Subject: RE: [Pana] Re: [issue229] Comments on Device-ID choice

From: "Avi Lior" <[email-masked]>
Date: Tue, 31 Jan 2006 10:29:23 -0500

Almost...

From
"
Device identifiers used in the context of PANA are identifiers 
that are related to physical or cryptographic security.  Any of the 
following identifiers can be used for device identifiers: an IP 
address, a MAC address and an identifier that is not carried in data
packets but has local significance in identifying a connected device
(e.g., circuit id, PPP interface id).  The last type of identifiers 
is commonly used in point-to-point links where MAC addresses are not
available and lower-layers are already physically or cryptographically
secured.
"
Device identifer used in the context of PANA are identifiers that are related to physical or cyprtographic security.

Not sure I understand the above sentence.  For example MAC address is an allowed Identifier yet I never associate a MAC address with physical or cyrotgraphic security.  In fact I always thought that it is a weak identifier when it comes to security in that it can so easily be spoofed. 

To:
 
Device identifier used in the context of PANA should be selected such that the Device Identifier has local significance (Where?) in identifying a connected device.  Examples of such identifiers are an IP address, a MAC address, a cricuit id, and PPP interface id. 

You can add perhaps a another sentence before the Examples to address the phycisl or cyrpotgraphic security:

The Device identifier must be gauranteed to be immutable or it must be possible to locally validate whether the device id has been changed or not.

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:[email-masked]] 
> Sent: Monday, January 30, 2006 7:28 PM
> To: Avi Lior
> Cc: Tschofenig, Hannes; Alper Yegin; Yoshihiro Ohba; Hannes 
> Tschofenig PANA-Issues; [email-masked]
> Subject: Re: [Pana] Re: [issue229] Comments on Device-ID choice
> 
> Hi Avi,
> 
> I understand your concern.  BTW, I posted another text on this issue:
> 
> http://www1.ietf.org/mail-archive/web/pana/current/msg02110.html
> 
> Does this work for you?
> 
> Yoshihiro Ohba
> 
> 
> 
> On Sun, Jan 29, 2006 at 04:50:30PM -0500, Avi Lior wrote:
> > Hannes seems to peg the Device ID to either a MAC address 
> or an IP address.
> > 
> > I strongly disagree.  At the IETF we create protocols that 
> are to be used broadly and therefore limiting the Device ID 
> to a MAC address or an IP address is inappropriate.
> > 
> > Instead I think we should be concentrating on guidelines as 
> to what the Device ID should contain and guidelines as to how 
> it is used.  We should then let SDOs define what the Device 
> ID is based on what is available for that particular deployement.
> > 
> > Avi
> > 
> > > -----Original Message-----
> > > From: [email-masked] 
> [mailto:[email-masked]] On Behalf 
> > > Of Tschofenig, Hannes
> > > Sent: Sunday, January 29, 2006 3:46 PM
> > > To: Alper Yegin; Yoshihiro Ohba; Hannes Tschofenig PANA-Issues
> > > Cc: [email-masked]
> > > Subject: AW: [Pana] Re: [issue229] Comments on Device-ID choice
> > > 
> > > hi alper,
> > > 
> > > how about changing the paragraph from:
> > > 
> > > "
> > > 5.7  Device ID Choice
> > > 
> > >    The device identifier used in the context of PANA can be an IP
> > >    address, a MAC address, or an identifier that is not 
> carried in 
> > > data
> > >    packets but has local significance in identifying a connected 
> > > device
> > >    (e.g., circuit id, PPP interface id).  The last type 
> of identifiers
> > >    are commonly used in point-to-point links where MAC 
> addresses are 
> > > not
> > >    available and lower-layers are already physically or
> > >    cryptographically secured.
> > > 
> > >    It is assumed that the PAA knows the link type and the security
> > >    mechanisms being provided or required on the access 
> network (e.g.,
> > >    based on physical security, link-layer ciphers enabled 
> before or
> > >    after PANA, or IPsec).  Based on that information, the PAA can 
> > > decide
> > >    what type of EP device id will be usedused when 
> running PANA with 
> > > the
> > >    client.
> > > 
> > >    When IPsec-based security [I-D.ietf-pana-ipsec] is the 
> choice of
> > >    access control, the PAA SHOULD provide IP address(es) as EP(s)'
> > >    device ID, and expect the PaC to provide its IP 
> address in return.
> > >    Similarly, IP addresses are used when the EP(s) is not on the 
> > > same IP
> > >    subnet as the PaC is.
> > > 
> > >    In other cases, MAC addresses are used as device 
> identifiers when
> > >    they are available.
> > > 
> > >    If non-IPsec access control is enabled, and a MAC 
> address is not
> > >    available, locally-significant identifiers (e.g., as a 
> circuit id)
> > >    MUST be used as device id.  Note that these identifiers are not
> > >    exchanged within PANA messages.  Instead, peers rely on 
> > > lower-layers
> > >    to provide them along with received PANA messages.
> > > 
> > > " 
> > > 
> > > to:
> > > 
> > > "
> > > 5.7  Device ID Choice
> > > 
> > >    The device identifier used in the context of PANA can be an IP
> > >    address or a MAC address. It is assumed that the PAA knows the 
> > >    link type and the security
> > >    mechanisms being provided or required on the access 
> network (e.g.,
> > >    based on physical security, link-layer ciphers enabled 
> before or
> > >    after PANA, or IPsec).  Based on that information, the PAA can 
> > > decide
> > >    what type of EP device id will be used when running 
> PANA with the
> > >    client.
> > > 
> > >    When IPsec-based security [I-D.ietf-pana-ipsec] is the 
> choice of
> > >    access control, the PAA SHOULD provide IP address(es) as EP(s)'
> > >    device ID, and expect the PaC to provide its IP 
> address in return.
> > >    Similarly, IP addresses are used when the EP(s) is not on the 
> > > same IP
> > >    subnet as the PaC is.
> > > 
> > >    In other cases, MAC addresses are used as device 
> identifiers when
> > >    they are available.
> > > 
> > >    If the security protection established via PANA is 
> neighter based
> > >    on the network layer nor on the link layer but is provided by 
> > >    lower layers outside PANA (e.g., physical security as 
> provided by 
> > >    some point-to-point links) then no device identifier can be 
> > >    exchanged within PANA messages. 
> > > "
> > > 
> > > 
> > > ciao
> > > hannes
> > > 
> > > > -----Urspr？ngliche Nachricht-----
> > > > Von: Alper Yegin [mailto:[email-masked]]
> > > > Gesendet: Freitag, 27. Januar 2006 00:56
> > > > An: Tschofenig, Hannes; 'Yoshihiro Ohba'; 'Hannes Tschofenig 
> > > > PANA-Issues'
> > > > Cc: [email-masked]
> > > > Betreff: RE: [Pana] Re: [issue229] Comments on Device-ID choice
> > > > 
> > > > > > > "
> > > > > > >    The device identifier used in the context of PANA
> > > > can be an IP
> > > > > > >    address, a MAC address, or an identifier that is not
> > > > > > carried in data
> > > > > > >    packets but has local significance in identifying a
> > > > > > connected device
> > > > > > >    (e.g., circuit id, PPP interface id).  The last type of
> > > > > > identifiers
> > > > > > >    are commonly used in point-to-point links where MAC
> > > > > > addresses are not
> > > > > > >    available and lower-layers are already physically or
> > > > > > >    cryptographically secured.  Identifiers that are not
> > > > related to
> > > > > > >    physical or cryptographic security (e.g., session
> > > > identifiers in
> > > > > > >    PPP tunneling protocols) are not used as device
> > > identifiers.
> > > > > > > "
> > > > > >
> > > > > >
> > > > > > I'm not sure if this last sentence really helps. It 
> does not 
> > > > > > really give any guidance.
> > > > 
> > > > > what guidance would you like to see, alper?
> > > > 
> > > > I'm not after any particular guidance or message. It's 
> just that 
> > > > reading the above sentence did not really clarify what 
> cannot be a 
> > > > device identifier.
> > > > 
> > > > When I read it again, now I found it confusing too. On one
> > > side we are
> > > > talking about "device identifiers", and on the other 
> side we are 
> > > > talking about "identifiers related to physical or 
> crypto security".
> > > > 
> > > > I don't know what (if anything?!?) we should say here. But
> > > the current
> > > > text is not good, imho.
> > > > 
> > > > Alper
> > > >  
> > > > 
> > > > 
> > > > 
> > > > > 
> > > > > i had problems understanding the initial review comments.
> > > > > 
> > > > > so, what sort of info should we deliver (without trying to
> > > > write the text
> > > > > already in a specification type of style)?
> > > > 
> > > > 
> > > 
> > > _______________________________________________
> > > Pana mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/pana
> > > 
> > 
> > _______________________________________________
> > Pana mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/pana
> > 
> > 
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 31 Jan 2006 17:13:28 -0500

Hi Avi,

> Not sure I understand the above sentence.  For example MAC address is an allowed Identifier yet I never associate a MAC address with physical or cyrotgraphic security.  In fact I always thought tha…

A MAC address can be associated with link-layer ciphering (e.g.,
802.11).  A MAC address can also be associated with physical layer
security (e.g., in the case of DSL), by associating it with a switch
port when attaching.  Although this is not strong association compared
to the former case, as long as physical layer is reasonably secured it
should be acceptable.

BTW, a MAC address can be spoofed even using 802.11i before
bootstrapping 802.11i.

> Device identifier used in the context of PANA should be selected such that the Device Identifier has local significance (Where?) in identifying a connected device.  Examples of such identifiers are…

This has an issue of expanding the definition of "local siginicance"
from that is used in the current text.

> The Device identifier must be gauranteed to be immutable or it must be possible to locally validate whether the device id has been changed or not.

I am not sure whether this requirement is an essential requirement for
device identifier or not.

Yoshihiro Ohba