Re: [6tisch] [6tisch-security] proposed security text for architecture draft

[Michael Richardson <[e-mail]>]

{Please note that I am very familiar with EAP mechanisms, and I wrote EAP-SIM
 for Freeradius a decade ago, when the document was going through many changes}

<[e-mail]> wrote:
    > Regarding EAP method, I mentioned EAP-TLS.  EAP-TLS works for both
    > certificate-based authentication and pre-shared key based
    > authentication (EAP-TLS-PSK) without EAP tunneling method such as
    > EAP-TTLS.  In the latter case, TLS session is typically terminated at
    > AAA server.

But, since the EAP-TLS session terminates at the the AAA server, all of the
communications that we want to do (the 6top data), would have to come from
the AAA server.   

That means installing all of 6top/DTLS/CoAP code into the radius server.  
(That's because the EAP-TLS is between AAA(radius) server and joining node)
Is that really what you want to do?

What other things would the AAA server provide to the joining node?
Are you thinking about various kinds of group policies, etc?

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [