Subject: Re: [Pana] Correction to pana-fwk section 10.2.3

From: Rafa Marin Lopez <[email-masked]>
Date: Thu, 05 Jan 2006 13:02:01 -0500

I would like to do an additional comment regarding text i sent last week

In the penultimate paragraph is said:

"If the PaC receives a PANA message from a PAA, then the access network
 is Type (b21), otherwise, it is type (b22). "

However I think if PaC cannot configure an IP address, PaC should 
consider network
as type b22 becuase it will not be able to run PANA.

Thus this paragraph may be clearer as :

"If the PaC cannot acquire an IP address or does not receive 
PANA-Start-Request message from a PAA, then the access network is 
considered Type (b22), otherwise, it is Type (b21)."

P.D: If there is no objection to the text i provided last week and this 
minor modification, it will be added by end of next tuesday.

Rafa Marin Lopez wrote:

> In section 10.2.3 three types of network are explained
>
> "
> a) Free access network
>
>     There is no IEEE 802.1X or PANA authentication in this access
>     network.
>
> b) PANA-secured network
>
>     There is PANA authentication in this access network.
>
> c) IEEE 802.1X-secured network
>
>     There is IEEE 802.1X authentication in this access network.
> "
> Considering that classification,  it is said also in this section:
>
> "Types (a) and (b) are not distinguishable until the PaC associates 
> with the AP ".
>
> However this is not true becuase PaC can distinguish between type a) 
> and type b) basically
> becuase type a) network does NOT announce RSN IE in beacon frame/probe 
> response and type b) DOES (PSK mode).
>
> Actually PaC cannot distinguish between networks where PANA is used to 
> bootstrap PSK  and network where PSK is required
> but it is statically configured. In both cases RSN IE announces PSK 
> mode in RSN IE.
>
> Another thing that could not be clear in the classification is the 
> meaning of IEEE 802.1X-secured network. Are we assuming here both IEEE 
> 802.1X authentication with EAP or PSK should be also included here?. 
> My understanding of type c) network is EAP authentication is used but 
> no PSK mode is considered.
>
> But in any case, even if PSK mode is also included  in type c)
>
> c) IEEE 802.1X-secured networks
>      c1) PSK authentication
>      c2) EAP authentication
>
> then i would say PaC cannot distinguish between type b) networks and 
> type c1) networks and not between type a) and type b) . If PSK 
> authentication is not included in type c) networks then classification 
> is incomplete , we should add networks that requires a PSK and no PANA 
> authentication is possible.
>
>
>
> Thus I think the section 10.2.3 could be rewritten more clearly in 
> this way:
>
> "
> 10.2.3  Capability Discovery
>
>  When a PaC is a mobile, there may be multiple APs available in its
>  vicinity.  Each AP are connected to one of the following types of
>  access networks.
>
>
>  a) Access network without link-layer security
>
>   There is no IEEE 802.11i link-layer security in this access network.
>
>
>  b) Access network with link-layer security
>
>     In this case two options are considered to enable link-layer
>      security:
>
>     b1.  Access network operating in IEEE 802.1X/EAP mode
>
>         There is IEEE 802.1X and EAP authentication in this access
>         network.
>
>     b2.  Access network operating in PSK mode
>
>          An IEEE 802.11i pre-shared key is used for authentication.  
> There
>       are two alternatives:
>
>          b21.  Dynamically configured PSK
>
>            There is PANA authentication in this access network which
>            allows the PaC to bootstrap a PSK to access the current AP.
>
>
>          b22.  Statically configured PSK
>
>
>            There is no PANA authentication.  To access this network AP
>            and PaC must share a statically configured PSK to access the
>            network.
>
>  PaC can distinguish between Type (a) and Type (b) networks
>  by checking the capability information advertised in
>  IEEE 802.11 Beacon/Probe Response frames (IEEE 802.11i defines
>  RSN Information Element (IE) for this purpose).
>
>  Specifically if no RSN IE is contained in Beacon and Probe
>  Response frames then the access network is Type (a), otherwise it is
>  Type (b).
>
>  Type (b1) and Type (b2) can be recognized by checking the contents of
>  the RSN IE, i.e., if IEEE 802.1X-EAP mode is advertised in the RSN IE
>  the access network is Type (b1), otherwise if PSK mode is adverstised
>  it is Type (b2).
>
>  Since the RSN IE does not give further information to distinguish Type
>  (b21) from Type (b22), the PaC needs to take an additional action of
>  associating to the AP, acquiring an IP address and engaging in
>  (solicited or unsolicited) PAA discovery.
>
>
>  If the PaC receives a PANA message from a PAA, then the access network
>  is Type (b21), otherwise, it is type (b22).
>
>  The PaC behavior after identifying an access network type is
>  described in Section 10.2, Section 10.2.1 and Section 10.2.2. "
>
> Regards.
>

-- 
------------------------------------------------------
Rafael Marin Lopez
Faculty of Computer Science-University of Murcia
30071 Murcia - Spain
Telf: +34968367645    e-mail: [email-masked]
------------------------------------------------------

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Alper Yegin" <[email-masked]>
Date: Tue, 10 Jan 2006 00:25:25 +0200

Hi Rafa,

You said:

> However this is not true becuase PaC can distinguish between type a) and
> type b) basically

Does it have to be that way? Can't we design it such that for Type B RSN IE
does not announce PSK mode? I think this would keep things simpler. 

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Rafa Marin Lopez
> Sent: Friday, December 30, 2005 5:12 PM
> To: [email-masked]
> Cc: Yoshihiro Ohba; Rafa Marin Lopez
> Subject: [Pana] Correction to pana-fwk section 10.2.3
> 
> "Types (a) and (b) are not distinguishable until the PaC associates with
> the AP ".
> 
> However this is not true becuase PaC can distinguish between type a) and
> type b) basically
> but it is statically configured. In both cases RSN IE announces PSK mode
> in RSN IE.
> 
> 802.1X authentication with EAP or PSK should be also included here?. My
> understanding of type c) network is EAP authentication is used but no
> PSK mode is considered.
> 
> Thus I think the section 10.2.3 could be rewritten more clearly in this
> way:
> 
> "