eap Mailing List: RE: PANA and EAP keying framework

[Bernard Aboba (bernard_aboba]

> There are numerous places, but you can start with clause 5.9.2.1, which
> gives an expository overview of the process.
> IP traffic is not encapsulated with the 802.1X Ethertype, so is
> expressly blocked.

Right.

> In any case, another way is to use multiple (virtual) APs, one
> operating in 'open' authentication running PANA and the other
> operating in 802.11i, and switching from the former AP to the latter
> after PANA authentication.

That is also forbidden in IEEE 802.11i, which includes the authorizations as 
part of the PMKSA context.  Therefore it is not permitted to use 
authorizations provided for one virtual AP with another virtual AP.