Subject: RE: session-id

From: <[email-masked]>
Date: Tue, 22 Apr 2003 11:53:06 +0300

> -----Original Message-----
> From: ext Hannes Tschofenig [mailto:[email-masked]]
> Sent: 18 April, 2003 16:12
> To: Yoshihiro Ohba; [email-masked]
> Subject: RE: session-id
> 
> 
> hi yoshi,
> 
> the session id-stuff is addressed with Issue 6: Session 
> Identifier or SPIs.
> 
> i fully agree with you with respect to the dhcp based 
> scenario. i also agree
> to your conclusions and i fully support
> - the introduction of an identifier which is different to the 
> mac/ip address
> - the ability to update the mac/ip address

I fully agree.
 
> furthermore i think that it is good to separate the different 
> identifiers
> and to avoid overloading. (as a general design principle)

That's right.

> it is helpful to point to installed state information based on a fixed
> length identifier instead of using something with variable 
> length (different
> link layer addresses, ipv4/ipv6 addresses).
> 
> the uniqueness of such an identifier, however, requires some care:
> 
> a) is it sufficient to have (let's say) a 128-bit number 
> which is randomly
> created?
> 
> b) should we apply a concept similar to the spi (ike, ikev2) 
> which provides
> uniqueness between the two entities. however, in case of mobility spi
> collisions still can occur.

Session ID scope is quite hard to manage when there are multiple PAAs involved, reboots etc. See my email on Diameter Session-Id. It's not fixed length, but is a ready concept. Also, interaction between PANA and Diameter is likely to occur.

- Dan

> ciao
> hannes
> 
> 
> > -----Original Message-----
> > From: Yoshihiro Ohba [mailto:[email-masked]]
> > Sent: Donnerstag, 17. April 2003 07:28
> > To: [email-masked]
> > Subject: session-id
> >
> >
> > Per Alper's suggestion, I try to open up a new thread for 
> session-id.
> >
> > In pana-00 draft, a PANA session is identified by using device
> > identifier, which is either an IP address or a MAC address.  I have
> > the following scenario which might be difficult to support in the
> > current draft:
> >
> >    A PaC starts PANA with using unspecified IP address.  
> After the PaC
> >    is succesfully authenticated, it configures an IP 
> address via DHCP.
> >    Before the PaC obtains an IP address, the MAC address is used as
> >    the device identifier.  Suppose that the network forces 
> all PaCs to
> >    use L3 ciphers, the PaC needs to perform IKE in order to 
> establish
> >    an IPsec tunnel between the PaC and EP after the PaC 
> obtains an IP
> >    address.
> >
> >    The IKE credential is to be derived from EAP Master Key 
> established
> >    between the PaC and PAA as a result of successful PANA
> >    authentication (I presume an Informational RFC describes a
> >    mechanism for the credential derivation).
> >
> >    In order for IKE to succeed, the EP needs to know the IKE
> >    credential and IP address of the PaC.  This means that IP address
> >    should also be a device identifier even when the MAC
> >    address is initially used as the device identifier.  
> Note that the
> >    MAC address may still be used as a device identifier 
> even after the
> >    PaC configures an IP address, in order to secure future DHCP
> >    re-configuration.
> >
> >    The IP address can be a link-local address, however, if 
> additional
> >    packet filtering is applied at EP to inner IP headers 
> based on the
> >    PaC's global IP address, then such a global IP address would need
> >    to be registered to the EP as a device identifier.
> >
> > This scenario might affect PANA design as follows:
> >
> > -  Both MAC address and IP address might need to be used as device
> >    identifier at one time.
> >
> > -  Multiple IP addresses might need to be used as device 
> identifier at
> >    one time.
> >
> > These observation might boil down to the following 
> functionalities for
> > PANA:
> >
> > -  Ability to update device identifier, perhaps based on add/delete
> >    operation.
> >
> > -  Ability to identify a PANA session based on a session identifier,
> >    which is more stable identifier than device identifier.
> >
> >
> > Comments?
> >
> > Yoshihiro Ohba
> >
> 
>