Subject: [Pana] pana-fwk nits on section 10.2.2

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 28 Dec 2005 17:56:40 -0500

Summary:

- In section 10.2.2, the term "PMK" defined in IEEE 802.11i
specification is re-defined in a slightly different way.  To avoid
confusion, the term "PSK" should be used instead of "PMK".

- The enumerated 802.11i/WPA bootstrapping procedure in section 10.2.2
is not accurate in terms of POPA configuration.

Suggested changes:

[1] In section 10.2.2 Change:

"
   In this model, PANA is used for authentication and authorization, and
   link-layer ciphering is used for access control.  Successful PANA
   authentication enables link-layer ciphering which is based on PSK
   (Pre-Shared Key) mode of WPA (Wi-Fi Protected Access) [WPA] or IEEE
   802.11i [802.11i].  In this document, the key shared between a
   station and an AP is referred to as the PMK (Pair-wise Master Key).
   The PMK is derived from the EAP AAA-Key as a result of successful
   PANA authentication.  In this model, MAC addresses are used as the
   device identifiers in PANA.
"

to:

"
   In this model, PANA is used for authentication and authorization,
   and link-layer ciphering is used for access control.  Successful
   PANA authentication enables link-layer ciphering which is based on
   PSK (Pre-Shared Key) mode of WPA (Wi-Fi Protected Access) [WPA] or
   IEEE 802.11i [802.11i].  The PSK is derived from the EAP AAA-Key as
   a result of successful PANA authentication.  In this model, MAC
   addresses are used as the device identifiers in PANA.
"

[2] Change:

"
   When a PaC does not have a PMK for the AP, the following procedure is
   taken:

   1.  The PaC associates with the AP.

   2.  The PaC configures a PRPA by using DHCP (in the case of IPv4) or
       configures a link-local address (in the case of IPv6), and then
       runs PANA.

   3.  Upon successful authentication, the PaC obtains a separate PMK
       for each AP controlled by the PAA.

   4.  The AP initiates IEEE 802.11i 4-way handshake to establish a PTK
       (Pair-wise Transient Key) with the PaC, by using the PMK.

   5.  The PaC obtains a POPA by using any method that the client
       normally uses.
"

to:

"
   When a PaC does not have a PSK for the AP, the following procedure is
   taken:

   1.  The PaC associates with the AP.

   2.  The PaC configures a PRPA by using a method defined in Section
       5 and then runs PANA.

   3.  Upon successful authentication, the PaC obtains a separate PSK
       for each AP controlled by the PAA as well as the information 
       on the available POPA configuration methods.

   4.  The AP initiates IEEE 802.11i 4-way handshake to establish a
       PTK (Pair-wise Transient Key) with the PaC, by using the PSK.

   5.  The PaC obtains a POPA when necessary using one of the
       available POPA configuration methods.
"

Regards,
Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Alper Yegin" <[email-masked]>
Date: Thu, 29 Dec 2005 01:13:50 +0200

This looks good.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Yoshihiro Ohba
> Sent: Thursday, December 29, 2005 12:57 AM
> To: [email-masked]
> Subject: [Pana] pana-fwk nits on section 10.2.2
> 
> Summary:
>