Subject: PANA and IP addresses

From: Thomas Narten <[email-masked]>
Date: Thu, 20 Jun 2002 12:24:43 -0400

We've had some discussion about when a PANA client obtains an IP
address. Specifically, does it have to have a proper unicast IP
address (e.g., link-local, or regular address) prior to invoking PANA,
or should a client be able to invoke PANA prior to obtaining any IP
address (e.g., using the all 0s address).

One model for how PANA can be used is that a client obtains an address
using normal means (e.g., using DHCP). That address has only limited
utility, because various enforcement points (e.g., an access router)
have filters limiting the useability of the address. The client then
invokes PANA, and once the PANA authentication is successful, the
address is given greater capabilities (e.g, the PAA/AAA infrastructure
interacts with the enforcement points to change the capabilities of
the address).

In this model, there is no requirment that PANA be used by clients
prior to their obtaining IP addresses.

Question: is this model sufficient and reasonable to deal with the
deployment scenarios people have in mind with PANA? If not, why not,
and what other models do folks have in mind and what advantages do
they have over the simple model described above?

Note also, that there are variations to the above too. One could
imagine that after the PANA exchange, the client invokes DHCP again,
but this time the DHCP exchange includes authentication info (learned
through PANA) that allows the client to obtain a different address
than it already has. 

Thomas

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 24 Jun 2002 14:26:52 +0200

> through PANA) that allows the client to obtain a different address

If all PANA enables is IP address based security, it seems rather
limited.  If it worked like that, wouldn't it be easy to just listen
to the network and steal an "approved" IP address, start to use it,
and gain full access?

My view of what PANA should provide is a bearer layer independent
version of 802.11 Wireless LAN's method of authenticating and
connecting to a network. (And similar to Bluetooth's similar system,
but I'm not familiar with that.)  Looking at what 802.11/1x can
provide could be useful to see what PANA should do: WLAN can include
negotiation of encryption and integrity keys for per-packet
operations.

In this view (which is my own and may be totally bogus), PANA needs to
support this security negotiation, and be profiled for each physical
bearer, because it is normally the physically bearer that performs
encryption and integrity protection.  I think this would be the right
approach.  The negotiation and profiling could be left to specific EAP
mechanisms too if, of course, PANA choses to use EAP.

-- 
Simon Josefsson,
RSA Labs