Re: [Nea] Consensus check on EAP-based PT

[Nancy Cam-Winget <[e-mail]>]

I prefer the EAP-TLV approach.

While there may be implementations that are close to the EAP-PT proposal,
 there are also similar implementations of the EAP-TLV.

Several EAP-PT issues and concerns were raised that for me, outweigh
 the "benefits of already having code":
 - the goal for NEA is to define a transport for data.  EAP is designed
 and defined to be an authentication framework.  To "only carry data",
 issues for how the design must now accommodate the "no authentication"
 must now be compensated for...  For instance: how does the state machine
 know that the intent is for it to carry NEA data only and not
authentication?
 The two main issues of violations for using an authentication framework
(EAP)
 for not doing authentication is in the generation of an identity and the
 creation of keys. 

 - code and configuration updates are going to be needed regardless of
 whether we adopt EAP-PT or EAP-TLV.  While it may be perceived to "be
simpler" as some vendors allow for ease of adding EAP methods....these
 interfaces were intended to be defined for adding new authentication
 methods, not "methods that only carry data".

 - the above raises one of my security concerns that if we were to allow
 for "lets just add another EAP method", there is the danger that EAP-PT
 can be used as a standalone method which we have discussed as being
 insecure.  As Joe succinctly states, while we can make special cases
 for EAP-PT....but more importantly, I think we are setting a bad precedence
 in defining a "non authenticating" EAP method and opening the door for
 defining other things as EAP methods too.....

   Nancy.


On 8/2/11 2:04 PM, "Susan Thomson" <[e-mail]> wrote:

> At IETF81 and several prior IETF meetings, as well as on the mailing
> list, the WG has evaluated the pros and cons of 2 architectural
> approaches to carrying posture within an EAP tunnel method:
> 
> - EAP method
> http://www.ietf.org/internet-drafts/draft-hanna-nea-pt-eap-01.txt
> 
> - EAP TLV.
> http://www.ietf.org/internet-drafts/draft-cam-winget-eap-tlv-03.txt
> 
> So far, there has been no WG consensus to adopt one architecture versus
> the other. (At the recent F2F meeting in Quebec City, the consensus
> check at the meeting showed an equal number in favor of each approach.)
> 
> This email is a final call to determine WG consensus on the L2 PT
> approach.
> 
> The consensus check is to choose one of the following 3 options:
> 1) PT-EAP approach
> 2) NEA-TLV approach
> 3) Neither (please state the reason if you choose this option)
> 
> Please respond to the above question by Tues Aug 16 at 5pm PT. Please do
> so even if you have already expressed your opinion, either at a WG
> meeting or on the mailing list. The answer can be as brief as selecting
> option 1), 2) or 3). If you would like to add your reasons for your
> choice, that would be appreciated too, especially if you choose option
> 3).
> 
> If we have consensus on the mailing list, we will adopt the selected
> approach.
> 
> If we still do not have consensus, the WG chairs and AD (Stephen
> Farrell) have agreed that the AD will make a decision. The proponents of
> both approaches have agreed to abide by this decision. This resolution
> plan was discussed at the F2F meeting at IETF81. This plan was also
> communicated to the list in an email on Jun 30, 2011. No objections have
> been received.
> 
> In either case, the individual submission corresponding to the selected
> approach will be adopted as a -00 NEA WG I-D, and we will proceed with
> the normal process of editing the document within the WG.
> 
> Thanks
> Susan
> 
> ------------------
> References:
> IETF81 audio session (start at approx 44 mins into session):
> http://www.ietf.org/audio/ietf81/ietf81-2103-20110727-1256-pm.mp3
> 
> IETF81 draft meeting minutes:
> http://tools.ietf.org/wg/nea/minutes
> 
> _______________________________________________
> Nea mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/nea
>