Subject: [Pana] do we need DI for PAA?

From: Alper Yegin <[email-masked]>
Date: Thu, 19 Aug 2004 13:43:48 -0700

While looking at issue 104, I started to think maybe we don't need to
deal with PAA DI in the specification.

We need DI for PaC for controlling authorized traffic.
We need DI for EP(s) conveyed to PaC for secure association process.

DI of PAA seems to be in the picture for two things:
- identifying the PAA. I think for that we can directly use IP address
of PAA. [note: DI may be IP address or MAC address]. IP address of PAA
and DI of PaC can be exchanged during the PBR/PBA to detect MitM. 
- implicitly signaling the type of DI to PaC. I think we can do that by
including the DI of EP(s).

How about:
- Including the IP address of PAA in an IP-Address AVP, and one or more
Device-ID AVPs for EP(s) in PBR
- Including Device-ID AVP for PaC in PBA
- Deprecating EP-Device-ID AVP, using Device-ID AVP instead.

So that we confine the usage of DIs for PaC and EP, and keep the PAA out
of this.

Comments?

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Sun, 19 Sep 2004 19:19:11 -0400

Hi Alper,

The proposal makes sense to me.

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Mon, 23 Aug 2004 13:16:05 -0700

Comments welcome.

[1] Section 2:

Change:

 PANA Session:

      A PANA session begins with the initial handshake between the PANA
      Client (PaC) and the PANA Authentication Agent (PAA), and
      terminates by an authentication failure, a timeout, or an explicit
      termination message.  A fixed session identifier is maintained
      throughout a session.  A session cannot be shared across multiple
      physical network interfaces.  A distinct PANA session is
      associated with the device identifiers of PaC and PAA.

To:

 PANA Session:

      A PANA session begins with the initial handshake between the PANA
      Client (PaC) and the PANA Authentication Agent (PAA), and
      terminates by an authentication failure, a timeout, or an explicit
      termination message.  A fixed session identifier is maintained
      throughout a session.  A session cannot be shared across multiple
      physical network interfaces. 

Change:

   Device Identifier (DI):

      The identifier used by the network as a handle to control and
      police the network access of a client.  Depending on the access
      technology, this identifier might contain any of IP address,
      link-layer address, switch port number, etc.  of a connected
      device.

To:

   Device Identifier (DI):

      The identifier used by the network as a handle to control and
      police the network access of a client.  Depending on the access
      technology, this identifier may contain an address that is
      carried in protocol headers (e.g., IP or link-layer address),
      or a locally significant identifier that is made available
      by the local protocol stack (e.g., circuit id, PPP interface id) 
      of a connected device.

[2] Section 3.1:

Change:

         <-----     PANA-Bind-Request[Session-Id, EAP{Success},
                         Device-Id, Lifetime, Protection-Cap., Key-Id,
MAC]

To:

         <-----     PANA-Bind-Request[Session-Id, EAP{Success},
                         Device-Id, IP-Address, Lifetime,
Protection-Cap.,
                         Key-Id, MAC]

[3] Section 4.1.1:

Change:

   o  Device-Id AVP: contains a device identifier of the sender of the
      message.  A device identifier is represented as a pair of device
      identifier type and device identifier value.  Either a layer-2
      address or an IP address is used for the device identifier value.

To:

   o  Device-Id AVP: contains a device identifier of the PaC or an EP.
      A device identifier is represented as a pair of device
      identifier type and device identifier value.  Either a layer-2
      address or an IP address is used for the device identifier value
      when this AVP is present.

Remove:

   o  EP-Device-Id AVP: contains the device identifier of an EP.

[4] Section 4.1.5:

Change:

      *  Device-Id of PaC

      *  Device-Id of PAA

      *  IP address of PaC (may be the same as the Device-Id of PaC)

      *  IP address of PAA (may be the same as the Device-Id of PAA)

      *  List of device identifiers of EPs

To:

      *  Device-Id of PaC

      *  IP address of PaC (may be the same as the Device-Id of PaC)

      *  IP address of PAA

      *  List of device identifiers of EPs

[5] Section 4.1.7:

Change:

   o  When a device identifier of the communication peer is bound to the
      PANA session, it matches the device identifier carried in MAC and/
      or IP header(s), or other auxiliary indetifier provided by the
      lower-layers (e.g., circuit ID).

To:

   o  When a device identifier of the PaC is bound to the
      PANA session, it matches the device identifier carried in MAC or
      or IP header, or other locally-significant identifier provided by 
      the lower-layers (e.g., circuit ID) unless the message is 
      a PANA-Update-Request with IP-Address AVP.

Change:

   o  When a Device-Id AVP is included, the AVP is valid if the device
      identifier type contained in the AVP is supported (this check is
      for both PaC and PAA) and is the requested one (this check is for
      PAA only) and the device identifier value contained in the AVP
      matches the value extracted from the lower-layer encapsulation
      header corresponding to the device identifier type contained in
      the AVP.  Note that a Device-Id AVP carries the PaC's device
      identifier in messages from PaC to PAA and PAA's device identifier
      in messages from PAA to PaC.

To:

   o  When a Device-Id AVP is included, the AVP is valid if the device
      identifier type contained in the AVP is supported (this check is
      for both PaC and PAA) and is the requested one (this check is for
      PAA only) and the device identifier value contained in the AVP
      matches the value extracted from the lower-layer encapsulation
      header corresponding to the device identifier type contained in
      the AVP (this check is for PaC only).  Note that a Device-Id AVP
      carries the PaC's device identifier in messages from PaC to PAA  
      and EP(s)' device identifier in messages from PAA to PaC.

Add:

   o  When the IP-Address AVP is received in a message from the PAA,
      the AVP is valid if the IP address matches the source address
      in the IP header.

[6] Section 4.3:

Change:

        <-----     PANA-Bind-Request(x+3,y+2)
                       [Session-Id, EAP{Success}, Device-Id, Lifetime,
                        Protection-Cap., PPAC, MAC]

To:

        <-----     PANA-Bind-Request(x+3,y+2)
                       [Session-Id, EAP{Success}, Device-Id, IP-Address,
                        Lifetime, Protection-Cap., PPAC, MAC]

Change:

   The PANA-Bind-Request and the PANA-Bind-Answer message exchange is
   also used for binding device identifiers of the PaC and the PAA to
   the PANA SA when the identifiers are either IP or MAC addresses.  To
   achieve this, the PANA-Bind-Request and the PANA-Bind-Answer SHOULD
   contain a device identifier of the PAA and the PaC, respectively, in
   a Device-Id AVP.  Device identifier exchange that is protected by a
   MAC AVP prevents man-in-the-middle attacks.  The PaC MUST use the
   same type of device identifier as contained in the PANA-Bind-Request
   message.  

To:

   The PANA-Bind-Request and the PANA-Bind-Answer message exchange is
   also used for binding device identifiers of the PaC and EP(s), and 
   the IP address of the PAA to the PANA SA. To achieve this, 
   the PANA-Bind-Request SHOULD contain the device indentifier(s) of
   the EP(s) in Device-Id AVP(s) when they are either MAC or IP 
   address(es), and the IP address of the PAA in an IP-Address AVP. 
   PANA-Bind-Answer SHOULD contain PaC's device identifier in a 
   Device-Id AVP when it is already presented with that of EP(s). 
   The PaC MUST use the same type of device identifier as contained in 
   the PANA-Bind-Request message. This exchange when protected by a MAC 
   AVP prevents man-in-the-middle attacks. 

[7] Section 4.4:

Change:

         <-----     PANA-Bind-Request(p+2,q+2)
                       [Session-Id, EAP{Success}, Device-Id, Key-Id,
                        Lifetime, Protection-Cap., PPAC, MAC]

To:

         <-----     PANA-Bind-Request(p+2,q+2)
                       [Session-Id, EAP{Success}, Device-Id, IP-Address,
                        Key-Id, Lifetime, Protection-Cap., PPAC, MAC] 

[8] Section 4.6:

Change:

         <-----     PANA-Bind-Request(x+5,y+6)          // S-flag set
                      [EAP{Success}, Device-Id, Key-Id,
                       Lifetime, Protection-Cap., PPAC, MAC]

To:

         <-----     PANA-Bind-Request(x+5,y+6)          // S-flag set
                      [EAP{Success}, Device-Id, IP-Address, Key-Id,
                       Lifetime, Protection-Cap., PPAC, MAC]

[8] New text for Section 4.8:

4.8  Device ID Choice

   The device identifier used in the context of PANA can be an IP
   address, a MAC address, or an identifier that is not carried in data
   packets but has local significance in identifying a connected host
   (e.g., circuit id, PPP interface id).  The last type of identifiers 
   are commonly used in point-to-point links where MAC addresses are
   not available and lower-layers are already physically or
   cryptographically secured.

   It is assumed that the PAA knows the link type and the security
   mechanisms being provided or required on the access network (e.g.,
   based on physical security, link-layer ciphers enabled before or
   after PANA, or IPsec).  Based on that information, the PAA can decide
   what type of EP device id will be used when running PANA with the
   client.  When IPsec-based security [I-D.ietf-pana-ipsec] is the
   choice of access control, the PAA SHOULD provide IP address(es) 
   as EP(s)' device ID, and expect the PaC to provide its IP address 
   in return. In case IPsec is not used, MAC addresses are used as 
   device IDs when available.  If non-IPsec access control is enabled, 
   and a MAC address is not available, device ID exchange does not 
   occur within PANA. Instead, peers rely on lower-layers to provide
   locally-significant identifiers along with received PANA packets.

[9] Remove Section 4.13:

I think now the information in section 4.3 is already covered elsewhere,
so 
we can remove the section.

[10] Section 6.4.7:

Change:

6.4.7  PANA-Bind-Request (PBR)

   PANA-Bind-Request (PBR) is sent by the PAA to the PaC.

         PANA-Bind-Request ::= < PANA-Header: 4, REQ [SEP] [NAP] >
                       < Session-Id >
                       { Result-Code }
                       { PPAC }
                       [ EAP-Payload ]
                       [ Device-Id ]
                       [ Session-Lifetime ]
                       [ Protection-Capability ]
                       [ Key-Id ]
                    *  [ EP-Device-Id ]
                    *  [ AVP ]
                   0*1 < MAC >

To:

6.4.7  PANA-Bind-Request (PBR)

   PANA-Bind-Request (PBR) is sent by the PAA to the PaC.

         PANA-Bind-Request ::= < PANA-Header: 4, REQ [SEP] [NAP] >
                       < Session-Id >
                       { Result-Code }
                       { PPAC }
                       { IP-Address }
                       [ EAP-Payload ]
                       [ Device-Id ]
                       [ Session-Lifetime ]
                       [ Protection-Capability ]
                       [ Key-Id ]
                    *  [ Device-Id ]
                    *  [ AVP ]
                   0*1 < MAC >

[11] Remove "<Device-Id>" from PFER and PFEA in sections 6.4.14 and
6.4.15 

respectively.

[12] Remove Section "6.5.15  EP-Device-Id AVP".

[13] New text for Section 6.5.19:

6.5.19  IP-Address AVP

   The IP-Address (AVP Code: 1042) contains an IP address of a PaC or
PAA.
   The payload format of the IP-Address AVP is the same as that of the
   Device-Id AVP (see See section Section 6.5.2).  Address families for
   IPv4 or IPv6 MUST be used for this AVP.

[14] Occurence tables in Section 6.6:

                          +-----------------------------------------+
                          |        Message                          |
                          |          Type                           |
                          +-----+-----+-----+-----+-----+-----+-----+
      Attribute Name      | PSR | PSA | PAR | PAN | PBR | PBA | PDI |
      --------------------+-----+-----+-----+-----+-----+-----+-----+
      Result-Code         |  0  |  0  |  0  |  0  |  1  |  1  |  0  |
      Session-Id          |  0  | 0-1 |  1  |  1  |  1  |  1  | 0-1 |
      Termination-Cause   |  0  |  0  |  0  |  0  |  0  |  0  |  0  |
      EAP-Payload         | 0-1 | 0-1 |  1  |  1  | 0-1 |  0  |  0  |
      MAC                 |  0  | 0-1 | 0-1 | 0-1 | 0-1 | 0-1 |  0  |
      Nonce               |  1  |  1  |  0  |  0  |  0  |  0  |  0  |
      Device-Id           |  0  |  0  |  0  |  0  |  0+ | 0-1 |  0  |
      Cookie              | 0-1 | 0-1 |  0  |  0  |  0  |  0  |  0  |
      Protection-Cap.     | 0-1 |  0  |  0  |  0  | 0-1 |  0  |  0  |
      PPAC                | 0-1 |  0  |  0  |  0  |  1  | 0-1 |  0  |
      Session-Lifetime    |  0  |  0  |  0  |  0  | 0-1 |  0  |  0  |
      Failed-AVP          |  0  |  0  |  0  |  0  |  0  |  0  |  0  |
      ISP-Information     |  0+ | 0-1 |  0  |  0  |  0  |  0  |  0  |
      NAP-Information     | 0-1 |  0  |  0  |  0  |  0  |  0  |  0  |
      Key-Id              |  0  |  0  |  0  |  0  | 0-1 | 0-1 |  0  |
      IP-Address          |  0  |  0  |  0  |  0  |  1  |  0  |  0  |
      --------------------+-----+-----+-----+-----+-----+-----+-----+

                 Figure 12: AVP Occurrence Table (1/3)

+---------------------------------------------+
                          |      Message
|
                          |       Type
|
 
+------+------+-----+-----+-----+------+------+
      Attribute Name      | PRAR | PRAA | PTR | PTA | PER | PFER | PFEA
|
 
--------------------+------+------+-----+-----+-----+------+------+
      Result-Code         |  0   |  0   |  0  |  0  |  1  |  1   |  0
|
      Session-Id          |  1   |  1   |  1  |  1  |  1  |  1   |  1
|
      Termination-Cause   |  0   |  0   |  1  |  0  |  0  |  0   |  0
|
      EAP-Payload         |  0   |  0   |  0  |  0  |  0  |  1   |  0
|
      MAC                 | 0-1  | 0-1  | 0-1 | 0-1 | 0-1 | 0-1  | 0-1
|
      Nonce               |  0   |  0   |  0  |  0  |  0  |  0   |  0
|
      Device-Id           |  0   |  0   |  0  |  0  |  0  |  0   |  0
|
      Cookie              |  0   |  0   |  0  |  0  |  0  |  0   |  0
|
      Protection-Cap.     |  0   |  0   |  0  |  0  |  0  |  0   |  0
|
      PPAC                |  0   |  0   |  0  |  0  |  0  |  0   |  0
|
      Session-Lifetime    |  0   |  0   |  0  |  0  |  0  |  0   |  0
|
      Failed-AVP          |  0   |  0   |  0  |  0  |  1  |  0   |  0
|
      ISP-Information     |  0   |  0   |  0  |  0  |  0  |  0   |  0
|
      NAP-Information     |  0   |  0   |  0  |  0  |  0  |  0   |  0
|
      Key-Id              |  0   |  0   |  0  |  0  |  0  | 0-1  | 0-1
|
      IP-Address          |  0   |  0   |  0  |  0  |  0  |  0   |  0
|
 
--------------------+------+------+-----+-----+-----+------+------+

                 Figure 13: AVP Occurrence Table (2/3)

                          +-----------+
                          |  Message  |
                          |   Type    |
                          +-----+-----+
      Attribute Name      | PUR | PUA |
      --------------------+-----+-----+
      Result-Code         |  0  |  0  |
      Session-Id          |  1  |  1  |
      Termination-Cause   |  0  |  0  |
      EAP-Payload         |  0  |  0  |
      MAC                 | 0-1 | 0-1 |
      Nonce               |  0  |  0  |
      Device-Id           |  0  |  0  |
      Cookie              |  0  |  0  |
      Protection-Cap.     |  0  |  0  |
      PPAC                |  0  |  0  |
      Session-Lifetime    |  0  |  0  |
      Failed-AVP          |  0  |  0  |
      ISP-Information     |  0  |  0  |
      NAP-Information     |  0  |  0  |
      Key-Id              |  0  |  0  |
      IP-Address          |  1  |  0  |
      --------------------+-----+-----+

                 Figure 14: AVP Occurrence Table (3/3)

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 30 Aug 2004 22:08:25 -0400

I have several comments.  Please see below.

>       physical network interfaces. 

I guess the last sentence applies to logical network interfaces as
well.

...

>       the AVP (this check is for PaC only).  Note that a Device-Id AVP

Do you mean "(this check is for PAA only)"?  [I mean this check is for
PAA to validate PaC's device identifier.]

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Tue, 31 Aug 2004 16:57:54 -0700

Comments welcome.

[1] Section 2:

Change:

 PANA Session:

To:

 PANA Session:

      network interfaces. 

Change:

   Device Identifier (DI):

To:

   Device Identifier (DI):

[2] Section 3.1:

Change:

To:

[3] Section 4.1.1:

Change:

To:

Remove:

[4] Section 4.1.5:

Change:

      *  Device-Id of PaC

      *  Device-Id of PAA

To:

      *  Device-Id of PaC

      *  IP address of PAA

[5] Section 4.1.7:

Change:

To:

Change:

To:

   o  When a Device-Id AVP is included, the AVP is valid if the device
      identifier type contained in the AVP is supported (check performed
      by both PaC and PAA) and is the requested one (check performed by
      PAA only) and the device identifier value contained in the AVP
      matches the value extracted from the lower-layer encapsulation
      header corresponding to the device identifier type contained in
      the AVP (check performed by PAA only).  Note that a Device-Id AVP
      carries the PaC's device identifier in messages from PaC to PAA  
      and EP(s)' device identifier in messages from PAA to PaC.

Add:

[6] Section 4.3:

Change:

To:

Change:

To:

[7] Section 4.4:

Change:

To:

[8] Section 4.6:

Change:

To:

4.8  Device ID Choice

[9] Remove Section 4.13:

[10] Section 6.4.7:

Change:

To:

respectively.

6.5.19  IP-Address AVP

 

                          +-----------+
                          |  Message  |
                          |   Type    |
                          +-----+-----+