Subject: Re: Review Request of PANA I-D

From: Alper Yegin <[email-masked]>
Date: Mon, 17 Mar 2003 11:14:54 -0800

Hi Pete,

>>>  Just like any
>>>  access network, a PAN also requires authentication and authorization
>>>  prior to granting access to its clients.
>>> Not necessarily.  My cellphone doesn't need to authenticate my laptop
>>> when I connect over an RS-232 wire.
>> 
>> OK, this is physical security. As long as you are the one who plugs in the
>> cables, you are fine. PANs also come with wireless connections.
> 
> Right, but even then the wireless connection might provide sufficient
> security by itself.

You mean L2 authentication mechanisms? Yes, they can.

> The key difference I see with PANs is that they
> are not likely to support "roaming", i.e., many otherwise unknown
> devices hooking up to the PAN.  All of the devices are likely to
> belong to the same administrative domain (indeed, the same
> individual).

Yes, we tried to capture this in:

   Another characteristic of PANs is its small scale.  Only a handful of
   nodes are expected to be part of a given PAN; therefore the
   authentication process does not necessarily require a managed backend
   AAA infrastructure for credential verification.  Locally stored
   information can be used in this kind of PANA deployment without
   relying on a AAA backend.

We can use "roaming" term here too.

alper