Subject: RE: [Pana] Re: [issue229] Comments on Device-ID choice

From: "Avi Lior" <[email-masked]>
Date: Fri, 3 Feb 2006 15:15:06 -0500

There is even a third type of device identifier:  an electronic serical number or ESN.  And even a Device Certificate. 

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:[email-masked]] 
> Sent: Friday, February 03, 2006 2:44 PM
> To: Alper Yegin
> Cc: 'Yoshihiro Ohba'; 'Tschofenig, Hannes'; Avi Lior; 'Hannes 
> Tschofenig PANA-Issues'; [email-masked]
> Subject: Re: [Pana] Re: [issue229] Comments on Device-ID choice
> 
> The issue is:
> 
> - We already define IP address, MAC address, and identifier 
> that is not carried in data packets but has local 
> significance in identifying a connected device (e.g., circuit 
> id, PPP interface id) as device identifiers.
> 
> - There is another types of identifier (e.g., PPPoE and L2TP session
> identifiers) that is not IP address or MAC address but is 
> carried in data packets.  We think that this type of 
> identifier is not device identifier, but what makes it 
> different from IP address, MAC address and locally 
> significant identifier?
> 
> Yoshihiro Ohba
> 
> 
> 
> On Fri, Feb 03, 2006 at 07:08:56PM +0200, Alper Yegin wrote:
> > Sorry folks, I don't understand what is wrong or missing 
> with the current text in Section 5.7? Can someone clarify?
> > 
> > 
> > Alper
> > 
> > 
> > 
> > 
> > > -----Original Message-----
> > > From: Yoshihiro Ohba [mailto:[email-masked]]
> > > Sent: Thursday, February 02, 2006 9:28 PM
> > > To: Tschofenig, Hannes
> > > Cc: Yoshihiro Ohba; Avi Lior; Alper Yegin; Hannes Tschofenig 
> > > PANA-Issues; [email-masked]
> > > Subject: Re: [Pana] Re: [issue229] Comments on Device-ID choice
> > > 
> > > Section 8.2 is for device identifiers to be contained in 
> Device-Id 
> > > AVP.  A locally significant identifier is also a device 
> identifier 
> > > as long as it is used as a handle to control and police 
> the network 
> > > access of a client.
> > > 
> > > Yoshihiro Ohba
> > > 
> > > 
> > > On Tue, Jan 31, 2006 at 07:07:46PM +0100, Tschofenig, 
> Hannes wrote:
> > > > hi yoshi,
> > > >
> > > > i think this particular part caused the confusion.
> > > >
> > > > "
> > > > Any of the
> > > > following identifiers can be used for device identifiers: an IP 
> > > > address, a MAC address and an identifier that is not carried in 
> > > > data packets but has local significance in identifying 
> a connected 
> > > > device (e.g., circuit id, PPP interface id).
> > > > "
> > > >
> > > > the device identifier can only be an ip or a mac 
> address. that's 
> > > > what
> > > section  8.2 tells me.
> > > >
> > > > the type of security you want to rely on is a separate story.
> > > >
> > > > ciao
> > > > hannes
> > > >
> > > >
> > > > > -----Urspr醇・gliche Nachricht-----
> > > > > Von: Yoshihiro Ohba [mailto:[email-masked]]
> > > > > Gesendet: Dienstag, 31. Januar 2006 01:28
> > > > > An: Avi Lior
> > > > > Cc: Tschofenig, Hannes; Alper Yegin; Yoshihiro Ohba; Hannes 
> > > > > Tschofenig PANA-Issues; [email-masked]
> > > > > Betreff: Re: [Pana] Re: [issue229] Comments on 
> Device-ID choice
> > > > >
> > > > > Hi Avi,
> > > > >
> > > > > I understand your concern.  BTW, I posted another 
> text on this issue:
> > > > >
> > > > > 
> http://www1.ietf.org/mail-archive/web/pana/current/msg02110.html
> > > > >
> > > > > Does this work for you?
> > > > >
> > > > > Yoshihiro Ohba
> > > > >
> > > > >
> > > > >
> > > > > On Sun, Jan 29, 2006 at 04:50:30PM -0500, Avi Lior wrote:
> > > > > > Hannes seems to peg the Device ID to either a MAC address
> > > > > or an IP address.
> > > > > >
> > > > > > I strongly disagree.  At the IETF we create protocols that
> > > > > are to be used broadly and therefore limiting the 
> Device ID to a 
> > > > > MAC address or an IP address is inappropriate.
> > > > > >
> > > > > > Instead I think we should be concentrating on guidelines as
> > > > > to what the Device ID should contain and guidelines 
> as to how it 
> > > > > is used.  We should then let SDOs define what the 
> Device ID is 
> > > > > based on what is available for that particular deployement.
> > > > > >
> > > > > > Avi
> > > > > >
> > > > > > > -----Original Message-----
> > > > > > > From: [email-masked] 
> [mailto:[email-masked]] 
> > > > > > > On Behalf Of Tschofenig, Hannes
> > > > > > > Sent: Sunday, January 29, 2006 3:46 PM
> > > > > > > To: Alper Yegin; Yoshihiro Ohba; Hannes Tschofenig 
> > > > > > > PANA-Issues
> > > > > > > Cc: [email-masked]
> > > > > > > Subject: AW: [Pana] Re: [issue229] Comments on Device-ID 
> > > > > > > choice
> > > > > > >
> > > > > > > hi alper,
> > > > > > >
> > > > > > > how about changing the paragraph from:
> > > > > > >
> > > > > > > "
> > > > > > > 5.7  Device ID Choice
> > > > > > >
> > > > > > >    The device identifier used in the context of 
> PANA can be an IP
> > > > > > >    address, a MAC address, or an identifier that is not 
> > > > > > > carried in data
> > > > > > >    packets but has local significance in identifying a 
> > > > > > > connected device
> > > > > > >    (e.g., circuit id, PPP interface id).  The last type
> > > > > of identifiers
> > > > > > >    are commonly used in point-to-point links where MAC 
> > > > > > > addresses are not
> > > > > > >    available and lower-layers are already physically or
> > > > > > >    cryptographically secured.
> > > > > > >
> > > > > > >    It is assumed that the PAA knows the link type 
> and the security
> > > > > > >    mechanisms being provided or required on the access
> > > > > network (e.g.,
> > > > > > >    based on physical security, link-layer ciphers enabled
> > > > > before or
> > > > > > >    after PANA, or IPsec).  Based on that information, the 
> > > > > > > PAA can decide
> > > > > > >    what type of EP device id will be usedused 
> when running 
> > > > > > > PANA with the
> > > > > > >    client.
> > > > > > >
> > > > > > >    When IPsec-based security [I-D.ietf-pana-ipsec] is the
> > > > > choice of
> > > > > > >    access control, the PAA SHOULD provide IP 
> address(es) as EP(s)'
> > > > > > >    device ID, and expect the PaC to provide its IP
> > > > > address in return.
> > > > > > >    Similarly, IP addresses are used when the 
> EP(s) is not on 
> > > > > > > the same IP
> > > > > > >    subnet as the PaC is.
> > > > > > >
> > > > > > >    In other cases, MAC addresses are used as device
> > > > > identifiers when
> > > > > > >    they are available.
> > > > > > >
> > > > > > >    If non-IPsec access control is enabled, and a MAC
> > > > > address is not
> > > > > > >    available, locally-significant identifiers (e.g., as a
> > > > > circuit id)
> > > > > > >    MUST be used as device id.  Note that these 
> identifiers are not
> > > > > > >    exchanged within PANA messages.  Instead, 
> peers rely on 
> > > > > > > lower-layers
> > > > > > >    to provide them along with received PANA messages.
> > > > > > >
> > > > > > > "
> > > > > > >
> > > > > > > to:
> > > > > > >
> > > > > > > "
> > > > > > > 5.7  Device ID Choice
> > > > > > >
> > > > > > >    The device identifier used in the context of 
> PANA can be an IP
> > > > > > >    address or a MAC address. It is assumed that 
> the PAA knows the
> > > > > > >    link type and the security
> > > > > > >    mechanisms being provided or required on the access
> > > > > network (e.g.,
> > > > > > >    based on physical security, link-layer ciphers enabled
> > > > > before or
> > > > > > >    after PANA, or IPsec).  Based on that information, the 
> > > > > > > PAA can decide
> > > > > > >    what type of EP device id will be used when running
> > > > > PANA with the
> > > > > > >    client.
> > > > > > >
> > > > > > >    When IPsec-based security [I-D.ietf-pana-ipsec] is the
> > > > > choice of
> > > > > > >    access control, the PAA SHOULD provide IP 
> address(es) as EP(s)'
> > > > > > >    device ID, and expect the PaC to provide its IP
> > > > > address in return.
> > > > > > >    Similarly, IP addresses are used when the 
> EP(s) is not on 
> > > > > > > the same IP
> > > > > > >    subnet as the PaC is.
> > > > > > >
> > > > > > >    In other cases, MAC addresses are used as device
> > > > > identifiers when
> > > > > > >    they are available.
> > > > > > >
> > > > > > >    If the security protection established via PANA is
> > > > > neighter based
> > > > > > >    on the network layer nor on the link layer but 
> is provided by
> > > > > > >    lower layers outside PANA (e.g., physical security as
> > > > > provided by
> > > > > > >    some point-to-point links) then no device 
> identifier can be
> > > > > > >    exchanged within PANA messages.
> > > > > > > "
> > > > > > >
> > > > > > >
> > > > > > > ciao
> > > > > > > hannes
> > > > > > >
> > > > > > > > -----Urspr？ngliche Nachricht-----
> > > > > > > > Von: Alper Yegin [mailto:[email-masked]]
> > > > > > > > Gesendet: Freitag, 27. Januar 2006 00:56
> > > > > > > > An: Tschofenig, Hannes; 'Yoshihiro Ohba'; 'Hannes 
> > > > > > > > Tschofenig PANA-Issues'
> > > > > > > > Cc: [email-masked]
> > > > > > > > Betreff: RE: [Pana] Re: [issue229] Comments on 
> Device-ID 
> > > > > > > > choice
> > > > > > > >
> > > > > > > > > > > "
> > > > > > > > > > >    The device identifier used in the 
> context of PANA
> > > > > > > > can be an IP
> > > > > > > > > > >    address, a MAC address, or an 
> identifier that is 
> > > > > > > > > > > not
> > > > > > > > > > carried in data
> > > > > > > > > > >    packets but has local significance in 
> identifying 
> > > > > > > > > > > a
> > > > > > > > > > connected device
> > > > > > > > > > >    (e.g., circuit id, PPP interface id).  
> The last 
> > > > > > > > > > > type of
> > > > > > > > > > identifiers
> > > > > > > > > > >    are commonly used in point-to-point 
> links where 
> > > > > > > > > > > MAC
> > > > > > > > > > addresses are not
> > > > > > > > > > >    available and lower-layers are already 
> physically or
> > > > > > > > > > >    cryptographically secured.  
> Identifiers that are 
> > > > > > > > > > > not
> > > > > > > > related to
> > > > > > > > > > >    physical or cryptographic security 
> (e.g., session
> > > > > > > > identifiers in
> > > > > > > > > > >    PPP tunneling protocols) are not used as device
> > > > > > > identifiers.
> > > > > > > > > > > "
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > I'm not sure if this last sentence really helps. It
> > > > > does not
> > > > > > > > > > really give any guidance.
> > > > > > > >
> > > > > > > > > what guidance would you like to see, alper?
> > > > > > > >
> > > > > > > > I'm not after any particular guidance or message. It's
> > > > > just that
> > > > > > > > reading the above sentence did not really clarify what
> > > > > cannot be a
> > > > > > > > device identifier.
> > > > > > > >
> > > > > > > > When I read it again, now I found it confusing 
> too. On one
> > > > > > > side we are
> > > > > > > > talking about "device identifiers", and on the other
> > > > > side we are
> > > > > > > > talking about "identifiers related to physical or
> > > > > crypto security".
> > > > > > > >
> > > > > > > > I don't know what (if anything?!?) we should 
> say here. But
> > > > > > > the current
> > > > > > > > text is not good, imho.
> > > > > > > >
> > > > > > > > Alper
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > >
> > > > > > > > > i had problems understanding the initial 
> review comments.
> > > > > > > > >
> > > > > > > > > so, what sort of info should we deliver 
> (without trying 
> > > > > > > > > to
> > > > > > > > write the text
> > > > > > > > > already in a specification type of style)?
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > > _______________________________________________
> > > > > > > Pana mailing list
> > > > > > > [email-masked]
> > > > > > > https://www1.ietf.org/mailman/listinfo/pana
> > > > > > >
> > > > > >
> > > > > > _______________________________________________
> > > > > > Pana mailing list
> > > > > > [email-masked]
> > > > > > https://www1.ietf.org/mailman/listinfo/pana
> > > > > >
> > > > > >
> > > > >
> > > >
> > > >
> > 
> > 
> > 
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana