Re: [pcp] Comparison of PCP authentication

[Sam Hartman <[e-mail]>]

I have a question.
As background reading I recommend taking a look at RFC 6677 section 5.1.


If we want to use EAP channel binding to bind an authentication to a
specific PCP server, how will we do that with PANA?

For all three approaches we need to define i1 or what attributes the client
sends in the EAP channel binding to give the identity of the PCP
server. We could for example use the IP address of the PCP server in the
nas-ip-address (or v6 address) AVP.

For the PCP specific approach the rest is easy. The PCP server knows it
is a PCP server, and includes those attributes in the AAA message
so that  the EAP server has i2.

How does the PANA server find out i2?

RFC 6677 strongly recommends that an eap-lower-layer attribute be
included.  There's a value defined for PANA.  However, that wouldn't
really be a good choice here because it would not allow an EAP server to
distinguish PCP authentications from uses of PANA for network access.
how does the PANA server know which eap-lower-layer to include?

--Sam