Subject: [Pana] pana-fwk Issues 171 to 175: closing

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 13 Dec 2005 15:48:26 -0500

New text for section 1:

"
1.  Introduction

   PANA (Protocol for carrying Authentication for Network Access) is a
   link-layer agnostic network access authentication protocol that runs
   between a client that wants to gain access to the network and a
   server on the network side.  PANA defines a new EAP [RFC3748] lower
   layer that uses IP between the protocol end points.

   The motivation to define such a protocol and the requirements are
   described in [RFC4058].  Protocol details are documented in
   [I-D.ietf-pana-pana].  [I-D.ietf-pana-ipsec] describes use of IPsec
   for access control following PANA-based authentication.  IPsec can be
   used for per-packet ciphering, but nevertheless it is not the only
   way to achieve this functionality.  Alternatives include reliance on
   physical security and link-layer ciphering.  The server of PANA may
   or may not be co-located with the entity enforcing the per-packet
   access control function.  When the server of PANA and per-packet
   access control entities are separate, SNMP [I-D.ietf-pana-snmp] may
   be used to carry information between the two nodes.

   PANA design provides support for various types of deployments.
   Access networks can differ based on the availability of lower-layer
   security, placement of PANA entities, choice of client IP
   configuration and authentication methods, etc.

   PANA is intended to be used in any access network regardless of the
   underlying security.  For example, the network might be physically
   secured, or secured by means of cryptographic mechanisms after the
   successful client-network authentication.

   The server of PANA and per-packet access control entities can be
   placed on various elements in the access network (e.g., access point,
   access router, dedicated host).

   IP address configuration mechanisms vary as well.  Static
   configuration, DHCP [RFC2131], stateless address auto-configuration
   [RFC2461] are possible mechanisms to choose from.  If the client
   configures an IPsec tunnel for enabling per-packet security,
   configuring IP addresses inside the tunnel becomes relevant, for
   which there are additional choices such as IKE [RFC2409].

   This document defines a general framework for describing how these
   various deployment choices are handled by PANA and the access network
   architectures.  Additionally, two possible deployments are described
   in detail: PANA over DSL (Digital Subscriber Line) networks and WLANs
   (Wireless LANs).
"

New text for section 2:

"
2.  Terminology

   Pre-PANA address (PRPA)

      This is an IP address configured on a client of PANA before
      starting the PANA exchange.

   Post-PANA address (POPA)

      This is an IP address (optionally) configured on a client of PANA
      after a successful authentication.

   IPsec Tunnel Inner Address (IPsec-TIA)

      This is an IP address configured on a client of PANA as the inner
      address of an IPsec tunnel mode SA (Security Association).

   IPsec Tunnel Outer Address (IPsec-TOA)

      This is the address configured on a client of PANA as the outer
      address of an IPsec tunnel mode SA.

   Secure Association Protocol

      A protocol that runs between a client of PANA and a per-packet
      access control element to provide a cryptographic binding between
      the initial entity authentication (and authorization) exchange to
      the subsequent exchange of data packets.  Examples of secure
      association protocols include the 4-way handshake in IEEE 802.11i
      [802.11i], and IKE [RFC2409] in IP-based access control.
"

Regards,
Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana