Subject: [Pana] FW: AD Review comments on draft-ietf-pana-usage-scenarios-06.txt

From: Alper Yegin <[email-masked]>
Date: Fri, 21 May 2004 13:47:19 -0700

Please see below for Thomas Narten's review comments on the
usage-scenarios draft.

Chairs note: The current I-D seems like it will benefit from a re-write.
It has text that is not essential to answering the fundamental
questions. The text can be condensed. While doing that, we can also
reduce it to an appendix section in the requirements draft, and reduce
the document load.

- Chairs

-----Original Message-----
From: Thomas Narten [mailto:[email-masked]] 
Sent: Friday, May 21, 2004 8:53 AM
To: [email-masked]; Alper Yegin
Cc: Margaret Wasserman
Subject: AD Review comments on draft-ietf-pana-usage-scenarios-06.txt

2004-05-20 review of -06:

Overall, a weak and unconvincing document. But probably harmless.

Need to get verification from DSL and CDMA2000 community on their
sections and whether pana is of any real interest to them.

abstract says:

>    Network access authentication is a function that is typically
>    required in most scenarios.

please change "most" to "many". Far from clear that this is required
in "most" scenarios.

Nits:

"PANA" acronym should be expanded in title (see ID nits)

The acronyms need definitions in some cases. E.g.:

>    MSC: Mobile Switching Center
>    MT: Mobile Termination
>    VLR: Visiting Location Register

mean nothing to me. There are others too that are not obvious. Expand
their meaning a bit?

normative references are not right. Many of the listed ones appear to
be non-normative.

>    The Extensible Authentication Protocol (EAP) [RFC2284bis] offers a
>    natural way to encapsulate many different authentication methods.
>    Among the various types of link-layers, only IEEE 802 defines how
to
>    carry EAP on the link-layer [802.1X].  Other link-layers resort to
>    using PPP/PPPoE [RFC1661,RFC2516] as a link-layer agnostic way of
>    carrying EAP. The ungainly insertion of this extra layer incurs
>    additional round-trips at connection time, generates overhead of
PPP
>    processing even for subsequent data packets, and forces the network
>    topology into a point-to-point model. EAP could achieve greater
>    applicability if it could be carried directly over IP. That way,
the
>    resulting IP packets could be carried over any link technology
>    without incurring additional cost or limitation on the
architectures.

would a PPP person agree with this characterization? (need to check)

>    In the absence of such lower-layer security and authentication
>    mechanism not only are service providers unable to control the
>    unauthorized use of their networks but also end-users feel insecure
>    about using such networks at all.  In order to support
authentication

I don't follow? End user can use SSH and be done with it... Where are
folks to afraid to use a network due to insecurity?

Thomas

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana