Subject: RE: The Emperor Has No Clothes: Is PANA actually useful?

From: "Narayanan, Vidya" <[email-masked]>
Date: Wed, 24 May 2006 12:44:34 -0700

Disclaimer - I do work in the INT area, but have not been involved in
the PANA WG. 

When this work was chartered, I failed to understand its need and the
deployment use cases. Subsequently, about 3 years ago, I recommended
against the use of PANA for the needs of my ex-employer. More recently,
I have been advocating against the use of PANA in 3gpp2. With that
background, some high level confusions that I have about the use of
PANA: 

1. Reading the framework document, it is simply not clear to me as to
why PANA would be useful for any type of network. Actually, even after
reading some other PANA documents, this is not clear to me. It seems to
have become this complex suite of protocols that aren't specifically
buying anything. Why would I want to go through IP address acquisition,
for one, if I had a link layer that carried EAP, particularly for link
layer security? 

2. Link layer agnostic approach has often been cited as a reason to use
PANA. I must say that I don't understand how it is link layer agnostic,
when it depends on 802.11i 4-way handshake or the like for the secure
association protocol. In fact, I am not sure how this even works with
the currently defined secure association protocols in lower layers. None
of the documents have provided any clarity to me on this. The use of
IPsec/IKE for this is even more confusing to me - in this case, why
would PANA be used instead of EAP-in-IKEv2? 

3. Statements like "...whereas it allows only limited type of traffic
(e.g., PANA, DHCP, router discovery, etc.) for the authorized PaCs" do
not exactly provide a clear picture of port control - yet another reason
IMO to leave the EAP lower layer where it belongs (at the link layer).
There are many other such confusions in my mind arising from the PANA
documents that I won't get into here. 

4. The choices that are left to deployment while using PANA constitute a
long list for one protocol! Security before/after the PANA run, global
vs local PRPA, DHCP vs 3927 vs 2131 for IPv4 PRPA, dual-stack handling
behavior, secure association protocol choice and what it takes to make
it work with PANA, need for POPA and "unconfiguring" PRPA, PAA/EP
location and choice of protocol between those entities, IKEv1 vs IKEv2
etc. - I am sure I've missed more choices here; but, complex enough, to
say the least! 

Given all of this, publishing these documents in the current stage as
proposed standard RFCs concerns me. 

Vidya

> -----Original Message-----
> From: Sam Hartman [mailto:[email-masked]] 
> Sent: Wednesday, May 24, 2006 8:12 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: The Emperor Has No Clothes: Is PANA actually useful?
> 
> 
> 
> Hi.  Speaking as an individual, I'd like to make an explicit 
> call for members of the IETF community not involved in the 
> PANA working group to review draft-ietf-pana-framework.  
> Please speak up if you have done such a review or attempted 
> such a review and been unsuccessful.  Let us know what you 
> think PANA is intended to be useful for and whether you think 
> it is actually useful.
> 
> My strong hunch is that we've chartered work for some reason, 
> and now that the working group is nearing the end of its 
> charter, we still don't understand why we want this thing 
> we've built and whether it's a good idea.  People aren't 
> screaming not so much because they are happy with results but 
> because no one actually understands PANA.
> 
> I understand that there's a strong presumption that once 
> chartered, work is useful.  I'd like to challenge this 
> presumption enough to get people to actually read the 
> document.  If people not involved in the effort sit down, 
> read the document and understand what it's all about, my 
> concern is satisfied.  But if enough people try to read the 
> document, try to understand and fail, we're not done yet.  We 
> certainly cannot have consensus to publish something we've 
> tried and failed to understand.
> 
> It's not just me.  I've been trying to find people outside of 
> PANA who claim to understand the effort and what it's good 
> for and why link-layer solutions are not better.  When the 
> first discussion of PANA hit the IESG, I asked other IESG 
> members why PANA was a good idea and what problem it solved.  
> "Don't go there," was the advice I got from the responsible AD.
> 
> At that time (a year and a half ago) there was no one on the 
> IESG who claimed to understand PANA or to think it was a good idea.
> 
> I'm fairly sure that with the possible exception of Jari (who 
> is a technical advisor to PANA), that's still true.
> 
> 
> The security community has been trying to understand PANA.  
> I've sent multiple security reviewers at the PANA document.s 
> They always come back fundamentally confused about what PANA 
> is trying to do or about whether it is a good idea.  They end 
> up focusing on some detail or another and asking for some 
> minor part of the system to be fixed.  But I don't get the 
> impression from the reviews they understand the overall 
> picture; explicit discussion of this also indicates that they 
> are not confident in their understanding nor do they know 
> whether it is a good idea.
> 
> We keep running back over the same ground, still confused and 
> still trying to muddle through to no real effect.
> 
> 
> I've tried to understand it myself.  I tried to understand in the BOF.
> It was very clear to me leaving the original PANA BOF that 
> something was very confused.  Every year or so since I've 
> tried to go back and figure out what I missed.  Eventually 
> though I've started wondering whether the problem wasn't me, 
> but was an actual lack of clarity.
> 
> So, folks can you please help us all out.  Especially if the 
> internet area is not your primary focus, especially if you've 
> never heard of PANA before, take a look at the framework 
> document and all their other documents.  Do you get it?  Is 
> it a good idea?
> 
> Thanks for your time.
> 
> P.S.  Again, this is me speaking as an individual.  At this 
> late stage, it would be entirely inappropriate for me to take 
> actions as an AD claiming that we didn't understand a problem 
> without a strong community consensus.
> 
> 
> 
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ietf
> 

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Antonio F. Gómez Skarmeta" <[email-masked]>
Date: Fri, 26 May 2006 08:49:55 +0200

Well, certainly other EU project are interested as I am involve in some 
of them like Daidalos http://www.ist-daidalos.org and previously also 
SEINIT http://www.seinit.org/

  But also I will like to mention and Josh is aware (DAME project) that 
some work is being considered in the european academic networks 
regarding to the interaction between  authentication and authorization 
that comes from a design that was based on the use of PANA in the 
network access :-)

 Antonio

>
> On 24 May 2006, at 20:52, Lucy E. Lynch wrote:
>
>
>     I don't know if PANA will be useful, but I do know why some folks
>     are interested...
>
>Have you taken a look at the I2 NetAuth work:
>http://security.internet2.edu/netauth/
>
>
>These academic networks are interested in both PANA and NEA as part
>of their ubiquitous sign-on to R&E networks agenda.
>    
>
>
> While I can't comment on NetAuth, I've been engaged in the Europe's 
> equivalent project for HEFE, Eduroam, for the last couple of years and 
> to my knowledge we've never discussed PANA (even though at least a few 
> of us have been aware of its gestation).
>
> FWIW I've personally never understood what niche(s) PANA was expecting 
> to fill, but I assumed it was me being dim.
>
>josh.
>
>
> Josh Howlett, Networking Specialist, University of Bristol.
> email: josh.howlett at bristol.ac.uk | phone: +44 (0)7867 907076 | 
> interal: 7850
> ------------------------------------------------------------------------
>
> Asunto:
> The Emperor Has No Clothes: Is PANA actually useful?
> De:
> "Sam Hartman" <[email-masked]>
> Fecha:
> Wed, 24 May 2006 08:12:04 -0700
> Para:
> <[email-masked]>
>
> Para:
> <[email-masked]>
> CC:
> <[email-masked]>
>
>
>Hi.  Speaking as an individual, I'd like to make an explicit call for
>members of the IETF community not involved in the PANA working group
>to review draft-ietf-pana-framework.  Please speak up if you have done
>such a review or attempted such a review and been unsuccessful.  Let
>us know what you think PANA is intended to be useful for and whether
>you think it is actually useful.
>
>My strong hunch is that we've chartered work for some reason, and now
>that the working group is nearing the end of its charter, we still
>don't understand why we want this thing we've built and whether it's a
>good idea.  People aren't screaming not so much because they are happy
>with results but because no one actually understands PANA.
>
>I understand that there's a strong presumption that once chartered,
>work is useful.  I'd like to challenge this presumption enough to get
>people to actually read the document.  If people not involved in the
>effort sit down, read the document and understand what it's all about,
>my concern is satisfied.  But if enough people try to read the
>certainly cannot have consensus to publish something we've tried and
>failed to understand.
>
>It's not just me.  I've been trying to find people outside of PANA who
>claim to understand the effort and what it's good for and why
>link-layer solutions are not better.  When the first discussion of
>PANA hit the IESG, I asked other IESG members why PANA was a good idea
>and what problem it solved.  "Don't go there," was the advice I got
>from the responsible AD.
>
>At that time (a year and a half ago) there was no one on the IESG who
>claimed to understand PANA or to think it was a good idea.
>
>I'm fairly sure that with the possible exception of Jari (who is a
>technical advisor to PANA), that's still true.
>
>
>The security community has been trying to understand PANA.  I've sent
>multiple security reviewers at the PANA document.s They always come
>back fundamentally confused about what PANA is trying to do or about
>whether it is a good idea.  They end up focusing on some detail or
>another and asking for some minor part of the system to be fixed.  But
>I don't get the impression from the reviews they understand the
>overall picture; explicit discussion of this also indicates that they
>are not confident in their understanding nor do they know whether it
>is a good idea.
>
>We keep running back over the same ground, still confused and still
>trying to muddle through to no real effect.
>
>
>It was very clear to me leaving the original PANA BOF that something
>was very confused.  Every year or so since I've tried to go back and
>figure out what I missed.  Eventually though I've started wondering
>whether the problem wasn't me, but was an actual lack of clarity.
>
>So, folks can you please help us all out.  Especially if the internet
>area is not your primary focus, especially if you've never heard of
>PANA before, take a look at the framework document and all their other
>documents.  Do you get it?  Is it a good idea?
>
>Thanks for your time.
>
>P.S.  Again, this is me speaking as an individual.  At this late
>stage, it would be entirely inappropriate for me to take actions as an
>AD claiming that we didn't understand a problem without a strong
>community consensus.
>
>
>
>  
>

-- 
------------------------------------------------------------
Antonio F. Gómez Skarmeta
Dept. Ingeniería de la Información y las Comunicaciones
Facultad de Informática
Universidad de Murcia
Apartado 4021
30001 Murcia
Telf: +34-968-364607
fax: +34-968-364151

---

From: "Tschofenig, Hannes" <[email-masked]>
Date: Mon, 29 May 2006 10:04:36 +0200

Hi Jari, 

> Anyway, I agree with Dave Crocker that the bar should be
> higher for using "there's another solution" argument in last
> call discussion of chartered work than in, say, a BOF
> discussion. Perhaps we should focus more on whether
> the function itself is something that we agree on, and
> what we can do to fix/scope/help PANA.

That's very true given that some solutions that were mentioned in the
discussion appeared recently while the PANA protocol was in AD
Evaluation for a long time already. One example:
draft-barany-eap-gee-00.txt

Ciao
Hannes

---

From: "Gray, Eric" <[email-masked]>
Date: Tue, 30 May 2006 11:02:23 -0400

Lucy,

	Thanks!

--
E 

--> -----Original Message-----
--> From: Lucy E. Lynch [mailto:[email-masked]] 
--> Sent: Friday, May 26, 2006 2:31 PM
--> To: Gray, Eric
--> Cc: Narayanan, Vidya; Sam Hartman; Bernard Aboba; [email-masked]
--> Subject: RE: The Emperor Has No Clothes: Is PANA actually useful?
--> 
--> On Fri, 26 May 2006, Gray, Eric wrote:
--> 
--> > For those of us that are just trying to follow this discussion,
--> > what does the word "posture" mean in this context?
--> 
--> according to draft-thomson-nea-problem-statement-02.txt
--> 
--> "Posture: Posture refers to the hardware or software 
--> configuration of
-->     an endpoint as it pertains to an organization's security policy.
-->     Posture may include knowledge about the types of hardware and
-->     software installed and their configurations, e.g.  OS name and
-->     version, application patch levels, and anti-virus signature file
-->     version."
--> 
--> 
--> 
--> > --
--> > Eric
--> >
--> > --> -----Original Message-----
--> > --> From: Narayanan, Vidya [mailto:[email-masked]]
--> > --> Sent: Friday, May 26, 2006 2:05 PM
--> > --> To: Sam Hartman; Bernard Aboba
--> > --> Cc: [email-masked]
--> > --> Subject: RE: The Emperor Has No Clothes: Is PANA 
--> actually useful?
--> > -->
--> > --> >
--> > --> > >>>>> "Bernard" == Bernard Aboba 
--> <[email-masked]> writes:
--> > --> >
--> > --> >     >> My question is more why do they need EAP in
--> > --> situations where
--> > --> >     >> they are not running at the link layer than why do
--> > --> they want or
--> > --> >     >> not want PANA.
--> > --> >
--> > --> >     Bernard> The simple answer is that there are
--> > --> situations which IEEE
--> > --> >     Bernard> 802.1X cannot handle on wired networks.  As
--> > --> specified,
--> > --> >     Bernard> IEEE 802.1X is "network port control", which
--> > --> means that
--> > --> >     Bernard> authorization is controllable only at the
--> > --> port level.  If
--> > --> >     Bernard> there is more than one host connected to a
--> > --> switch port,
--> > --> >     Bernard> then that model no longer applies.
--> > --> >
--> > --> > Yeah.  I guess I wonder whether you are actually getting
--> > --> > network access authenticatino at that point or whether you
--> > --> > are getting a service that allows you to check posture.  It
--> > --> > seems that a service that simply allows you to check posture
--> > --> > should be not EAP.
--> > --> >
--> > -->
--> > -->
--> > --> I fully agree. As far as I can tell, using EAP in 
--> this manner merely
--> > --> reduces it to a posture transport protocol. The level 
--> of security
--> > --> provided by EAPoUDP does not seem to be any greater than a
--> > --> kerberos-based authentication done today in most enterprise
--> > --> networks,
--> > --> considering the presence of switched ethernet. Hence, the
--> > --> only reason to
--> > --> move to EAPoUDP would be to check posture and I agree 
--> with Sam that
--> > --> making EAP the posture transport protocol is a bad idea.
--> > -->
--> > --> Vidya
--> > -->
--> > -->
--> > --> > _______________________________________________
--> > --> > Ietf mailing list
--> > --> > [email-masked]
--> > --> > https://www1.ietf.org/mailman/listinfo/ietf
--> > --> >
--> > -->
--> > --> _______________________________________________
--> > --> Ietf mailing list
--> > --> [email-masked]
--> > --> https://www1.ietf.org/mailman/listinfo/ietf
--> > -->
--> >
--> > _______________________________________________
--> > Ietf mailing list
--> > [email-masked]
--> > https://www1.ietf.org/mailman/listinfo/ietf
--> >
--> 
--> -- 
--> Lucy E. Lynch 				Academic User Services
--> Computing Center			University of Oregon
--> llynch  @darkwing.uoregon.edu		(541) 346-1774
-->

---

From: "Gray, Eric" <[email-masked]>
Date: Tue, 30 May 2006 11:12:39 -0400

Sam,

	Thanks!

--
E 

--> -----Original Message-----
--> From: Sam Hartman [mailto:[email-masked]] 
--> Sent: Friday, May 26, 2006 5:20 PM
--> To: Gray, Eric
--> Cc: Narayanan, Vidya; Bernard Aboba; [email-masked]
--> Subject: Re: The Emperor Has No Clothes: Is PANA actually useful?
--> 
--> >>>>> "Gray," == Gray, Eric <[email-masked]> writes:
--> 
-->     Gray,> For those of us that are just trying to follow this
-->     Gray,> discussion, what does the word "posture" mean in this
-->     Gray,> context?
--> 
--> Assertions about your OS state--things like patch levels,
--> configuration of security settings, etc.
-->