[pcp] Authentication: how do we make a decision about the approach

[Sam Hartman <[e-mail]>]

I for one don't really know how to get the working group more
information on which to make a decision about which authentication
approach to choose.
We all seem to agree that it's possible to specify PCP-based security
with any of the PANA approaches or simply by creating an EAP lower
layer.
Stuart, Alan, myself and a few others have said they believe the EAP lower
layer approach will be easier to implement.
Alper, Yoshi and a few others have indicated they favor PANA.

The sense of the room roughly favored an EAP specific approach in
Atlanta, but I'm not sure the chairs felt comfortable calling it a rough
consensus of the room.  When we asked the same question earlier, we got
a different result. Of course we've explored the issues more. That was
before I looked at various implementation strategies and before we had
the architectural discussion.

So, what now?

For myself, the discussions have strengthened my opinion that we'd be
better off defining an EAP lower layer for all the reasons that we've
discussed. So I rather strongly prefer that approach, and will argue for
that position until the consensus call is made. However, I'm in this
discussion to work on PCP security. If I end up in the rough on this
issue, I'll contribute to the PANA approach and would be able and
willing to contribute heavily to documents in that space.
Sure, I'd like to see the approach I think best be chosen, but more
important is providing a quality security solution for PCP.