Subject: [Pana] RE: EAP-based reauth clarification [Re: Mobility Handling in PANA]

From: Giaretta Gerardo <[email-masked]>
Date: Thu, 15 Jul 2004 11:07:19 +0200

> > 
> > Just two comments:
> > 
> > [1] A similar text is provided in section 4.9:
> > 
> > "
> >    When separate EAP authentications are performed for ISP 
> and NAP in a
> >    single PANA session, it is possible that different authorization
> >    lifetime values are associated with the two 
> authentications.  In this
> >    case, the smaller authorization lifetime value MUST be used for
> >    calculating the PANA Session-Lifetime value.  As a result, when
> >    EAP-based re-authentication occurs, both NAP and ISP 
> authentications
> >    will be performed in the same re-authentication procedure. "
> > 
> > Is this really needed? I mean, it could be unefficient to 
> perform both 
> > the authentications if only one is required. This is a consequence 
> > that the PANA Session Lifetime is equal to the smaller 
> authorization 
> > lifetime value. I'm thinking if it is possible to manage 
> the lifetimes 
> > in order to perform only the authentication that is 
> required. Do you 
> > have any thoughts on this?
> 
> I had a couple of thoughts on that before the current 
> solution, but there are many issues as described below.
> 
> > 
> > A possible solution could be (however I'm not sure if this works):
> > 
> > PANA session lifetime = min (Residual NAP auth. Lifetime, 
> Residual ISP 
> > auth. Lifetime)
> > 
> > In this way, only the required re-authentication is 
> performed and the 
> > PANA session lifetime is re-calculated at the end of each 
> > re-authentication.
>

I try to reply to your issues, even if I'm still not sure if this
optimization is really needed.
 
> - Should the S-bit set if the EAP re-authentication with a 
> single EAP run is performed?
>

I think that S-bit should not be set if a single EAP run is performed
during the re-authentication.
The issue is how the PAA informs the PaC whether an ISP or a NAP
re-authentication must be performed. Can we use the N-flag for that?

> - Which exchange should be used for carrying authenticaiton 
> result for the EAP re-authentication with a single EAP run, 
> PBR-PBA or PFER-PFEA?

I think PBR-PBA should be used.
Note that, for example after an ISP re-authentication, the PANA_MAC_Key
should be re-derived using the new ISP-AAA-key and the old NAP-AAA-Key.

> 
> - What happens if the EAP re-authentication with a single EAP 
> run (for NAP authentication for example) fails?  Should the 
> PANA session be deleted, or remain because authorization for 
> ISP part still exists? In the latter case, are the subsequent 
> EAP-reauthentications always performed with a single EAP run 
> for ISP authentication?  And also in the latter case is the 
> PANA_MAC_KEY needs to be updated after the single EAP run 
> failure in the EAP re-authentication?  If so, how?
> 

I think this is the main issue. Maybe if one re-authentication fails,
the PANA session should be deleted. This case should be treated as the
bootstrap case when double authentication is performed and ISP or NAP
authentication fails.

> > However there might be cases in which it is
> > convenient to perform both the authentications together (e.g. the 
> > difference between the residual lifetimes is very small).
> 
> > 
> > [2] What about a scenario in which a new ISP is available? Consider 
> > that at the first occurence of PANA there were only two 
> ISPs available 
> > (ISP1 and ISP2). If a new ISP (ISP3) becomes available 
> (e.g. after a 
> > movement of the PaC), I think this must be communicated to the PaC. 
> > How can we handle this?
> 
> After a movement of a PaC, the new ISP information can be 
> contained in PSR sent from the new PAA.  However, if the PaC 
> returns a PSA with ISP3 information in a ISP-Information AVP, 
> the PAA should not perform mobility optimization.
> 

Agree.

> In the case where a new ISP becomes available while the PaC 
> is connecting to the same PAA, I don't think the PaC has to 
> know the new ISP immediately.
> 

Agree. 
Note that this implies that if the PaC performs only re-authentication
procedures, it will never know if a new ISP is available. Do you think
this is an issue?

-Gerardo

> Yoshihiro Ohba
> 
> 
> 
> 
> > 
> > 
> > --Gerardo
> > 
> >  
> > > Yoshihiro Ohba
> > > 
> > > 
> > > On Mon, Jul 12, 2004 at 05:42:11PM +0200, Giaretta Gerardo wrote:
> > > > Hi Yoshi,
> > > > 
> > > > > > > I am not sure how EAP-based re-authentication can
> > > work after the
> > > > > > > PaC has successfully established a new PANA session with 
> > > > > > > nPAA
> > > > > > > based on the mobility optimization operation, 
> > > especially with NAP
> > > > > > > and ISP separated authentications.  Since PSR-PSA 
> exchange 
> > > > > > > is
> > > > > > > omitted in the case of EAP-based re-authentication, 
> > > there is no
> > > > > > > means to negotiate on NAP and ISP separate
> > > authentications between
> > > > 
> > > > > > > the PaC and nPAA.  Do you have any thoughts on this?
> > > > > > > 
> > > > > > 
> > > > > > I'm not sure I understand your point: is this a general
> > > > > PANA issue or
> > > > > > is it related to the operations described in
> > > > > > draft-bournelle-pana-ctp-00.txt?
> > > > > 
> > > > > It might be related to both.  I think that if NAP and ISP
> > > separate
> > > > > authentications were made in the initial authentication, then 
> > > > > the
> > > > > same NAP and ISP separate authentications should also 
> be made in 
> > > > > EAP-based re-authentication (this is a PANA issue, i.e., 
> > > this should
> > > > > be described in the PANA specification.)  If the same thing 
> > > > > needs to be done in EAP-based re-authentication after handoff 
> > > > > (though I am not sure the same thing needs to be done in this 
> > > > > case), information on whether NAP and ISP separate 
> > > > > authentications were made in the previous network may 
> need to be 
> > > > > included in PANA-CTD (this is an issue of 
> > > > > draft-bournelle-pana-ctp-00.txt).
> > > > >
> > > > 
> > > > I agree with you. The result of the usage of CTP, as the
> > > result of any
> > > > fast authentication mechanism, must be the same as the one 
> > > > obtained
> > > > performing the whole authentication procedure. This implies 
> > > that nPAA
> > > > should know if PaC performed double authentication and 
> which ISP 
> > > > it
> > > > chose. Therefore this information must be transferred in 
> > > CTD message.
> > > > 
> > > > However, I think that EAP re-authentication is not related
> > > to mobility
> > > > handling. The usage of CTP allows to transfer the PANA
> > > context to the
> > > > nPAA. After the PBR/PBA exchange the PaC is authenticated
> > > and the nPAA
> > > > knows the residual authorization lifetime. Therefore
> > > > EAP-reauthentication is not performed immediately after 
> the handoff 
> > > > and it is accomplished as specified in PANA specs.
> > > > 
> > > > Note that we have not defined yet how to inform both NAP
> > > and ISP AAA
> > > > system of the new PaC's location. I think this is also an 
> > > > important
> > > > issue.
> > > > 
> > > > 
> > > > --Gerardo
> > > > 
> > > > 
> > > >  
> > > > > Yoshihiro Ohba
> > > > > 
> > > > 
> > > > 
> > > > 
> > > > 
> > > > Gruppo Telecom Italia - Direzione e coordinamento di Telecom 
> > > > Italia
> > > > S.p.A.
> > > > 
> > > > 
> ==================================================================
> > > > ==
> > > > CONFIDENTIALITY NOTICE
> > > > This message and its attachments are addressed solely to 
> > > the persons
> > > > above and may contain confidential information. If you have
> > > received
> > > > the message in error, be informed that any use of the
> > > content hereof
> > > > is prohibited. Please return it immediately to the sender
> > > and delete
> > > > the message. Should you have any questions, please send an
> > > e_mail to
> > > > [email-masked]. Thank you
> > > > 
> ====================================================================
> > > 
> > 
> > 
> > Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia 
> > S.p.A.
> > 
> > ====================================================================
> > CONFIDENTIALITY NOTICE
> > This message and its attachments are addressed solely to 
> the persons 
> > above and may contain confidential information. If you have 
> received 
> > the message in error, be informed that any use of the 
> content hereof 
> > is prohibited. Please return it immediately to the sender 
> and delete 
> > the message. Should you have any questions, please send an 
> e_mail to 
> > [email-masked]. Thank you 
> > ====================================================================
> 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to
[email-masked]. Thank you
====================================================================

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 15 Jul 2004 09:23:15 -0400

Hi Gerardo,

> bootstrap case when double authentication is performed and ISP or NAP

If you delete the PANA session just because the re-authentication for
NAP fails, this would be a problem for the other (ISP) authorization
state.  

> procedures, it will never know if a new ISP is available. Do you think

I don't think that is an issue because it is a rare case.

Yoshihiro Ohba