Subject: Re: [Int-area] DCHP-based authentication for DSL?

From: Jari Arkko <[email-masked]>
Date: Mon, 03 Dec 2007 19:28:34 -0800

Not sure if this information was passed to the list yet, but as you may
know, in addition to asking IETF about DHCP, DSL Forum has also asked
IEEE about 802.1X support.

Here is the IEEE 802.1 response to the DSL Forum liaison:
(See:
http://www.ieee802.org/1/files/public/minutes/2007-11-closing-plenary-slides.pdf
Slide 55)

"Thank you for your liaison re: Subscriber Authentication in DSL (May
25th 2007)

http://www.ieee802.org/1/files/public/docs2007/liaison-dsl-forum-auth-for-wt146-0707.doc

we would like to draw your attention to the possibility of using
P802.1af in conjunction with P802.1aj
to meet a number of your requirements.

Attachments: P802.1aj D2.2 TPMR (Amendment to IEEE Std 802.1Q: Two Port
Mac Relay)
P802.1af D1.7 Key Agreement for MAC Security

It is anticipated that Project 802.1af will soon be formally identified
as a full revision of P802.1X."

_______________________________________________
Int-area mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/int-area

---

From: "Avi Lior" <[email-masked]>
Date: Mon, 3 Dec 2007 20:24:52 -0500

I don't think that DHCP is the right protocol to use for Network Access
Authentication.

> 
> How do we feel about this?

Not very good really.  A splitting headache best describes it.  Thanks
for asking.

> Is this a good idea, considering 
> the DSL architecture? 

I am not a subject matter expert but it seems that they are fighting
hard for this.  Not sure the motivation, but I can't imagine what reason
they can have for hacking DHCP -- and in this sense hacking is in the
negative sense.

>How will it affect DHCP the protocol? 

Not sure but how can it help the DHCP protocol.  Even if we put all the
caveats in the world that this must only be used by DSL forum, you all
know that we will battle this in other SDOs for years to come.

>Are there any other choices that we should recommend instead?

It seems that they need a transport of the user credentials between the
Peer and the Authenticator.  How about Pana?

> I would like to hold the discussion on this in this list 
> until we've determined that the DHCP protocol is the right 
> tool for the job. 

It is not the right tool for the job.  I wonder how this will bite us
down the road.  For example, what are the impacts on DSL forum when they
start looking at convergence with other technologies.  And handoff
scenarios etc....

What will they do if the have to do simultaneous or multiple
authentications.  Can DHCP support this?  In the short term, it seems
that this may work but in the long run I am not sure.

> Jari