Subject: [Pana] Pre-authentication support for PANA

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 08 Jul 2005 16:43:29 -0400

Today I submitted the following draft:

http://www.panasec.org/docs/draft-ohba-pana-preauth-00.txt

Your comments are appreciated.

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Julien Bournelle <[email-masked]>
Date: Wed, 13 Jul 2005 17:08:37 +0200

Hi yoshi,

 First of all, I'd like to say that it's an interesting idea.

 However, I'm wondering if there isn't a conflict with your other
 proposal to bind the AAA-Key to Lower Layer Parameters
 (draft-ohba-eap-aaakey-binding-01). 

 Do I miss something ?

 The other comment that I have is that I'm wondering if the AAA server won't
 find strange to authenticate 2 times the same client but from 2 PAAs.

 regards,

 Julien

-- 
julien.bournelle at int-evry.fr

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 13 Jul 2005 11:31:00 -0400

Hi Julien,

>  First of all, I'd like to say that it's an interesting idea.

Thank you for your interest and comments.
>  (draft-ohba-eap-aaakey-binding-01). 

Although I did not describe PANA specific lower-layer parameters in
aaakey-binding draft, at least following parameters may need to be
contained in the key-binding-blob if the AAA-Key is computed in the
way as specified in aaakey-binding draft:

- PAA's DiameterIdentity contained in the PANA Session-Id AVP.

- NAP-Information AVP or ISP-Information AVP

- Protection-Capablity AVP

- PPAC AVP 

- Device-Id AVPs of EPs

These information associated with a PANA session between a PaC and a
remote PAA is not likely to change after the PAA becomes an active PAA
for the PaC.  So I think there is no problem.

>  find strange to authenticate 2 times the same client but from 2 PAAs.

I think the AAA server can have multiple AAA sessions from different
NASes regarding the same client.  Anyways, I will check how RADIUS
works with IEEE 802.11i pre-authentication.

Thank you,
Yoshihiro Ohba

---

From: Julien Bournelle <[email-masked]>
Date: Mon, 18 Jul 2005 12:54:43 +0200

Hi yoshi,

> for the PaC.  So I think there is no problem.

 ok I thought that PaC's Device-Id may be used to compute the blob.

> works with IEEE 802.11i pre-authentication.

 ok,

 thanks for your answers.

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 26 Jul 2005 19:54:03 -0400

Hi Julien,

> > works with IEEE 802.11i pre-authentication.

I had a conversation with Bernard Aboba on RADIUS behavior in the case
of IEEE 802.11i pre-authentication.  

The AAA server can tell whether a particular RADIUS EAP authentication
run belongs to initial authentication or pre-authentication based on
whether Called-Station-Id attribute carries SSID of AP or not.

In the case of PANA pre-authentication, we don't have SSID.  So, a new
AAA attribute might need to be defined to distinguish
pre-authentication from initial authentication.

Regards,
Yoshihiro Ohba

---

From: Julien Bournelle <[email-masked]>
Date: Wed, 27 Jul 2005 13:41:45 +0200

Hi yoshi,

> whether Called-Station-Id attribute carries SSID of AP or not.

 It could be interesting to have more details on how it works with
 802.11i.

> pre-authentication from initial authentication.

 maybe a flag could be sufficient.

 BTW, I was also wondering what happen if the pPAA and nPAA are
 connected to different AAA servers. I'm still assuming here that we are
 in the intra-domain scenario.

 regards,

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 27 Jul 2005 07:51:59 -0400

>  It could be interesting to have more details on how it works with

I'd suggest asking RADEXT WG for further details on 802.11i
pre-authentication.

>  maybe a flag could be sufficient.

I think so, too.

>  in the intra-domain scenario.

Although I don't fully understand why pPAA and nPAA need to
communicate with different AAA servers in the intra-domain scenario,
the AAA server contacted by nPAA may allow running EAP for
pre-authentication even if it did not run EAP for initial
authentication with the client.

Regards,
Yoshihiro Ohba