Subject: Revised Charter for PANA

From: <[email-masked]>
Date: Tue, 21 May 2002 08:51:47 -0500

Hello,

Below is a revised charter for PANA. The intent of the revision
is to ensure that the charter has a better focus on the problem
that this WG will deal with. 
Comments solicited. 
Deadline for receiving comments: May 28th, 2002

-Basavaraj and Alper

-----------------------------------------------------------------------------------------------

IP based hosts that connect or attach to the Internet via an access
network need to provide their credentials and be authenticated before
being authorized to access the network. 

Background:
-----------
There is currently no generic network layer protocol to be used by a
user's device when wanting network access, and this WG will attempt to
fill that hole. That is, a protocol between a user's device and a
device at the network access point where the network access device
might be a client of the AAA infrastructure.  

Currently the authentication mechanisms in PPP are being used for many
wired access scenarios as well as some wireless access, which requires
using PPP encapsulation for the data packets. Using PPP just for client
authentication is viewed as a sub-optimal solution as it causes extra
round-trips, overhead of encapsulation and processing, and forces the
network topology into a point-to-point model. A point in case is PPPoE
which is used over multi-access networks primarily for the purpose of 
exploiting the authentication scheme provided by PPP. 
Also, IEEE 802 relies on 802.1X which provides EAP authentication that
is limited to IEEE 802 link layers.

Network access technologies for wired and wireless media are evolving
rapidly. With the rapid growth in the number and type of devices and
terminals that support IP stacks and can access the Internet, users
can potentially use a single device having the capability of attaching
via different multiple access media and technologies to interface to
the network. The model for providing the users' information to the
network for authentication, authorization or accounting needs to be
the same and NOT be tied in to the underlying access type.  

Goal and Scope of PANA:
-----------------------
PANA aims to provide a layer two agnostic and IPv4/IPv6 compatible
protocol that allows a host to be authenticated for network access. A
messaging protocol which is of type client-server allows
authentication payload to be carried between the host/client (PaC) and
an agent/server (PAA) in the access network. The PAA is on the same IP
subnet as the PaC. The PAA itself may interface with other AAA
backend infrastructures for authenticating and authorizing the
service being requested by the host. The PAA enables access control
to be enforced at the appropriate enforcement point in the
network. When a protocol is needed between the PAA and the network
access enforcement point, this protocol is considered to be outside
the scope of PANA. [It can be RADIUS/Diameter/COPS/SNMP etc.] 

PANA does NOT define any new authentication protocol nor does it
define key distribution, key agreement or key derivation protocols.
It is essentially a transport protocol between a host and an agent in
an access network for EAP.  

Deliverables of the WG:

1. Requirements of PANA
2. Usage Scenarios and applicability statement
3. Protocol Specification
4. Interaction of PANA with 802.1x and PPP
5. MIB for PANA Protocol

---

From: "James Kempf" <[email-masked]>
Date: Tue, 21 May 2002 18:12:02 -0700

Raj,

Sounds fine.

            jak