Subject: Re: [Pana] Re: [issue229] Comments on Device-ID choice

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 02 Feb 2006 14:28:28 -0500

Section 8.2 is for device identifiers to be contained in Device-Id
AVP.  A locally significant identifier is also a device identifier as
long as it is used as a handle to control and police the network
access of a client.

Yoshihiro Ohba

On Tue, Jan 31, 2006 at 07:07:46PM +0100, Tschofenig, Hannes wrote:
> hi yoshi, 
> 
> i think this particular part caused the confusion.
> 
> "
> Any of the 
> following identifiers can be used for device identifiers: an IP 
> address, a MAC address and an identifier that is not carried in data
> packets but has local significance in identifying a connected device
> (e.g., circuit id, PPP interface id).  
> "
> 
> the device identifier can only be an ip or a mac address. that's what section  8.2 tells me. 
> 
> the type of security you want to rely on is a separate story.  
> 
> ciao
> hannes
> 
> 
> > -----Ursprüngliche Nachricht-----
> > Von: Yoshihiro Ohba [mailto:[email-masked]] 
> > Gesendet: Dienstag, 31. Januar 2006 01:28
> > An: Avi Lior
> > Cc: Tschofenig, Hannes; Alper Yegin; Yoshihiro Ohba; Hannes 
> > Tschofenig PANA-Issues; [email-masked]
> > Betreff: Re: [Pana] Re: [issue229] Comments on Device-ID choice
> > 
> > Hi Avi,
> > 
> > I understand your concern.  BTW, I posted another text on this issue:
> > 
> > http://www1.ietf.org/mail-archive/web/pana/current/msg02110.html
> > 
> > Does this work for you?
> > 
> > Yoshihiro Ohba
> > 
> > 
> > 
> > On Sun, Jan 29, 2006 at 04:50:30PM -0500, Avi Lior wrote:
> > > Hannes seems to peg the Device ID to either a MAC address 
> > or an IP address.
> > > 
> > > I strongly disagree.  At the IETF we create protocols that 
> > are to be used broadly and therefore limiting the Device ID 
> > to a MAC address or an IP address is inappropriate.
> > > 
> > > Instead I think we should be concentrating on guidelines as 
> > to what the Device ID should contain and guidelines as to how 
> > it is used.  We should then let SDOs define what the Device 
> > ID is based on what is available for that particular deployement.
> > > 
> > > Avi 
> > > 
> > > > -----Original Message-----
> > > > From: [email-masked] [mailto:[email-masked]] On 
> > > > Behalf Of Tschofenig, Hannes
> > > > Sent: Sunday, January 29, 2006 3:46 PM
> > > > To: Alper Yegin; Yoshihiro Ohba; Hannes Tschofenig PANA-Issues
> > > > Cc: [email-masked]
> > > > Subject: AW: [Pana] Re: [issue229] Comments on Device-ID choice
> > > > 
> > > > hi alper, 
> > > > 
> > > > how about changing the paragraph from:
> > > > 
> > > > "
> > > > 5.7  Device ID Choice
> > > > 
> > > >    The device identifier used in the context of PANA can be an IP
> > > >    address, a MAC address, or an identifier that is not 
> > > > carried in data
> > > >    packets but has local significance in identifying a 
> > > > connected device
> > > >    (e.g., circuit id, PPP interface id).  The last type 
> > of identifiers
> > > >    are commonly used in point-to-point links where MAC 
> > > > addresses are not
> > > >    available and lower-layers are already physically or
> > > >    cryptographically secured.
> > > > 
> > > >    It is assumed that the PAA knows the link type and the security
> > > >    mechanisms being provided or required on the access 
> > network (e.g.,
> > > >    based on physical security, link-layer ciphers enabled 
> > before or
> > > >    after PANA, or IPsec).  Based on that information, the PAA 
> > > > can decide
> > > >    what type of EP device id will be usedused when running 
> > > > PANA with the
> > > >    client.
> > > > 
> > > >    When IPsec-based security [I-D.ietf-pana-ipsec] is the 
> > choice of
> > > >    access control, the PAA SHOULD provide IP address(es) as EP(s)'
> > > >    device ID, and expect the PaC to provide its IP 
> > address in return.
> > > >    Similarly, IP addresses are used when the EP(s) is not on 
> > > > the same IP
> > > >    subnet as the PaC is.
> > > > 
> > > >    In other cases, MAC addresses are used as device 
> > identifiers when
> > > >    they are available.
> > > > 
> > > >    If non-IPsec access control is enabled, and a MAC 
> > address is not
> > > >    available, locally-significant identifiers (e.g., as a 
> > circuit id)
> > > >    MUST be used as device id.  Note that these identifiers are not
> > > >    exchanged within PANA messages.  Instead, peers rely on 
> > > > lower-layers
> > > >    to provide them along with received PANA messages.
> > > > 
> > > > " 
> > > > 
> > > > to:
> > > > 
> > > > "
> > > > 5.7  Device ID Choice
> > > > 
> > > >    The device identifier used in the context of PANA can be an IP
> > > >    address or a MAC address. It is assumed that the PAA knows the 
> > > >    link type and the security
> > > >    mechanisms being provided or required on the access 
> > network (e.g.,
> > > >    based on physical security, link-layer ciphers enabled 
> > before or
> > > >    after PANA, or IPsec).  Based on that information, the PAA 
> > > > can decide
> > > >    what type of EP device id will be used when running 
> > PANA with the
> > > >    client.
> > > > 
> > > >    When IPsec-based security [I-D.ietf-pana-ipsec] is the 
> > choice of
> > > >    access control, the PAA SHOULD provide IP address(es) as EP(s)'
> > > >    device ID, and expect the PaC to provide its IP 
> > address in return.
> > > >    Similarly, IP addresses are used when the EP(s) is not on 
> > > > the same IP
> > > >    subnet as the PaC is.
> > > > 
> > > >    In other cases, MAC addresses are used as device 
> > identifiers when
> > > >    they are available.
> > > > 
> > > >    If the security protection established via PANA is 
> > neighter based
> > > >    on the network layer nor on the link layer but is provided by 
> > > >    lower layers outside PANA (e.g., physical security as 
> > provided by 
> > > >    some point-to-point links) then no device identifier can be 
> > > >    exchanged within PANA messages. 
> > > > "
> > > > 
> > > > 
> > > > ciao
> > > > hannes 
> > > > 
> > > > > -----Urspr？ngliche Nachricht-----
> > > > > Von: Alper Yegin [mailto:[email-masked]]
> > > > > Gesendet: Freitag, 27. Januar 2006 00:56
> > > > > An: Tschofenig, Hannes; 'Yoshihiro Ohba'; 'Hannes Tschofenig 
> > > > > PANA-Issues'
> > > > > Cc: [email-masked]
> > > > > Betreff: RE: [Pana] Re: [issue229] Comments on Device-ID choice
> > > > > 
> > > > > > > > "
> > > > > > > >    The device identifier used in the context of PANA
> > > > > can be an IP
> > > > > > > >    address, a MAC address, or an identifier that is not
> > > > > > > carried in data
> > > > > > > >    packets but has local significance in identifying a
> > > > > > > connected device
> > > > > > > >    (e.g., circuit id, PPP interface id).  The last type of
> > > > > > > identifiers
> > > > > > > >    are commonly used in point-to-point links where MAC
> > > > > > > addresses are not
> > > > > > > >    available and lower-layers are already physically or
> > > > > > > >    cryptographically secured.  Identifiers that are not
> > > > > related to
> > > > > > > >    physical or cryptographic security (e.g., session
> > > > > identifiers in
> > > > > > > >    PPP tunneling protocols) are not used as device 
> > > > identifiers.
> > > > > > > > "
> > > > > > >
> > > > > > >
> > > > > > > I'm not sure if this last sentence really helps. It 
> > does not 
> > > > > > > really give any guidance.
> > > > > 
> > > > > > what guidance would you like to see, alper?
> > > > > 
> > > > > I'm not after any particular guidance or message. It's 
> > just that 
> > > > > reading the above sentence did not really clarify what 
> > cannot be a 
> > > > > device identifier.
> > > > > 
> > > > > When I read it again, now I found it confusing too. On one 
> > > > side we are 
> > > > > talking about "device identifiers", and on the other 
> > side we are 
> > > > > talking about "identifiers related to physical or 
> > crypto security".
> > > > > 
> > > > > I don't know what (if anything?!?) we should say here. But 
> > > > the current 
> > > > > text is not good, imho.
> > > > > 
> > > > > Alper
> > > > >  
> > > > > 
> > > > > 
> > > > > 
> > > > > > 
> > > > > > i had problems understanding the initial review comments.
> > > > > > 
> > > > > > so, what sort of info should we deliver (without trying to
> > > > > write the text
> > > > > > already in a specification type of style)?
> > > > > 
> > > > > 
> > > > 
> > > > _______________________________________________
> > > > Pana mailing list
> > > > [email-masked]
> > > > https://www1.ietf.org/mailman/listinfo/pana
> > > > 
> > > 
> > > _______________________________________________
> > > Pana mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/pana
> > > 
> > > 
> > 
> 
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 3 Feb 2006 19:08:56 +0200

Sorry folks, I don't understand what is wrong or missing with the current text in Section 5.7? Can someone clarify?

Alper

> From: Yoshihiro Ohba [mailto:[email-masked]]
> Sent: Thursday, February 02, 2006 9:28 PM
> To: Tschofenig, Hannes
> Cc: Yoshihiro Ohba; Avi Lior; Alper Yegin; Hannes Tschofenig PANA-Issues;
> [email-masked]
> Subject: Re: [Pana] Re: [issue229] Comments on Device-ID choice
> 
> > > -----Urspr醇・gliche Nachricht-----

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 03 Feb 2006 14:43:52 -0500

The issue is:

- We already define IP address, MAC address, and identifier that is
not carried in data packets but has local significance in identifying
a connected device (e.g., circuit id, PPP interface id) as device
identifiers.

- There is another types of identifier (e.g., PPPoE and L2TP session
identifiers) that is not IP address or MAC address but is carried in
data packets.  We think that this type of identifier is not device
identifier, but what makes it different from IP address, MAC address
and locally significant identifier?

Yoshihiro Ohba

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 3 Feb 2006 23:24:36 +0200

> and locally significant identifier?

RFC2661 (L2TP) says:

   Session ID indicates the identifier for a session within a tunnel.
   L2TP sessions are named by identifiers that have local significance
   only.

In my understanding, session identifiers in both cases (PPPoE and L2TP) are used to identify the PPP connections. However a PPP connection is identified on a PPP peer should not matter as long as it is locally identified in one form. 

These examples reveal that some of the identifiers may be transported over the wire. For that, maybe we should revise the text as:

   The device identifier used in the context of PANA can be an IP
   address, a MAC address, or an identifier that *may* not be carried 
   in data packets but has local significance in identifying a connected 
   device (e.g., circuit id, PPP interface id).

Does this help?

Alper

> > Sorry folks, I don't understand what is wrong or missing with the
> current text in Section 5.7? Can someone clarify?
> >
> >
> > Alper
> >
> >
> >
> >
> > > > the device identifier can only be an ip or a mac address. that's
> what
> > > section  8.2 tells me.
> > > >

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 03 Feb 2006 16:32:30 -0500

Alper,

The suggested text pretty much works for me.

Yoshihiro Ohba