Subject: RE: [Pana] EAP-Request/Identity & PANA-Start-Request

From: [email-masked]
Date: Mon, 13 Oct 2003 14:58:50 +0300

Hi Yoshihiro,

Your arguments are not exactly valid. 

We could also say that PaC sends always EAP-Payload AVP 
that contains EAP-Response/Identity in the PANA-Start-Answer 
message. I.e. no EAP-Request is necessarily needed from PAA.

PAA can itself create the EAP-Request thus the authenticator 
is not involved.

Otherwise PaC needs to send it's identity to the PAA out 
of the EAP so that PAA/NAS can contact the right authenticator.

- Dan

> -----Original Message-----
> From: ext Yoshihiro Ohba [mailto:[email-masked]]
> Sent: 10 October, 2003 18:35
> To: Forsberg Dan (NRC/Helsinki)
> Cc: [email-masked]
> Subject: Re: [Pana] EAP-Request/Identity & PANA-Start-Request
>
>
> On Fri, Oct 10, 2003 at 03:53:06PM +0300,
> [email-masked] wrote:
> > PANA folks,
> >
> > We have PANA-Start-Request/Answer messgae pair carrying Cookie.
> > Then we have the first PANA-Auth-Request/Answer message pair
> > carrying EAP-Request/Identity and EAP-Response/Identity. The
> > EAP-Request/Identity is generated in the PAA/NAS, because/which
> > at that point doesn't know the realm for the user. EAP header
> > also contains the identifier field which is somewhat analoguous
> > to PANA cookie. Why not to put the first EAP payload AVP into
> > the PANA-Start-Request message? This doesn't bring any new
> > requirements for the PAA to create state information, because
> > the EAP header identifier field can act similarly to PANA cookie
> > AVP... or in the extreme we could drop the cookie AVP and use
> > the EAP identifier field as the "cookie".
>
> There are two things we need to consider here:
>
> o The first EAP Request sent by the EAP authenticator is not always
>   EAP-Request/Identity, i.e., the use of EAP-Request/Identity
> is optional when
>   the client identity can be obtained by some other means.
>
> o EAP state machine (draft-ietf-eap-statemachines-00.{txt,ps}) does
>   not allow an EAP authenticator to be stateless when sending
> the first EAP Request.
>
> So in general PAA cannot be stateless when sending a
> PANA-Start-Request
> with piggybacking an EAP Request.
>
> Yoshihiro Ohba
>
>
>
> >
> > Let me hear your comments.
> >
> > Br,
> > - Dan
> >
> > _______________________________________________
> > Pana mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/pana
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 13 Oct 2003 09:24:59 -0700

Hi Dan,

> message. I.e. no EAP-Request is necessarily needed from PAA.

EAP does not allow EAP peers to unsolicitedly send EAP-Response.

> PAA can itself create the EAP-Request thus the authenticator 

The current EAP authenticator state machine on the NAS does not allow
lower-layer entity (e.g., PAA) to create an EAP Request on behalf of
the authenticator.

> of the EAP so that PAA/NAS can contact the right authenticator.

In some EAP environment where MAC address is used as a client
identifier, the identifier can be effectively obtained from the MAC
header that carries PANA message without using EAP-Identity exchange.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 13 Oct 2003 09:24:59 -0700

Hi Dan,

Yoshihiro Ohba