Re: [pcp] About selecting a key management for PCP

[Alper Yegin <[e-mail]>]

>> an in-band authenticaiton mchanism for PCP (actually a simplified PANA).
> 
> 
>> It's not simplified…. It's basically growing PANA (an EAPoUDP transport) within PCP. A redundant work that'd >result in more complexity than keeping two simple protocols separate. This "oh I'll just carry EAP over my favorite >protocol (e.g., DHCP!), and it'd be sooo simple" was tried before and failed miserably.  PCP and its key >management are two separate issues that deserve two separate protocols (similar to IKE and IPsec being >separate). I don't see any value in cobbling them up, which is more like a PPP-style approach -- all-in-one.
> 
> 
> 
> Maybe my bad English causes confusion. Sorry for that. The "simplified" here means we can remove the redundant functions of PANA and only keep the necessary part. That is exactly what we are trying to do in the pcp authentication draft.
> 

We can certainly profile PANA to to not use those unnecessary parts (IP-reconfig bit… just a bit, don't use it).


> In addition, you remind me one thing. Karp WG is trying to use IKEv2 to provide key management for unicast routing protocols. If our WG decide to select a separated AKM
> solution. Do you think it is a good idea to borrow their work to secure PCP?
> 

Sure, it's a candidate. (Though, IMHO, IKEv2 is so IPsec-specific, using it for keying other protocols is a stretch).

Alper



> Cheers
> 
> Dacheng
> 
> Alper
>