Subject: [Pana] Mobility

From: Alper Yegin <[email-masked]>
Date: Mon, 09 Feb 2004 17:20:55 -0800

>From Jari's review comments:

   In case the new PAA retrieves the on-going PANA session attributes
   from the previous PAA, the PANA session continues with a PANA-Reauth
   exchange.  The MAC AVP contained in the PANA-Reauth messages MUST be
   generated and verified by using the retrieved PANA SA attributes.
   This exchange MUST also include Session-Id AVP that contains the
   newly assigned session identifier, and Device-Id AVP. A new PANA
   session is created upon successful completion of this exchange. This
   session inherits only the session lifetime, protection capability,
   and MSK attributes from the previous session. Other attributes are
   generated based on the PANA exchanges on the new link. While MSK
   stays the same, a new PANA_MAC_Key is computed using the new
   parameters. Subsequent MAC-AVPs are processed using this new PANA SA.

JARI: (Question) I presume that the link or IPsec layer protection
      is not inherited when you move? Such a movement would be hard,
      given the IPsec reliance on IP addresses which may have changed
      as a result of the authentication.

That's right. The secure association protocol needs to rerun following
successful PANA SA establishment on the new link.

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana