Subject: [Pana] [pana-ipsec] ID_KEY_ID

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 09 Feb 2004 08:28:57 -0800

In Section 5:

   "Aggressive mode with pre-shared key MUST be
   supported. PaC and EP SHOULD use its PANA session ID [PANA-PROT] as
   the payload of ID_KEY_ID in aggressive mode for establishing the
   phase I SA."

Since a PANA session can generate a fresh IKE pre-shared secret when a
AAA-Key (or an MSK in the current draft) is updated, I think the
payload of ID_KEY_ID should include not only PANA Session-Id but also
the value of PANA Key-Id AVP to uniquely identify different versions
of IKE pre-shared secrets within a PANA session.

(Also, the word "MSK" in pana-ipsec draft should be replaced with
"AAA-Key".)

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana