Subject: RE: Establishsing an IPsec SA between PaC and EP

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 21 Mar 2003 17:35:01 -0800

Yoshihiro,

> > 
> > > 
> > >   1) If PAA and EP are not co-located, need to discover 
> the IP address of EP
> > > also
> > >      so that an IPsec SA can be established.
> > >   [Ray Bell]  I assume you mean an IPSec SA between the 
> PAA and EP (i.e.,
> > > PaC<-->EP<-->PAA), which would require a two-step IPSec 
> configuration to be
> > > implemented: one SA between the PaC and EP, and one SA 
> between the EP and
> > > PAA.  Since IPSec Clients are common on most hosts, it may be more
> > > simplistic to allow an IPSec SA between the PaC<-->SAA, 
> where the EP is
> > > configured to route IKE & IPSec.
> > >
> > 
> > I guess that he means IPsec SA between the PaC and the EP. The issue
> > is that PaC need to discover the EP address to configure 
> his IPsec SA.
> 
> There might be the following design choices to support EP 
> discovery for 
> establishing IPsec SA in the access network:
> 
> - IP address(es) of EP(s) are carried in PANA messages, for 
> example, by 
>   including EP-Address AVP(s) in PANA_success message.  This 
> is possible 
>   since PAA knows the location of EP(s).  
> 
This looks like a better choice to me.

> - Define a new ICMP Code for ICMP Error message that is sent from EP 
>   to indicate the need for IPsec protection.  This requires 
> some traffic 
>   needs to be generated by PaC and captured by the EP.  I don't think 
>   defining a new ICMP Error Code just to know the EP address is a good
>   thing.
> 
> - Define a separate protocol for EP discovery.  I think this is not as
>   easy as the first choise.
> 
> > A more general issue is to know if PANA would be in charge 
> of configuring
> > such an SA. I think that it could be a nice feature.
> 
> Data-Protection AVP is defined for that purpose.  If a Data-Protection
> AVP in included in PANA_success message and its flag indicates
> network-layer ciphering, then it means PANA is in charge of enabling
> IPsec SA between PaC and EP by using a standard protocol such as IKE
> (and the IKE credential would be derived from the EAP Master Session
> Key established as a result of successful PANA authentication).
> 
This also looks like a good idea. I was about to raise this as another
requirement, but this one captures it i.e how does a PaC know whether
the network needs ciphering ? It is also possible that the ciphering
could be at link layer also i.e., PANA SA could be used to derive
keys for use at link layer ciphering also. Do we want to provide this
facility of choose whatever cipher you want at either layer 2 or layer 3?
We can still keep the message that conveys this flexible but just produce one
informational draft that describes using IPsec.

-mohan

> Yoshihiro Ohba
> 
> 
> > 
> > -- 
> > [email-masked]
> > 
> > 
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 21 Mar 2003 21:53:27 -0500

Hi Mohan,

> This looks like a better choice to me.

OK.

> facility of choose whatever cipher you want at either layer 2 or layer 3?

Yes.  If the flag in the Data-Protection AVP indicates layer-2 ciphering, 
it means is in charge of enabling layer-2 ciphering between PaC and EP.

On the other hand, both layer-2 and layer-3 ciphering have some
additional parameters as explained below.

With regard to layer-2 ciphering, if we consider 802.11 medium for
example, there is a selection of ciphersuites and/or key management
method, (static WEP, 802.1X key management with PSK, etc.).  With
regard to layer-3 ciphering there is a selection of key management
protocol, i.e., IKE or IKEv2.  The design team did not have much time
to discuss whether to carry this level of cipher enabling parameters
in PANA message, and thus the -00 version assumes that this level of
parameters are pre-configured.  

Does this level of parameters need to be carried by PANA?

> informational draft that describes using IPsec.

I agree on producing an informational draft that describes how to
enable IPsec between PaC and EP by using PANA.

Yoshihiro Ohba