Subject: RE: PANA FAQ

From: John Schnizlein <[email-masked]>
Date: Thu, 23 May 2002 16:23:32 -0400

At 04:11 PM 5/23/2002, [email-masked] wrote:

>>I hope you agree that requiring authentication before an IP
>>address implies that authentication will not be at layer-3. 
>
>I tend to agree. But the thinking has been that the host could 
>possibly ICMP with IP address 0 to carry EAP payload. 
>So it is possible that we could do authentication without 
>the host having been assigned an address. 

Thank you for making clear the special case I had not considered.

We should properly consider, and reject this sort of thing as not
really layer-3 IP. It would just be the layer-2 communication with
fake IP addresses to carry a special case across the link layer.

How could this be better than using a layer-2 authentication,
which would naturally (no fakery required) operate before the
IP address necessary for layer-3 communication is available?

John

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Thu, 23 May 2002 18:46:07 -0700

John,

> fake IP addresses to carry a special case across the link layer.

I don't really understand why you say this is not really layer-3 IP.
What would you call it, and what is the definition of this?

Unspecified source address is already used with at least dhcp and 
router discovery. The IP address of the sender has no significance,
therefore the receiver has to cache the mac address and use it
when responding. The IP address cannot be resolved into a mac
address using ARP/ND. Same thing is used with Mobile IPv4 when
foreign agent located care-of address is used. The source of outgoing
and destination of incoming packets to mobile node is the home IP
address, which doesn't belong to the visited IP subnet. 

> IP address necessary for layer-3 communication is available?

I still consider this a layer-3 solution. 

alper

---

From: Thomas Narten <[email-masked]>
Date: Fri, 24 May 2002 06:54:01 -0400

> Unspecified source address is already used with at least dhcp

DHCP is a special case. One must bootstrap someway to get an IP
address in the first place.  And it requires hacks in the relay agent
to make it work. It would be nice to limit the need for such tricks to
a minimal set

> and router discovery.

The response from the router is sent to an IP broadcast address. A big
difference between Router Advertisements and something like PANA is
that the RAs are sent to all nodes, and they don't contain any
client-specific information. PANA messages, in contrast will, since
they are a a response to a specific client. Thus, they can't go to all
other clients.

Thomas

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Fri, 24 May 2002 13:37:40 -0700

> address in the first place.  

Yes.

> And it requires hacks in the relay agent
> to make it work. 

PAA is on the same subnet as the PaC. So, we don't need relay
agents for PANA.

> It would be nice to limit the need for such tricks to
> a minimal set

Agreed. They should be minimized and have sufficient
justification.

> 
> > and router discovery.
> 
> The response from the router is sent to an IP broadcast address. 

It really depends on the implementations, but sending it link-layer
unicast makes sense to me. Not only for efficiency, but also for
customizing router advertisements based on the host id in the future..

> A big

alper