Subject: [Pana] RE: EAP-based reauth clarification [Re: Mobility Handling in PANA]

From: Giaretta Gerardo <[email-masked]>
Date: Tue, 13 Jul 2004 14:37:55 +0200

Yoshihiro Ohba wrote:  
> 
> Based on the discussion below.  I would suggest adding the
> following sentences to section 4.4 of PANA speficication:
> 
> "
> When NAP and ISP separate authetnications were performed in 
> the first occurence of PANA authentication phase, the same 
> NAP and ISP separate authentications MUST also be performed 
> in subsequent EAP-based re-authentication occurances.  
> Otherwise, NAP and ISP separate authentications MUST NOT be 
> performed in subsequent EAP-based re-authentication occurances. "
>

Just two comments:

[1] A similar text is provided in section 4.9: 

"
   When separate EAP authentications are performed for ISP and NAP in a
   single PANA session, it is possible that different authorization
   lifetime values are associated with the two authentications.  In this
   case, the smaller authorization lifetime value MUST be used for
   calculating the PANA Session-Lifetime value.  As a result, when
   EAP-based re-authentication occurs, both NAP and ISP authentications
   will be performed in the same re-authentication procedure.
"

Is this really needed? I mean, it could be unefficient to perform both
the authentications if only one is required. This is a consequence that
the PANA Session Lifetime is equal to the smaller authorization lifetime
value. 
I'm thinking if it is possible to manage the lifetimes in order to
perform only the authentication that is required. Do you have any
thoughts on this?

A possible solution could be (however I'm not sure if this works):

PANA session lifetime = min (Residual NAP auth. Lifetime, Residual ISP
auth. Lifetime) 

In this way, only the required re-authentication is performed and the
PANA session lifetime is re-calculated at the end of each
re-authentication. However there might be cases in which it is
convenient to perform both the authentications together (e.g. the
difference between the residual lifetimes is very small). 

[2] What about a scenario in which a new ISP is available? Consider that
at the first occurence of PANA there were only two ISPs available (ISP1
and ISP2). If a new ISP (ISP3) becomes available (e.g. after a movement
of the PaC), I think this must be communicated to the PaC. How can we
handle this?

--Gerardo

> Yoshihiro Ohba
> 
> 
> On Mon, Jul 12, 2004 at 05:42:11PM +0200, Giaretta Gerardo wrote:
> > Hi Yoshi,
> > 
> > > > > I am not sure how EAP-based re-authentication can 
> work after the
> > > > > PaC has successfully established a new PANA session with nPAA 
> > > > > based on the mobility optimization operation, 
> especially with NAP 
> > > > > and ISP separated authentications.  Since PSR-PSA exchange is 
> > > > > omitted in the case of EAP-based re-authentication, 
> there is no 
> > > > > means to negotiate on NAP and ISP separate 
> authentications between
> > 
> > > > > the PaC and nPAA.  Do you have any thoughts on this?
> > > > > 
> > > > 
> > > > I'm not sure I understand your point: is this a general
> > > PANA issue or
> > > > is it related to the operations described in 
> > > > draft-bournelle-pana-ctp-00.txt?
> > > 
> > > It might be related to both.  I think that if NAP and ISP 
> separate 
> > > authentications were made in the initial authentication, then the 
> > > same NAP and ISP separate authentications should also be made in 
> > > EAP-based re-authentication (this is a PANA issue, i.e., 
> this should 
> > > be described in the PANA specification.)  If the same thing
> > > needs to be done in EAP-based re-authentication after handoff 
> > > (though I am not sure the same thing needs to be done in this 
> > > case), information on whether NAP and ISP separate 
> > > authentications were made in the previous network may need to 
> > > be included in PANA-CTD (this is an issue of 
> > > draft-bournelle-pana-ctp-00.txt).
> > >
> > 
> > I agree with you. The result of the usage of CTP, as the 
> result of any 
> > fast authentication mechanism, must be the same as the one obtained 
> > performing the whole authentication procedure. This implies 
> that nPAA 
> > should know if PaC performed double authentication and which ISP it 
> > chose. Therefore this information must be transferred in 
> CTD message.
> > 
> > However, I think that EAP re-authentication is not related 
> to mobility 
> > handling. The usage of CTP allows to transfer the PANA 
> context to the 
> > nPAA. After the PBR/PBA exchange the PaC is authenticated 
> and the nPAA 
> > knows the residual authorization lifetime. Therefore 
> > EAP-reauthentication is not performed immediately after the handoff 
> > and it is accomplished as specified in PANA specs.
> > 
> > Note that we have not defined yet how to inform both NAP 
> and ISP AAA 
> > system of the new PaC's location. I think this is also an important 
> > issue.
> > 
> > 
> > --Gerardo
> > 
> > 
> >  
> > > Yoshihiro Ohba
> > > 
> > 
> > 
> > 
> > 
> > Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia 
> > S.p.A.
> > 
> > ====================================================================
> > CONFIDENTIALITY NOTICE
> > This message and its attachments are addressed solely to 
> the persons 
> > above and may contain confidential information. If you have 
> received 
> > the message in error, be informed that any use of the 
> content hereof 
> > is prohibited. Please return it immediately to the sender 
> and delete 
> > the message. Should you have any questions, please send an 
> e_mail to 
> > [email-masked]. Thank you 
> > ====================================================================
> 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to
[email-masked]. Thank you
====================================================================

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 14 Jul 2004 15:52:12 -0400

> perform only the authentication that is required. Do you have any

I had a couple of thoughts on that before the current solution, but
there are many issues as described below.

> re-authentication. 

- Should the S-bit set if the EAP re-authentication with a single EAP
run is performed?

- Which exchange should be used for carrying authenticaiton result for
the EAP re-authentication with a single EAP run, PBR-PBA or PFER-PFEA?

- What happens if the EAP re-authentication with a single EAP run (for
NAP authentication for example) fails?  Should the PANA session be
deleted, or remain because authorization for ISP part still exists?
In the latter case, are the subsequent EAP-reauthentications always
performed with a single EAP run for ISP authentication?  And also in
the latter case is the PANA_MAC_KEY needs to be updated after the
single EAP run failure in the EAP re-authentication?  If so, how?

> However there might be cases in which it is

> of the PaC), I think this must be communicated to the PaC. How can we

After a movement of a PaC, the new ISP information can be contained in
PSR sent from the new PAA.  However, if the PaC returns a PSA with
ISP3 information in a ISP-Information AVP, the PAA should not perform
mobility optimization.

In the case where a new ISP becomes available while the PaC is
connecting to the same PAA, I don't think the PaC has to know the new
ISP immediately.

Yoshihiro Ohba