Subject: Re: [Pana] Issue245: PANA and KDF

From: Sasikanth Bharadwaj <[email-masked]>
Date: Thu, 02 Mar 2006 14:09:38 +0530

Hi Yoshi
>
> The purpose of carrying the algorithm is just to avoid hard-coded key
> derivation and integrity algorithms, not to allow negotiation.
>
> We discussed this in the past for integrity algorithm for MAC (now
> AUTH) AVP.  We are just applying the same rule for KDF as well.
>
Maybe negotiation is the wrong word here. But shouldn't the
PaC be allowed to choose the algorithm it prefers when multiple algorithms
can be supported? Isn't this similar to the POPA configuration mechanisms?

Sasikanth

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 02 Mar 2006 09:56:31 -0500

> can be supported? Isn't this similar to the POPA configuration mechanisms?

The main purpose is to allow PANA implementations to implement other
algorithm if, in a future, the mandatory algorithm becomes not
reasonably strong, without necessarily changing the PANA specification
itself.

For an authentication protocol like PANA, benefit of having the
functionality to choose an algorithm compared to complexity to having
that functionality is not clear to me.  Rather I see a security issue
of bidding-down attack.

Yoshihiro Ohba