Subject: [Pana] pana-pana Issue229: Comments on Device-ID choice

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 27 Dec 2005 12:01:31 -0500

>5.7  Device ID Choice
>
>   The device identifier used in the context of PANA can be an IP
>   address, a MAC address, 
>
Here is the "MAC" conflict I referred to earlier. You could fix this by 
renaming the MAC AVP, or calling this a "layer 2 address" as you do 
earlier in the doc. I think renaming the MAC AVP makes more sense, but 
do as you like.

>or an identifier that is not carried in data
>   packets but has local significance in identifying a connected device
>   (e.g., circuit id, PPP interface id).  The last type of identifiers
>   are commonly used in point-to-point links where MAC addresses are
not
>   available and lower-layers are already physically or
>   cryptographically secured.
>  
>
PPPoE and L2TP use an identifier for a PPP session that is carried in 
the header itself, and have nothing to do with physical or cryptographic

security.

>   It is assumed that the PAA knows the link type and the security
>   mechanisms being provided or required on the access network (e.g.,
>   based on physical security, link-layer ciphers enabled before or
>   after PANA, or IPsec).
>
This may be a bold assumption for IPsec.

>  Based on that information, the PAA can decide
>   what type of EP device id will be usedused when running PANA with
the
>   client.
s/usedused/used

Does the PAA decide, or does an administrator configuring PANA decide? I

think you are starting to see some of the suffering of supporting too 
many options here.

>   When IPsec-based security [I-D.ietf-pana-ipsec] is the choice of
>   access control, the PAA SHOULD provide IP address(es) as EP(s)'
>   device ID, and expect the PaC to provide its IP address in return.
>   Similarly, IP addresses are used when the EP(s) is not on the same
IP
>   subnet as the PaC is.
If IP addresses are not used for IPsec, what is? Point here is whether 
this is a SHOULD or a MUST.

>   In other cases, MAC addresses are used as device identifiers when
>   they are available.
>  
>   If non-IPsec access control is enabled, and a MAC address is not
>   available, locally-significant identifiers (e.g., as a circuit id)
>   MUST be used as device id.  Note that these identifiers are not
>   exchanged within PANA messages.  Instead, peers rely on lower-layers
>   to provide them along with received PANA messages.
>  
>
This is another linkage of PANA with a layer below IP, invalidating the 
claim in the introduction that PANA can work with any link-layer, and 
that PANA/IP isolates EAP from all link-layer specifics.

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana