[pcp] channel binding (was Re: Comparison of PCP authentication)

[Alper Yegin <[e-mail]>]

(spinning off a new thread for easier tracking)

What value are you thinking of using for i1 and i2? IP address of the PCP server?
If so, you can do that in any of those solutions. 
Is there a problem?

Alper




On Aug 16, 2012, at 3:46 PM, Sam Hartman wrote:

> I have a question.
> As background reading I recommend taking a look at RFC 6677 section 5.1.
> 
> 
> If we want to use EAP channel binding to bind an authentication to a
> specific PCP server, how will we do that with PANA?
> 
> For all three approaches we need to define i1 or what attributes the client
> sends in the EAP channel binding to give the identity of the PCP
> server. We could for example use the IP address of the PCP server in the
> nas-ip-address (or v6 address) AVP.
> 
> For the PCP specific approach the rest is easy. The PCP server knows it
> is a PCP server, and includes those attributes in the AAA message
> so that  the EAP server has i2.
> 
> How does the PANA server find out i2?
> 
> RFC 6677 strongly recommends that an eap-lower-layer attribute be
> included.  There's a value defined for PANA.  However, that wouldn't
> really be a good choice here because it would not allow an EAP server to
> distinguish PCP authentications from uses of PANA for network access.
> how does the PANA server know which eap-lower-layer to include?
> 
> --Sam
> _______________________________________________
> pcp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pcp