Subject: session-id

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 17 Apr 2003 01:28:09 -0400

Per Alper's suggestion, I try to open up a new thread for session-id.

In pana-00 draft, a PANA session is identified by using device
identifier, which is either an IP address or a MAC address.  I have
the following scenario which might be difficult to support in the
current draft:

   A PaC starts PANA with using unspecified IP address.  After the PaC
   is succesfully authenticated, it configures an IP address via DHCP.
   Before the PaC obtains an IP address, the MAC address is used as
   the device identifier.  Suppose that the network forces all PaCs to
   use L3 ciphers, the PaC needs to perform IKE in order to establish
   an IPsec tunnel between the PaC and EP after the PaC obtains an IP
   address.

   The IKE credential is to be derived from EAP Master Key established
   between the PaC and PAA as a result of successful PANA
   authentication (I presume an Informational RFC describes a
   mechanism for the credential derivation).

   In order for IKE to succeed, the EP needs to know the IKE
   credential and IP address of the PaC.  This means that IP address
   should also be a device identifier even when the MAC
   address is initially used as the device identifier.  Note that the
   MAC address may still be used as a device identifier even after the
   PaC configures an IP address, in order to secure future DHCP
   re-configuration.

   The IP address can be a link-local address, however, if additional
   packet filtering is applied at EP to inner IP headers based on the 
   PaC's global IP address, then such a global IP address would need
   to be registered to the EP as a device identifier.

This scenario might affect PANA design as follows:

-  Both MAC address and IP address might need to be used as device
   identifier at one time.

-  Multiple IP addresses might need to be used as device identifier at
   one time.

These observation might boil down to the following functionalities for
PANA:

-  Ability to update device identifier, perhaps based on add/delete
   operation.

-  Ability to identify a PANA session based on a session identifier, 
   which is more stable identifier than device identifier.

Comments?

Yoshihiro Ohba

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Fri, 18 Apr 2003 15:12:21 +0200

hi yoshi,

the session id-stuff is addressed with Issue 6: Session Identifier or SPIs.

i fully agree with you with respect to the dhcp based scenario. i also agree
to your conclusions and i fully support
- the introduction of an identifier which is different to the mac/ip address
- the ability to update the mac/ip address

furthermore i think that it is good to separate the different identifiers
and to avoid overloading. (as a general design principle)

it is helpful to point to installed state information based on a fixed
length identifier instead of using something with variable length (different
link layer addresses, ipv4/ipv6 addresses).

the uniqueness of such an identifier, however, requires some care:

a) is it sufficient to have (let's say) a 128-bit number which is randomly
created?

b) should we apply a concept similar to the spi (ike, ikev2) which provides
uniqueness between the two entities. however, in case of mobility spi
collisions still can occur.

ciao
hannes

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:[email-masked]]
> Sent: Donnerstag, 17. April 2003 07:28
> To: [email-masked]
> Subject: session-id
>
>

---

From: Alper Yegin <[email-masked]>
Date: Fri, 18 Apr 2003 16:55:18 -0700

> Per Alper's suggestion, I try to open up a new thread for session-id.

Thank you Yoshi.

>  an IPsec tunnel between the PaC and EP after the PaC obtains an IP

I presume the assumption is that dhcp is secured. Otherwise, the client
could be given an IP address prior to PANA and there wouldn't be such a
problem. The only reason DHCP comes after PANA is that DHCP is secured using
PANA SA, is that right?

If this network is using IPsec for access control, then the other assumption
seems like this: Clients are allowed to perform DHCP in addition to PANA
before they are authorized to access the network.

>  PaC configures an IP address, in order to secure future DHCP

If IPsec is used for access control, MAC address has no significance for
PANA or access control. If L2 ciphers are used, IP addresses have no
significance...

>  to be registered to the EP as a device identifier.

If we are using an IPsec tunnel between PaC and EP, the inner addresses have
no significance for access control. So, I don't think we need to care about
them.

> -  Both MAC address and IP address might need to be used as device

Sure the PAA and PaC can be aware of both. But depending on the access
control mechanism, only one is significant.

> -  Multiple IP addresses might need to be used as device identifier at

I think one is enough.

>  which is more stable identifier than device identifier.

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 18 Apr 2003 18:31:04 -0400

> problem. The only reason DHCP comes after PANA is that DHCP is secured using

I think so.

> before they are authorized to access the network.

Yes, that would be the other assumption.

> PANA or access control. If L2 ciphers are used, IP addresses have no

L2 ciphers protect MAC address spoofing but do not protect IP address
spoofing.  I think this is addressed in section 6.4 of
draft-ietf-pana-threats-eval-03.txt.

> no significance for access control. So, I don't think we need to care about

I think the relationship between outer IP address and inner IP address
is similar to the one between MAC address and IP address.  Protecting
only outer IP address does not protect inner IP address spoofing.  I'm
not sure whether this is the area of PANA or SEND.

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Mon, 21 Apr 2003 11:21:58 -0700

> not sure whether this is the area of PANA or SEND.

IMO, this would be for SEND to handle. This is on the IP address ownership
side of the problem, not the access control.

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 21 Apr 2003 17:43:38 -0700

Given that varidation of the inner IP address of an IPsec tunnel in
the access network is a task of SEND, do you think session-id is still
not necessary for PANA for the remaining part of the scenario (i.e.,
performing PANA with unspecified IP adress, then DHCP and finally
IKE)?

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Tue, 22 Apr 2003 11:47:46 -0700

> performing PANA with unspecified IP adress, then DHCP and finally

I'm inclined to think session id concept would be useful, but let's see what
else we want to use session ids for, and how it will impact the protocol
design.

Alper