Subject: Re: NAP and ISP separate authentication [was Re: [Pana] IETF LC anddiscussion: Next steps]

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 07 Jun 2006 11:17:50 -0400

Hi Lionel,

There was a comment in IETF mailing list stating that NAP and ISP
authentication is one part that adds complexity in the base
specification.

I agree with you on having the separate document for NAP and ISP
authentication, probably in a generic way such as allowing more than
two authentications in parallel.

Regards,
Yoshihiro Ohba

On Wed, Jun 07, 2006 at 04:48:19PM +0200, MORAND Lionel RD-CORE-ISS wrote:
> What is the exact  concern behind the request to remove this from the base specification? There is a clear requirement to enable such a separate authentication in a multi-players context and there are some proposals in other WG groups (e.g. EAP) to provide this functionaly at different levels.
> 
> If removing NAP/ISP authentication from the base spec would (maybe) simplify the scope of the specification, we should keep this option in a separate document and define the required additional AVPs in the IANA controlled AVP Codes namespace. If it is the selected approach, I would propose to provide the separate document along with the base protocol.
> 
> BR,
> 
> Lionel
> 
> -----Message d'origine-----
> De : Yoshihiro Ohba [mailto:[email-masked]] 
> Envoyé : mercredi 7 juin 2006 15:08
> À : Alper Yegin
> Cc : 'Mark Townsley'; 'Jari Arkko'; [email-masked]
> Objet : NAP and ISP separate authentication [was Re: [Pana] IETF LC anddiscussion: Next steps]
> 
> > 
> > [6] Can we remove the NAP-ISP separation support from the base spec?
> > 
> 
> I think we can remove NAP and ISP separate authentication from the base spec.  Perhaps we can design the feature in more a generic way (e.g., allowing more than two EAP runs in parallel) in a separate document.
> 
> Yoshihiro Ohba
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana
> 
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Mark Townsley <[email-masked]>
Date: Wed, 07 Jun 2006 17:42:07 +0200

> two authentications in parallel.
That sounds like a good plan to me. Anything that can reduce the
complexity of the base specification will probably help the community
digest PANA. There's more than one way to do that, moving things into a
separate specification is a perfectly reasonable method (I had to do
this myself back in 1998 to advance L2TP). I also like the idea of
parallel, identical, authentication exchanges. This simplifies the
protocol, particularly for the cases where two exchanges are unnecessary.

There is precedent in other groups for advancing discovery separately
from a base protocol (L2VPN/PWE3 and softwires, for example). Given that
there are already multiple ways to do PANA discovery, I would consider
pulling this out of the base specification as well, allowing it to
advance as its own document.

$0.02,

- Mark