Subject: RE: [Pana] Re: [issue229] Comments on Device-ID choice

From: "Avi Lior" <[email-masked]>
Date: Mon, 6 Feb 2006 16:21:51 -0500

See that is important to know.

So what about Calling Station Id?  It also needs a device id.  Why? Potentially for channel binding.

Also policy evaluation may be impacted by the Calling Station Id. 

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:[email-masked]] 
> Sent: Monday, February 06, 2006 3:08 PM
> To: Avi Lior
> Cc: Alper Yegin; Yoshihiro Ohba; Tschofenig, Hannes; Hannes 
> Tschofenig PANA-Issues; [email-masked]
> Subject: Re: [Pana] Re: [issue229] Comments on Device-ID choice
> 
> Avi,
> 
> The intent is to pass the Device Id to EP so that EP can 
> perform per-packet access control appropriately.
> 
> Yoshihiro Ohba
> 
> On Sun, Feb 05, 2006 at 08:01:48PM -0500, Avi Lior wrote:
> > I have a question related to this....
> > 
> > Is the intent to use the Device Identifier in the AAA 
> messages? For example, Calling-Station-Id. 
> > 
> > > -----Original Message-----
> > > From: Alper Yegin [mailto:[email-masked]]
> > > Sent: Friday, February 03, 2006 4:25 PM
> > > To: 'Yoshihiro Ohba'
> > > Cc: 'Tschofenig, Hannes'; Avi Lior; 'Hannes Tschofenig 
> PANA-Issues'; 
> > > [email-masked]
> > > Subject: RE: [Pana] Re: [issue229] Comments on Device-ID choice
> > > 
> > > > - There is another types of identifier (e.g., PPPoE and L2TP 
> > > > session
> > > > identifiers) that is not IP address or MAC address but is
> > > carried in
> > > > data packets.  We think that this type of identifier is 
> not device 
> > > > identifier, but what makes it different from IP address,
> > > MAC address
> > > > and locally significant identifier?
> > > 
> > > RFC2661 (L2TP) says:
> > > 
> > >    Session ID indicates the identifier for a session 
> within a tunnel.
> > >    L2TP sessions are named by identifiers that have local 
> significance
> > >    only.
> > > 
> > > 
> > > In my understanding, session identifiers in both cases (PPPoE and 
> > > L2TP) are used to identify the PPP connections. However a PPP 
> > > connection is identified on a PPP peer should not matter 
> as long as 
> > > it is locally identified in one form.
> > > 
> > > These examples reveal that some of the identifiers may be 
> > > transported over the wire. For that, maybe we should 
> revise the text 
> > > as:
> > > 
> > > 
> > >    The device identifier used in the context of PANA can be an IP
> > >    address, a MAC address, or an identifier that *may* 
> not be carried 
> > >    in data packets but has local significance in identifying a 
> > > connected
> > >    device (e.g., circuit id, PPP interface id).
> > > 
> > > Does this help?
> > > 
> > > Alper
> > > 
> > > 
> > > 
> > > 
> > > > 
> > > > Yoshihiro Ohba
> > > > 
> > > > 
> > > > 
> > > > On Fri, Feb 03, 2006 at 07:08:56PM +0200, Alper Yegin wrote:
> > > > > Sorry folks, I don't understand what is wrong or missing with 
> > > > > the
> > > > current text in Section 5.7? Can someone clarify?
> > > > >
> > > > >
> > > > > Alper
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: Yoshihiro Ohba [mailto:[email-masked]]
> > > > > > Sent: Thursday, February 02, 2006 9:28 PM
> > > > > > To: Tschofenig, Hannes
> > > > > > Cc: Yoshihiro Ohba; Avi Lior; Alper Yegin; Hannes
> > > Tschofenig PANA-
> > > > Issues;
> > > > > > [email-masked]
> > > > > > Subject: Re: [Pana] Re: [issue229] Comments on Device-ID 
> > > > > > choice
> > > > > >
> > > > > > Section 8.2 is for device identifiers to be contained
> > > in Device-Id
> > > > > > AVP.  A locally significant identifier is also a device
> > > identifier
> > > > > > as long as it is used as a handle to control and police the 
> > > > > > network access of a client.
> > > > > >
> > > > > > Yoshihiro Ohba
> > > > > >
> > > > > >
> > > > > > On Tue, Jan 31, 2006 at 07:07:46PM +0100, Tschofenig,
> > > Hannes wrote:
> > > > > > > hi yoshi,
> > > > > > >
> > > > > > > i think this particular part caused the confusion.
> > > > > > >
> > > > > > > "
> > > > > > > Any of the
> > > > > > > following identifiers can be used for device
> > > identifiers: an IP
> > > > > > > address, a MAC address and an identifier that is not
> > > carried in
> > > > > > > data packets but has local significance in identifying a 
> > > > > > > connected device (e.g., circuit id, PPP interface id).
> > > > > > > "
> > > > > > >
> > > > > > > the device identifier can only be an ip or a mac
> > > address. that's
> > > > what
> > > > > > section  8.2 tells me.
> > > > > > >
> > > > > > > the type of security you want to rely on is a 
> separate story.
> > > > > > >
> > > > > > > ciao
> > > > > > > hannes
> > > > > > >
> > > > > > >
> > > > > > > > -----Urspr醇・gliche Nachricht-----
> > > > > > > > Von: Yoshihiro Ohba [mailto:[email-masked]]
> > > > > > > > Gesendet: Dienstag, 31. Januar 2006 01:28
> > > > > > > > An: Avi Lior
> > > > > > > > Cc: Tschofenig, Hannes; Alper Yegin; Yoshihiro Ohba; 
> > > > > > > > Hannes Tschofenig PANA-Issues; [email-masked]
> > > > > > > > Betreff: Re: [Pana] Re: [issue229] Comments on 
> Device-ID 
> > > > > > > > choice
> > > > > > > >
> > > > > > > > Hi Avi,
> > > > > > > >
> > > > > > > > I understand your concern.  BTW, I posted another
> > > text on this
> > > > issue:
> > > > > > > >
> > > > > > > > 
> > > http://www1.ietf.org/mail-archive/web/pana/current/msg02110.ht
> > > > > > > > ml
> > > > > > > >
> > > > > > > > Does this work for you?
> > > > > > > >
> > > > > > > > Yoshihiro Ohba
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > On Sun, Jan 29, 2006 at 04:50:30PM -0500, Avi 
> Lior wrote:
> > > > > > > > > Hannes seems to peg the Device ID to either a MAC 
> > > > > > > > > address
> > > > > > > > or an IP address.
> > > > > > > > >
> > > > > > > > > I strongly disagree.  At the IETF we create protocols 
> > > > > > > > > that
> > > > > > > > are to be used broadly and therefore limiting the
> > > Device ID to
> > > > > > > > a MAC address or an IP address is inappropriate.
> > > > > > > > >
> > > > > > > > > Instead I think we should be concentrating on
> > > guidelines as
> > > > > > > > to what the Device ID should contain and guidelines
> > > as to how
> > > > > > > > it is used.  We should then let SDOs define what
> > > the Device ID
> > > > > > > > is based on what is available for that particular
> > > deployement.
> > > > > > > > >
> > > > > > > > > Avi
> > > > > > > > >
> > > > > > > > > > -----Original Message-----
> > > > > > > > > > From: [email-masked]
> > > [mailto:[email-masked]]
> > > > > > > > > > On Behalf Of Tschofenig, Hannes
> > > > > > > > > > Sent: Sunday, January 29, 2006 3:46 PM
> > > > > > > > > > To: Alper Yegin; Yoshihiro Ohba; Hannes Tschofenig 
> > > > > > > > > > PANA-Issues
> > > > > > > > > > Cc: [email-masked]
> > > > > > > > > > Subject: AW: [Pana] Re: [issue229] Comments on 
> > > > > > > > > > Device-ID
> > > > choice
> > > > > > > > > >
> > > > > > > > > > hi alper,
> > > > > > > > > >
> > > > > > > > > > how about changing the paragraph from:
> > > > > > > > > >
> > > > > > > > > > "
> > > > > > > > > > 5.7  Device ID Choice
> > > > > > > > > >
> > > > > > > > > >    The device identifier used in the context of
> > > PANA can
> > > > > > > > > > be an
> > > > IP
> > > > > > > > > >    address, a MAC address, or an identifier that is 
> > > > > > > > > > not carried in data
> > > > > > > > > >    packets but has local significance in 
> identifying a 
> > > > > > > > > > connected device
> > > > > > > > > >    (e.g., circuit id, PPP interface id).  The last 
> > > > > > > > > > type
> > > > > > > > of identifiers
> > > > > > > > > >    are commonly used in point-to-point 
> links where MAC 
> > > > > > > > > > addresses are not
> > > > > > > > > >    available and lower-layers are already 
> physically or
> > > > > > > > > >    cryptographically secured.
> > > > > > > > > >
> > > > > > > > > >    It is assumed that the PAA knows the link
> > > type and the
> > > > security
> > > > > > > > > >    mechanisms being provided or required on 
> the access
> > > > > > > > network (e.g.,
> > > > > > > > > >    based on physical security, link-layer
> > > ciphers enabled
> > > > > > > > before or
> > > > > > > > > >    after PANA, or IPsec).  Based on that
> > > information, the
> > > > > > > > > > PAA can decide
> > > > > > > > > >    what type of EP device id will be usedused
> > > when running
> > > > > > > > > > PANA with the
> > > > > > > > > >    client.
> > > > > > > > > >
> > > > > > > > > >    When IPsec-based security
> > > [I-D.ietf-pana-ipsec] is the
> > > > > > > > choice of
> > > > > > > > > >    access control, the PAA SHOULD provide IP
> > > address(es)
> > > > > > > > > > as
> > > > EP(s)'
> > > > > > > > > >    device ID, and expect the PaC to provide its IP
> > > > > > > > address in return.
> > > > > > > > > >    Similarly, IP addresses are used when the
> > > EP(s) is not
> > > > > > > > > > on the same IP
> > > > > > > > > >    subnet as the PaC is.
> > > > > > > > > >
> > > > > > > > > >    In other cases, MAC addresses are used as device
> > > > > > > > identifiers when
> > > > > > > > > >    they are available.
> > > > > > > > > >
> > > > > > > > > >    If non-IPsec access control is enabled, and a MAC
> > > > > > > > address is not
> > > > > > > > > >    available, locally-significant identifiers
> > > (e.g., as a
> > > > > > > > circuit id)
> > > > > > > > > >    MUST be used as device id.  Note that these
> > > identifiers
> > > > > > > > > > are
> > > > not
> > > > > > > > > >    exchanged within PANA messages.  Instead,
> > > peers rely on
> > > > > > > > > > lower-layers
> > > > > > > > > >    to provide them along with received PANA 
> messages.
> > > > > > > > > >
> > > > > > > > > > "
> > > > > > > > > >
> > > > > > > > > > to:
> > > > > > > > > >
> > > > > > > > > > "
> > > > > > > > > > 5.7  Device ID Choice
> > > > > > > > > >
> > > > > > > > > >    The device identifier used in the context of
> > > PANA can
> > > > > > > > > > be an
> > > > IP
> > > > > > > > > >    address or a MAC address. It is assumed that the 
> > > > > > > > > > PAA knows
> > > > the
> > > > > > > > > >    link type and the security
> > > > > > > > > >    mechanisms being provided or required on 
> the access
> > > > > > > > network (e.g.,
> > > > > > > > > >    based on physical security, link-layer
> > > ciphers enabled
> > > > > > > > before or
> > > > > > > > > >    after PANA, or IPsec).  Based on that
> > > information, the
> > > > > > > > > > PAA can decide
> > > > > > > > > >    what type of EP device id will be used 
> when running
> > > > > > > > PANA with the
> > > > > > > > > >    client.
> > > > > > > > > >
> > > > > > > > > >    When IPsec-based security
> > > [I-D.ietf-pana-ipsec] is the
> > > > > > > > choice of
> > > > > > > > > >    access control, the PAA SHOULD provide IP
> > > address(es)
> > > > > > > > > > as
> > > > EP(s)'
> > > > > > > > > >    device ID, and expect the PaC to provide its IP
> > > > > > > > address in return.
> > > > > > > > > >    Similarly, IP addresses are used when the
> > > EP(s) is not
> > > > > > > > > > on the same IP
> > > > > > > > > >    subnet as the PaC is.
> > > > > > > > > >
> > > > > > > > > >    In other cases, MAC addresses are used as device
> > > > > > > > identifiers when
> > > > > > > > > >    they are available.
> > > > > > > > > >
> > > > > > > > > >    If the security protection established 
> via PANA is
> > > > > > > > neighter based
> > > > > > > > > >    on the network layer nor on the link 
> layer but is 
> > > > > > > > > > provided
> > > > by
> > > > > > > > > >    lower layers outside PANA (e.g., 
> physical security 
> > > > > > > > > > as
> > > > > > > > provided by
> > > > > > > > > >    some point-to-point links) then no device
> > > identifier can be
> > > > > > > > > >    exchanged within PANA messages.
> > > > > > > > > > "
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > ciao
> > > > > > > > > > hannes
> > > > > > > > > >
> > > > > > > > > > > -----Urspr？ngliche Nachricht-----
> > > > > > > > > > > Von: Alper Yegin [mailto:[email-masked]]
> > > > > > > > > > > Gesendet: Freitag, 27. Januar 2006 00:56
> > > > > > > > > > > An: Tschofenig, Hannes; 'Yoshihiro Ohba'; 'Hannes 
> > > > > > > > > > > Tschofenig PANA-Issues'
> > > > > > > > > > > Cc: [email-masked]
> > > > > > > > > > > Betreff: RE: [Pana] Re: [issue229] Comments
> > > on Device-ID
> > > > choice
> > > > > > > > > > >
> > > > > > > > > > > > > > "
> > > > > > > > > > > > > >    The device identifier used in 
> the context 
> > > > > > > > > > > > > > of PANA
> > > > > > > > > > > can be an IP
> > > > > > > > > > > > > >    address, a MAC address, or an
> > > identifier that
> > > > > > > > > > > > > > is
> > > > not
> > > > > > > > > > > > > carried in data
> > > > > > > > > > > > > >    packets but has local significance in 
> > > > > > > > > > > > > > identifying a
> > > > > > > > > > > > > connected device
> > > > > > > > > > > > > >    (e.g., circuit id, PPP interface
> > > id).  The last
> > > > type of
> > > > > > > > > > > > > identifiers
> > > > > > > > > > > > > >    are commonly used in point-to-point
> > > links where
> > > > > > > > > > > > > > MAC
> > > > > > > > > > > > > addresses are not
> > > > > > > > > > > > > >    available and lower-layers are already 
> > > > > > > > > > > > > > physically
> > > > or
> > > > > > > > > > > > > >    cryptographically secured.  Identifiers 
> > > > > > > > > > > > > > that are
> > > > not
> > > > > > > > > > > related to
> > > > > > > > > > > > > >    physical or cryptographic 
> security (e.g., 
> > > > > > > > > > > > > > session
> > > > > > > > > > > identifiers in
> > > > > > > > > > > > > >    PPP tunneling protocols) are not
> > > used as device
> > > > > > > > > > identifiers.
> > > > > > > > > > > > > > "
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > I'm not sure if this last sentence really
> > > helps. It
> > > > > > > > does not
> > > > > > > > > > > > > really give any guidance.
> > > > > > > > > > >
> > > > > > > > > > > > what guidance would you like to see, alper?
> > > > > > > > > > >
> > > > > > > > > > > I'm not after any particular guidance or message. 
> > > > > > > > > > > It's
> > > > > > > > just that
> > > > > > > > > > > reading the above sentence did not really clarify 
> > > > > > > > > > > what
> > > > > > > > cannot be a
> > > > > > > > > > > device identifier.
> > > > > > > > > > >
> > > > > > > > > > > When I read it again, now I found it
> > > confusing too. On
> > > > > > > > > > > one
> > > > > > > > > > side we are
> > > > > > > > > > > talking about "device identifiers", and 
> on the other
> > > > > > > > side we are
> > > > > > > > > > > talking about "identifiers related to physical or
> > > > > > > > crypto security".
> > > > > > > > > > >
> > > > > > > > > > > I don't know what (if anything?!?) we should
> > > say here. 
> > > > > > > > > > > But
> > > > > > > > > > the current
> > > > > > > > > > > text is not good, imho.
> > > > > > > > > > >
> > > > > > > > > > > Alper
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > i had problems understanding the initial
> > > review comments.
> > > > > > > > > > > >
> > > > > > > > > > > > so, what sort of info should we deliver 
> (without 
> > > > > > > > > > > > trying to
> > > > > > > > > > > write the text
> > > > > > > > > > > > already in a specification type of style)?
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > _______________________________________________
> > > > > > > > > > Pana mailing list
> > > > > > > > > > [email-masked]
> > > > > > > > > > https://www1.ietf.org/mailman/listinfo/pana
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > > _______________________________________________
> > > > > > > > > Pana mailing list
> > > > > > > > > [email-masked]
> > > > > > > > > https://www1.ietf.org/mailman/listinfo/pana
> > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > >
> > > > >
> > > > >
> > > 
> > > 
> > 
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 06 Feb 2006 16:29:19 -0500

I think the Calling-Station-Id issue should be discussed as a separate
issue for draft-ieft-pana-aaa-interworking-00.txt.

Yoshihiro Ohba