Subject: RE: Establishsing an IPsec SA between PaC and EP

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 24 Mar 2003 14:04:02 -0800

Yoshihiro,

> 
> With regard to layer-2 ciphering, if we consider 802.11 
> medium for example, there is a selection of ciphersuites 
> and/or key management method, (static WEP, 802.1X key 
> management with PSK, etc.).  With regard to layer-3 ciphering 
> there is a selection of key management protocol, i.e., IKE or 
> IKEv2.  The design team did not have much time to discuss 
> whether to carry this level of cipher enabling parameters in 
> PANA message, and thus the -00 version assumes that this 
> level of parameters are pre-configured.  
> 
> Does this level of parameters need to be carried by PANA?
> 
I guess so without which the PaC will be clueless as to what
to do next.

After the PANA SA is established, what is the next step the PaC does ?
From what I understood from the earlier mails, there is no separate
exchange to derive PANA SA. AAA distributes keys to PAA and PaC. They
further derive a key that defines PANA SA i.e there is no exchange here.

How does PaC know that PAA has the right key ? PaC may not be willing
to send any data (it does not want to expose any data) unless it
verifies
that PAA has the right key. This is third step described in EAP-keying
draft as out of band mechanism. Does this happen ?

After all this, you may have Ipsec SA/link ciphering protection or may
be merged with the above step ? 

So, for PaC to know what to do next, you may need some explicit
messages.
It just needs to be extensible so that others can use it.

-mohan

> > We can still keep the message that conveys this flexible but just 
> > produce one informational draft that describes using IPsec.
> 
> I agree on producing an informational draft that describes 
> how to enable IPsec between PaC and EP by using PANA.
> 
> Yoshihiro Ohba
> 
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 24 Mar 2003 17:37:21 -0500

> draft as out of band mechanism. Does this happen ?

PANA already supports PANA SA verification in that PANA_success
PANA_success_ack messages contain a MAC AVP and the MAC is calculated
based on PANA_MAC_Key which is part of PANA SA.  So we do not have to
worry about this.

Yoshihiro Ohba