Subject: Bootstraping RFC3118 using PANA

From: Alper Yegin <[email-masked]>
Date: Fri, 02 May 2003 15:36:40 -0700

Hello,

[sorry about possible duplicates as this message is cross-posted on two
mailing lists..]

Assuming the major (or, one of the) problem of RFC3118 is lack of roaming
and bootstraping support, we thought PANA could be useful here.

http://ietf.org/html.charters/pana-charter.html

One idea is to use PANA prior to DHCP to bootstrap a trust relation between
the host and the network. Note that PANA can be used even when the host does
not have an IP address. Client and network can use any authentication method
to authenticate each other. Assuming they use one that generates keying
material, this would result in a newly generated trust relation (i.e., PANA
SA) between the host and an access network entity (PANA authentication agent
- PAA). This would be a by-product of "network access authentication."

PANA SA can be used to derive a DHCP SA to be used with RFC3118. This can be
accomplished by a mutually-agreed PRF.

In its simplest form, DHCP server/agent/proxy can be co-located with PAA,
hence keying material  is internally made available to DHCP module.

This way, RFC3118 can be used as is (unless there are some other problems
with it..)

Comments?

Alper