Subject: [Pana] Resolution to Issue 161

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 20 Apr 2005 16:07:34 -0700

Issue 161 refers to changes required in Pana-ipsec draft for mhop changes.

Change section 5 first line FROM:

   If the network chooses IPsec to secure the link between the PaC and  
   EP, the PAA should communicate the IKE pre-shared key (Pac-EP Master  
   Key), Key-Id, PRPA of the PaC, and the session-Id to the EP before  
   the IKE exchange begins.

TO:

   If the network chooses IPsec to secure the link between the PaC and  
   EP, the PAA should communicate the IKE pre-shared key (Pac-EP Master  
   Key), Key-Id, the device identifer of the PaC, and the session-Id to the EP before  
   the IKE exchange begins. 

Comments ?

-mohan

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 22 Apr 2005 18:39:58 -0400

Hi Mohan,

>    Key), Key-Id, the device identifer of the PaC, and the session-Id to the EP before  

In IPv6 mhop case, the PaC would need to use a non-link-local address
as PRPA (and the device identifier) to communicate with the PAA.  As a
result, the PaC's device identifer installed to the EP will be the
non-local address.  On the other hand, a link-local address is used as
IPsec-TOA for IPv6 according to pana-framework and pana-ipsec drafts.

I mean:

IPsec-TOA (link-local) != DI (== non-link-local PRPA), for IPv6 mhop PANA.

Do you see an issue here?  Should the PaC use non-link-local PRPA as
IPsec-TOA?

Yoshihiro Ohba

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 25 Apr 2005 18:12:33 -0700

I don't assume NAT in the ipv6 case :-) 

-mohan

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 25 Apr 2005 19:17:04 -0400

Mohan,

Actually I am not talking about NAT case.  I am talking about the case
where a non-link-local PRPA is used by the PaC to communicate with an
off-link PAA.  My basic question is: which address should the PaC be
used as IPsec-TOA in this case for IPsec SA between the PaC and the EP
which is on-link, the (non-link-local) PRPA or a link-local address?

Yoshihiro Ohba