Subject: [Pana] Correction to pana-fwk section 10.2.3

From: Rafa Marin Lopez <[email-masked]>
Date: Fri, 30 Dec 2005 10:12:06 -0500

In section 10.2.3 three types of network are explained

"
a) Free access network

     There is no IEEE 802.1X or PANA authentication in this access
     network.

b) PANA-secured network

     There is PANA authentication in this access network.

c) IEEE 802.1X-secured network

     There is IEEE 802.1X authentication in this access network.
"
Considering that classification,  it is said also in this section:

"Types (a) and (b) are not distinguishable until the PaC associates with 
the AP ".

However this is not true becuase PaC can distinguish between type a) and 
type b) basically
becuase type a) network does NOT announce RSN IE in beacon frame/probe 
response and type b) DOES (PSK mode).

Actually PaC cannot distinguish between networks where PANA is used to 
bootstrap PSK  and network where PSK is required
but it is statically configured. In both cases RSN IE announces PSK mode 
in RSN IE.

Another thing that could not be clear in the classification is the 
meaning of IEEE 802.1X-secured network. Are we assuming here both IEEE 
802.1X authentication with EAP or PSK should be also included here?. My 
understanding of type c) network is EAP authentication is used but no 
PSK mode is considered.

But in any case, even if PSK mode is also included  in type c)

c) IEEE 802.1X-secured networks
      c1) PSK authentication
      c2) EAP authentication

then i would say PaC cannot distinguish between type b) networks and 
type c1) networks and not between type a) and type b) . If PSK 
authentication is not included in type c) networks then classification 
is incomplete , we should add networks that requires a PSK and no PANA 
authentication is possible.

Thus I think the section 10.2.3 could be rewritten more clearly in this 
way:

"
10.2.3  Capability Discovery

  When a PaC is a mobile, there may be multiple APs available in its
  vicinity.  Each AP are connected to one of the following types of
  access networks.

  a) Access network without link-layer security

   There is no IEEE 802.11i link-layer security in this access network.

  b) Access network with link-layer security

     In this case two options are considered to enable link-layer
      security:

     b1.  Access network operating in IEEE 802.1X/EAP mode

         There is IEEE 802.1X and EAP authentication in this access
         network.

     b2.  Access network operating in PSK mode

          An IEEE 802.11i pre-shared key is used for authentication.  There
       are two alternatives:

          b21.  Dynamically configured PSK

            There is PANA authentication in this access network which
            allows the PaC to bootstrap a PSK to access the current AP.

          b22.  Statically configured PSK

            There is no PANA authentication.  To access this network AP
            and PaC must share a statically configured PSK to access the
            network.

  PaC can distinguish between Type (a) and Type (b) networks
  by checking the capability information advertised in
  IEEE 802.11 Beacon/Probe Response frames (IEEE 802.11i defines
  RSN Information Element (IE) for this purpose).

  Specifically if no RSN IE is contained in Beacon and Probe
  Response frames then the access network is Type (a), otherwise it is
  Type (b).

  Type (b1) and Type (b2) can be recognized by checking the contents of
  the RSN IE, i.e., if IEEE 802.1X-EAP mode is advertised in the RSN IE
  the access network is Type (b1), otherwise if PSK mode is adverstised
  it is Type (b2).

  Since the RSN IE does not give further information to distinguish Type
  (b21) from Type (b22), the PaC needs to take an additional action of
  associating to the AP, acquiring an IP address and engaging in
  (solicited or unsolicited) PAA discovery.

  If the PaC receives a PANA message from a PAA, then the access network
  is Type (b21), otherwise, it is type (b22).

  The PaC behavior after identifying an access network type is
  described in Section 10.2, Section 10.2.1 and Section 10.2.2. "

Regards.

-- 
------------------------------------------------------
Rafael Marin Lopez
Faculty of Computer Science-University of Murcia
30071 Murcia - Spain
Telf: +34968367645    e-mail: [email-masked]
------------------------------------------------------

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Julien Bournelle <[email-masked]>
Date: Fri, 30 Dec 2005 16:37:22 +0100

Hi rafa,

 just a quick comment below... 

>  described in Section 10.2, Section 10.2.1 and Section 10.2.2. "

 why not advertise that PANA is used in the RSN IE ?

 - Julien

-- 
julien.bournelle at int-evry.fr

---

From: Rafa Marin Lopez <[email-masked]>
Date: Fri, 30 Dec 2005 12:02:35 -0500

Hi Julien

The intention in PANA -fwk  with respect to 802.11i is not to modify 
802.11i spec. Thus adverstising this could lead to change 802.11i spec.

Regards.