Subject: RE: [Pana] Mobility Handling in PANA

From: Giaretta Gerardo <[email-masked]>
Date: Mon, 12 Jul 2004 17:42:11 +0200

Hi Yoshi,

> > > I am not sure how EAP-based re-authentication can work after the 
> > > PaC has successfully established a new PANA session with nPAA 
> > > based on the mobility optimization operation, especially with NAP 
> > > and ISP separated authentications.  Since PSR-PSA exchange is 
> > > omitted in the case of EAP-based re-authentication, there is no 
> > > means to negotiate on NAP and ISP separate authentications between

> > > the PaC and nPAA.  Do you have any thoughts on this?
> > > 
> > 
> > I'm not sure I understand your point: is this a general
> PANA issue or
> > is it related to the operations described in
> > draft-bournelle-pana-ctp-00.txt?
> 
> It might be related to both.  I think that if NAP and ISP
> separate authentications were made in the initial 
> authentication, then the same NAP and ISP separate 
> authentications should also be made in EAP-based 
> re-authentication (this is a PANA issue, i.e., this should be 
> described in the PANA specification.)  If the same thing 
> needs to be done in EAP-based re-authentication after handoff 
> (though I am not sure the same thing needs to be done in this 
> case), information on whether NAP and ISP separate 
> authentications were made in the previous network may need to 
> be included in PANA-CTD (this is an issue of 
> draft-bournelle-pana-ctp-00.txt).
>

I agree with you. The result of the usage of CTP, as the result of any
fast authentication mechanism, must be the same as the one obtained
performing the whole authentication procedure. This implies that nPAA
should know if PaC performed double authentication and which ISP it
chose. Therefore this information must be transferred in CTD message. 

However, I think that EAP re-authentication is not related to mobility
handling. The usage of CTP allows to transfer the PANA context to the
nPAA. After the PBR/PBA exchange the PaC is authenticated and the nPAA
knows the residual authorization lifetime. Therefore
EAP-reauthentication is not performed immediately after the handoff and
it is accomplished as specified in PANA specs.

Note that we have not defined yet how to inform both NAP and ISP AAA
system of the new PaC's location. I think this is also an important
issue.

--Gerardo

> Yoshihiro Ohba

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to 
[email-masked]. Thank you
====================================================================

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 12 Jul 2004 21:47:44 -0400

Based on the discussion below.  I would suggest adding the following
sentences to section 4.4 of PANA speficication:

" 
When NAP and ISP separate authetnications were performed in the first
occurence of PANA authentication phase, the same NAP and ISP separate
authentications MUST also be performed in subsequent EAP-based
re-authentication occurances.  Otherwise, NAP and ISP separate
authentications MUST NOT be performed in subsequent EAP-based
re-authentication occurances.
"

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Tue, 13 Jul 2004 14:18:10 -0700

> re-authentication occurances.

Can this be generalized to saying the NAP/ISP selection cannot change in
a PANA session? I'm trying to understand what happens (breaks?) if the
PaC changes its selection...

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 14 Jul 2004 15:53:12 -0400

> PaC changes its selection...

In the current specification, the PaC is not allowed to change its
selection because PSR-PSA exchange is not performed in EAP-based
re-authentication.  So I think your question is what happens if we
modify the specification to allow PSR-PSA exchange to change the
selection in EAP-based re-authentication.  I think that works, but
probably the PSR-PSA exchange should be integrity protected with a MAC
AVP if a PANA SA exists in order to avoid false re-authentication
trigger DoS attack.  But adding a MAC AVP in PSA might conflict with
the current PANA mobility optimization solution.

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Wed, 14 Jul 2004 13:49:55 -0700

OK, I'm fine with locking a PANA session to fixed NAP/ISP. If the PaC
wants to hop around, it better terminate the current session and start a
new one.

Maybe we could briefly capture this by saying:

Any subsequent EAP-based authentication MUST be performed with the
same ISP and NAP that was selected during the initial authentication. 

Alper

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:[email-masked]]
> Sent: Wednesday, July 14, 2004 12:53 PM
> To: Alper Yegin
> Cc: 'Yoshihiro Ohba'; [email-masked]; 'Giaretta Gerardo'; 'Julien
> Bournelle'
> Subject: Re: [Pana] EAP-based reauth clarification [Re: Mobility
Handling
> in PANA]
> > > > > > > I am not sure how EAP-based re-authentication can work
after
> > the
> > > > > > > based on the mobility optimization operation, especially
with
> > NAP
> > > > > > > omitted in the case of EAP-based re-authentication, there
is
> > no
> > > > I agree with you. The result of the usage of CTP, as the result
of
> > any
> > > > handling. The usage of CTP allows to transfer the PANA context
to
> > the
> > > > nPAA. After the PBR/PBA exchange the PaC is authenticated and
the
> > nPAA
> > > > EAP-reauthentication is not performed immediately after the
handoff
> > and
> > > > Gruppo Telecom Italia - Direzione e coordinamento di Telecom
Italia
> > > S.p.A.

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 15 Jul 2004 18:54:07 -0400

> same ISP and NAP that was selected during the initial authentication. 

This works for me.

Yoshihiro Ohba