EAP authenticator is not always
  EAP-Request/Identity, i.e., the use of EAP-Request/Identity is optional when
  the client identity can be obtained by some other means.

o EAP state machine (draft-ietf-eap-statemachines-00.{txt,ps}) does
  not allow an EAP authenticator to be stateless when sending the first EAP Request.

So in general PAA cannot be stateless when sending a PANA-Start-Request 
with piggybacking an EAP Request.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 10 Oct 2003 08:34:44 -0700

Yoshihiro Ohba