Subject: PANA work

From: subir Das <[email-masked]>
Date: Tue, 02 Jul 2002 16:28:10 -0400

Hi All,

I have been following the discussion for a long and noticed that the 
same issue is coming again and again. During our early BoF days and 
past one year we have been trying to convey the message to the mailing 
list that PANA is neither trying to replace the L2 authentication 
mechanisms nor competing with the widespread 802.1X technology. It's 
true that 802.1X can offer the similar solution what PANA is aiming for 
if every link layer or device supports 802.1X. I don't know the 
history of 802.1X but people could very well argue that PPP and it's 
variants would have solved the similar problem (sometimes it may not
be a clean solution, performance issue, etc.). In fact, we have seen 
that the choice of the protocol is always driven by the industry and 
its killer applications although I agree that widely deployed protocols 
do not always offer the best solution. 

If I remember correctly, before forming the WG, ADs wanted to hear the 
voice from the service providers and vendors who would like to see this 
happen and will deploy this technology in future. We have noticed that 
quite a large number of people believe that a higher layer
authentication 
protocol like PANA will be very useful in their networks. Another useful 
scenario we have seen is Mobile IPv6. Mobile IPv4 needed extension since 
there was no authentication protocol at the IP layer. I also heard from 
3GPP folks that they also searched for a protocol like PANA to pass on
the
authentication parameters after layer-2 authentication. Due to the 
absence of such a protocol they decided to use PPP (in one method) 
just to tunnel the authentication parameters. 

At the end, I think if people are interested, let's start working on it 
and design the protocol without wasting further time. There is nothing 
wrong in providing multiple solutions to a particular problem. It's the 
solution provider who will decide which solution makes sense to their 
networks. 

My 0.2 cents!!  

Regards,

Subir

---

From: Reinaldo Penno <[email-masked]>
Date: Thu, 4 Jul 2002 08:10:53 -0700 (PDT)

Finally...

The feedback on the list and IETF meetings was that
quite a large number of people (providers and vendors)
believe that a higher layer authentication protocol
like PANA will be very useful in their networks. 

We have been down this path several times on this
list. These topics were already discussed over and
over and over. It's time to move ahead and start
discussing the protocol.

> solution provider who will decide which solution

__________________________________________________
Do You Yahoo!?
Sign up for SBC Yahoo! Dial - First Month Free
http://sbc.yahoo.com

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 6 Jul 2002 01:08:00 +0859 ()

> like PANA will be very useful in their networks. 

That is a wrong formulation.

As a feedback from the real world, we, MIS (Mobile Internet Services,
Inc.), needed, as a commercial mobile ISP, user authentication for
accessing the global Internet.

However, all we need is user authentication, regardless of the
layer at which authentication information is exchanged.

ARP, for example, uses a link layer protocol to enable IP layer access
for a host.

What we need here is a protocol at some layer to authoritatively
enable IP layer access for a host.

That is, it is totally wrong to assume that IP (or higher than link)
layer protocols are necessary for the authentication to securely
accessing the global Internet.

What is necessary is user authentication, which involves some user
identification information of the IP layer, which does not necessarily
mean the authenticaion protocol use IP packets.

So, MIS does not use packets with IP headers, which is IP version
dependent, for the authentication, which is why MIS protocol can
support both IPv4 and IPv6.

						Masataka Ohta

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Fri, 5 Jul 2002 13:24:16 -0700

Hello Masataka Ohta,

> support both IPv4 and IPv6.

If you can tell us more about how MIS architecture takes care of
network access authentication, that would be very helpful in understanding
your comments, what problems you are solving within your architecture.

Thanks.

alper

> Masataka Ohta

Privileged/Confidential Information may be contained in this e-mail and any
attachment to it and may be covered by existing non-disclosure or
confidentiality agreements.
If you are not the addressee (or authorized to receive for the addressee),
you may not use, copy or disclose to anyone any information contained in
this e-mail.  If you have received this e-mail in error, please notify the
sender immediately by reply e-mail and delete it from your system.
Thank you very much.

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Sun, 7 Jul 2002 22:27:19 -0700

Folks,

The latest versions of the requirements and the usage scenarios
draft are on the web:

http://www.ietf.org/internet-drafts/draft-ietf-pana-requirements-02.txt
http://www.ietf.org/internet-drafts/draft-ietf-pana-usage-scenarios-02.txt

Please review them and provide comments.

As usual, the latest FAQ can be found at:
http://www.toshiba.com/tari/pana-faq.txt
Comments/questions on the FAQ is welcome.

alper

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 9 Jul 2002 23:48:24 +0859 ()

Alper;

> your comments, what problems you are solving within your architecture.

MIS (Mobile Internet Services, Inc.) is an ISP offering mobile IP
with wireless LAN of IEEE 802.11b.

As such, MIS makes its service authenticated with packet-wise
cryptographical protection and, in addition, usable even for quickly
moving objects.

Naturally, the number of packet exhanges MUST be minimized, which
is why EAP or 802.1x, which are wrongly layerd to cause so many
inessential exchanges of packets, is not suitable for MIS service.

							Masataka Ohta