Subject: [Pana] AD-review: pana-fwk (Section 4)

From: "Alper Yegin" <[email-masked]>
Date: Mon, 24 Oct 2005 14:26:49 +0300

Mark,

This is for your comments/questions on Section 4 of the pana-fwk
document.

>     The presence of a secure channel before PANA exchange eliminates
>     the need for executing a secure association protocol after PANA.
>     The PANA session can be bound to the communication channel it was
>     carried over.
>
What do you mean by "bound to the communication channel" - do you really

mean that the security requirements of PANA are different depending on 
the assumptions implied by underlying link layer? 

Alper: If you are saying this in reference to whether or not to run a
secure association protocol, let me note that the secure association
protocol is not part of PANA. Examples are 802.11i 4-way handshake,
802.16e 3-way handshake, IKE. So, it is up-to the architecture to
determine the underlying link-layer capabilities and use the appropriate
protocols (PANA+EAP+secure_assoc+...).

This is different than 
"bound" to me (in general, "bindings" between layers are a red flag for 
bad design, so I'm not sure you want to suggest this).

Alper: The term "binding" in the context of EAP (RFC3748) and PANA is
used for relating the EAP "session" to a "communication channel". So
that, once the EAP authentication is successful, the network elements
(e.g., EP) know which traffic is allowed. [of course, representation of
a channel depends on the lower-layers...]

============================

Here's where you might suggest EAP Methods to NOT use, and it would be 
nice to even venture to suggest ones that SHOULD be used. Even better if

you can name one that MUST be implemented, so that there is at least one

method that is available on all PANA implementations.

Alper: It is better if we stay away from "concrete" EAP method
suggestions. This issue was discussed in EAP WG, as it was already part
of RFC2284. Also, the architectures using EAP decide on this by taking a
multitude of parameters into account. Whether PANA or another EAP
lower-layer is used has not impact on that decision.

Thanks.

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana