RFC 5192
DHCP Options for Protocol for Carrying Authentication for Network Access (PANA) Authentication Agents
RFC 5192 🎀 DHCP Options for PANA Authentication Agents
okay bestie, let's get into RFC 5192! 💖 It's a Standards Track doc from May 2008, written by Lionel Morand (France Telecom R&D), Alper E. Yegin (Samsung), Suraj Kumar (Tech Mahindra Ltd), and Syam Madanapalli (Samsung). Its whole purpose is defining new DHCPv4 and DHCPv6 options 🧚. The header doesn't list any Obsoletes or Updates lines, so nothing is listed there.
Network Working Group ✨, Request for Comments: 5192 ✨, Category: Standards Track ✨, May 2008 ✨. The title is "DHCP Options for Protocol for Carrying Authentication for Network Access (PANA) Authentication Agents" 💅.
Status of This Memo 🌸
okay so this is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🫶. For the standardization state and status, check the current edition of "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited ✨.
Abstract 💜
this doc defines new DHCPv4 and DHCPv6 options that carry a list of IP addresses. The list helps a PANA Client (PaC) find one or more PANA (Protocol for carrying Authentication for Network Access) Authentication Agents (PAAs) 🦋. It's one of the ways a PaC can find PAAs, so it's giving helpful 🌈.
Table of Contents 🍓
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Specification of Requirements . . . . . . . . . . . . . . . . . 2
3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . 2
4. PANA Authentication Agent DHCPv4 Option . . . . . . . . . . . . 3
5. PANA Authentication Agent DHCPv6 Option . . . . . . . . . . . . 4
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 5
7. Security Considerations . . . . . . . . . . . . . . . . . . . . 5
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 5
9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 6
9.1. Normative References . . . . . . . . . . . . . . . . . . . 6
9.2. Informative References . . . . . . . . . . . . . . . . . . 61. Introduction 🎀
okay so PANA [RFC5191] defines a brand new lower layer for the Extensible Authentication Protocol (EAP) [RFC3748], and it runs over IP between the protocol end-points 💖.
the PANA protocol runs between a PANA Client (PaC) and a PANA Authentication Agent (PAA) so they can handle authentication and authorization for network access service 🔥.
this doc specifies DHCPv4 [RFC2131] and DHCPv6 [RFC3315] options that let PaCs discover PAAs. It's one of the methods for locating PAAs ✨.
the DHCP options in this doc are only used as a PAA discovery mechanism. They MUST NOT be used to perform any negotiation of the use of PANA between the PaC and a PAA. Not negotiating through them, periodt 💅.
2. Specification of Requirements 🦋
this section is the key word check 🔍. The words are often capitalized, and they're interpreted as described in [RFC2119]. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🫶.
3. Terminology 🧚
this doc uses the DHCP terminology from [RFC2131], [RFC2132], and [RFC3315] 🌸.
it also uses the PANA terminology from [RFC5191]. The following terms are defined here:
- PANA Client (PaC): the client side of the protocol, living in the access device (like a laptop or PDA). It's responsible for giving credentials to prove its identity (authentication) for network access authorization. The PaC and the EAP peer are co-located in the same access device 💜.
- PANA Authentication Agent (PAA): the protocol entity in the access network. It verifies the credentials a PaC provides and authorizes network access to the access device. The PAA and the EAP authenticator (and optionally the EAP server) are colocated in the same node 👑.
4. PANA Authentication Agent DHCPv4 Option 🌈
this DHCPv4 option carries a list of 32-bit (binary) IPv4 addresses for PANA Authentication Agents (PAAs) that the PANA client (PaC) can use ⭐.
the DHCPv4 option for PAA has the format in Figure 1 🎀:
0 1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| option-code | option-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ PAA IPv4 Address +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1: PAA DHCPv4 option- option-code:
OPTION_PANA_AGENT (136). - option-length: the length of the 'options' field in octets. It MUST be a multiple of four (4) 🙈.
- PAA IPv4 Address: the IPv4 address of a PAA for the client to use. The PAAs are listed in order of preference for the client 💖.
a PaC (DHCPv4 client) SHOULD request the PAA DHCPv4 Option in a Parameter Request List, as described in [RFC2131] and [RFC2132] 🫶.
if a DHCPv4 server is configured with a (list of) PAA address(es), it SHOULD send the client the PAA DHCPv4 option, even if the client didn't explicitly request it 🔥.
a PaC (DHCPv4 client) that receives the PAA DHCPv4 option SHOULD use the (list of) IP address(es) to locate PAA(s) ✨.
the PaC (DHCPv4 client) MUST try the records in the order listed in the PAA DHCPv4 option it received from the DHCPv4 server 👑.
5. PANA Authentication Agent DHCPv6 Option 🦋
this DHCPv6 option carries a list of 128-bit (binary) IPv6 addresses for PANA Authentication Agents (PAAs) that the PANA client (PaC) can use 💜.
the DHCPv6 option for PAA has the format in Figure 2 🌸:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| option-code | option-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ PAA IPv6 Address +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| .... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: PAA DHCPv6 option- option-code:
OPTION_PANA_AGENT (40). - option-length: the length of the 'options' field in octets. It MUST be a multiple of sixteen (16) 🙈.
- PAA IPv6 Address: the IPv6 address of a PAA for the client to use. The PAAs are listed in order of preference for the client 🧚.
a PaC DHCPv6 client SHOULD request the PAA DHCPv6 option in an Options Request Option (ORO), as described in the DHCPv6 specification [RFC3315] 🫶.
if a DHCPv6 server is configured with a (list of) PAA address(es), it SHOULD send the client the PAA DHCPv6 option, even if the client didn't explicitly request it 🔥.
a PaC (DHCPv6 client) that receives the PAA DHCPv6 option SHOULD use the (list of) IP address(es) to locate PAA(s) ✨.
the PaC (DHCPv6 client) MUST try the records in the order listed in the PAA DHCPv6 option it received from the DHCPv6 server 👑.
6. IANA Considerations 🌈
the following DHCPv4 option code for PANA Authentication Agent options has been assigned by IANA 🎀:
Option Name Value Described in
-----------------------------------------------
OPTION_PANA_AGENT 136 Section 4the following DHCPv6 option code for PANA Authentication Agent options has been assigned by IANA 💖:
Option Name Value Described in
------------------------------------------------
OPTION_PANA_AGENT 40 Section 57. Security Considerations 💀
this section is serious, bestie 😭. The security considerations in [RFC2131], [RFC2132], and [RFC3315] apply.
if an adversary manages to modify the response from a DHCP server, or insert its own response, a PANA Client could be led to contact a rogue PANA Authentication Agent. That rogue PAA could then intercept authentication requests and/or deny network access to the access device 🚨.
in most networks, the DHCP exchange that delivers the options before network access authentication is neither integrity protected nor origin authenticated. So the options defined in this document MUST NOT be used to perform any negotiation on the use of PANA between the PANA Client and a PANA Authentication Agent. Using the presence (or absence) of these DHCP options as an indication of network mandating PANA authentication (or not) is an example of such a negotiation mechanism. This negotiation would allow bidding-down attacks, where clients get pushed into a lower-grade security mechanism (or even no security at all) 🙈.
8. Acknowledgements 🫶
we'd like to thank Ralph Droms, Stig Venaas, Ted Lemon, Andre Kostur, and Bernie Volz for their valuable comments 💜. We'd also like to thank Jari Arkko, Thomas Narten, and Bernard Aboba, who did several reviews, plus everyone in the PANA and DHC working groups who helped improve this document 🌸.
9. References 🍓
9.1. Normative References
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, March 1997.
- [RFC2132] Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor Extensions", RFC 2132, March 1997.
- [RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C., and M. Carney, "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", RFC 3315, July 2003.
- [RFC5191] Forsberg, D., Ohba, Y., Patil, B., Tschofenig, H., and A. Yegin, "Protocol for Carrying Authentication for Network Access (PANA)", RFC 5191, May 2008.
9.2. Informative References
- [RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H. Levkowetz, "Extensible Authentication Protocol (EAP)", RFC 3748, June 2004.
Authors' Addresses 🦋
- Lionel Morand, France Telecom R&D, EMail: lionel.morand@orange-ftgroup.com
- Alper E. Yegin, Samsung, EMail: a.yegin@partner.samsung.com
- Suraj Kumar, Tech Mahindra Ltd, EMail: surajk@techmahindra.com
- Syam Madanapalli, Samsung, EMail: syam@samsung.com
Full Copyright Statement 💖
Okay bestie, time for the legal bit, but make it cute 🎀 Copyright (C) The IETF Trust (2008). ✨ This document is subject to the rights, licenses and restrictions in BCP 78, and except as set out there, the authors keep all of their rights.
This document and the information in it are provided on an "AS IS" basis, and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE 🙈 all turn down every warranty, whether express or implied. That includes, but isn't limited to, any promise that using the information here won't infringe any rights, and any implied warranties of merchantability or fitness for a particular purpose. 💅
Intellectual Property 🦋
Okay so the IETF takes no position on whether any Intellectual Property Rights (or other rights someone might claim over the tech in this document) are valid or how far they reach. It also doesn't say whether any license under those rights is available, or might be. It hasn't done any independent digging to find such rights either 🔍 If you want the procedures for rights in RFC documents, look in BCP 78 and BCP 79, ngl they're the place to go. 🌸
Copies of IPR disclosures sent to the IETF Secretariat are the main thing here, plus any assurances of licenses that will be made available. You can also find out what happened when someone tried to get a general license or permission for implementers or users to use those proprietary rights. All of that lives in the IETF online IPR repository at http://www.ietf.org/ipr ✨
The IETF also invites any interested party to flag any copyrights, patents or patent applications, or other proprietary rights that might cover technology needed to implement this standard. ⭐ Send that info to the IETF at ietf-ipr@ietf.org 💜
📦 where this page comes from
- ietf: rfc5192 2008-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms