Subject: RE: draft-ietf-pana-usage-scenarios-00.txt

From: Jacques Caron <[email-masked]>
Date: Thu, 07 Feb 2002 22:23:00 +0100

Hi Hesham,

Sorry for the late response...

At 13:00 06/02/2002, Hesham Soliman (ERA) wrote:
>=> I already responded to that, but I see you have
>a new comment here. you said:
>'a given user should be assigned by his home network
>a globally routable NAI that should work on any media'
>
>'should' is one thing, 'does' is another. What
>happens today is not what you suggest
>above. We could integrate NAIs into every
>L2 authentication scheme, but I wouldn't hold
>my breath.
>We would like to have this access independant
>agreement, but we want to avoid going around
>to all SDOs and SIGs to make sure that they
>support this. Also we would like to make
>sure that this identity is independant
>of the IP version. A NAI is fine, now we
>need a protocol to carry it.

EAP between the client and its home server. EAP would then be encapsulated 
into Radius or Diameter between the NAS/AP/whatever and the home server, 
and preferably within the L2 protocol startup mechanism when that is 
available, or PANA if not. I still believe PANA can only be an interim 
solution, mainly for security reasons.

>Why should the user identity be carried
>over L2 anyway and get every default router
>to extract this and send it to some AAA
>server?

The L2 device should be doing the authentication, so the authentication is 
not carried over L2, it's just exchanged between two L2 devices at each end 
of the link (as is the case in both PPP and 802.1x). Same applies for 
application-level authentication, EAP should be encapsulated within the 
application protocol session (e.g. HTTP).

>  what if the router is separated
>from the AP? wouldn't we need an AP - AR
>L2 (or application layer in some cases!)
>protocol to carry this?

Nope. The AP should be doing the auth, not the router.

>I think having an application layer
>protocol is much cleaner.

I think it's way more insecure, and can only be used as an interim measure.

Jacques.

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com