Subject: Issues that need some attention (2)

From: <[email-masked]>
Date: Tue, 9 Jul 2002 16:38:35 -0500

Issue 2
-------

How does PANA prevent session hijacking?

Possibilities:

a. Secure every packet with IPsec AH
b. Frequent reauthentication of user
c. LSA (local security association techniques)
   draft-le-pana-lsa-tsk-00.txt

-Chairs

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Tue, 9 Jul 2002 16:35:40 -0700

Folks,

Here are few more issues for the protocol solution
discussion... Please provide feedback, in the form of
comments/questions on the current list, proposals
of other issues and possibilities.

Issue 3
-------

What would be the base protocol of PANA to encapsulate EAP?

Possibilities:

a. UDP
b. ICMP
c. IP

Issue 4
-------

What would be the mechanism for PAA discovery?

Possibilities:

a. Sending a multicast packet to a well-known address
b. ?

Issue 5
-------

What would be the heartbeat mechanism for PANA?

Possibilities:
a. PANA Hello/Bye messages
b. simple ping (i.e., icmp echo request/reply)
c. Local re-authentication

Issue 6
-------
A new IP address might need to be assigned to the PaC
upon successful authentication. How is this done?

Possibilities:

a. PaC can always assume that the IP address associated
with the interface is temporary and needs to be renewed
upon initial PANA exchange. 

b. A bit in the PANA success message can inform PaC that
it needs to renew its IP address.

c. PAA can take an action to deprecate PaC's IP
address and force it to renew it. E.g., access router,
which is co-located with the PAA, can send a unicast
router advertisement to deprecate the temporary prefix
and advertise a new prefix.

 -Chairs

---

From: Ilkka Vesa <[email-masked]>
Date: Wed, 10 Jul 2002 13:22:02 +0300 (EET DST)

Hi,

and one comment on the Issue 4...

> a. Sending a multicast packet to a well-known address

If EAP is used in PANA (like Issue 3 implies), PAA is the initiator of the
authentication. So wouldn't it be more useful to concentrate first on how
PAA detects new clients to send EAP-Identity Requests? Like it is
done in chapter 5.1.1 in EAP over UDP -draft.

PAA discovery could then be used as a last resort, if client wants to use
PANA and PAA hasn't detected PaC's presence (or PAA doesn't support PANA).

Ilkka

--
Ilkka Vesa ([email-masked])
Tampere University of Technology

---

From: "James Kempf" <[email-masked]>
Date: Wed, 10 Jul 2002 08:25:54 -0700

For 3b), SLP.

            jak