Subject: [Pana] pana-preauth Issue 243 (take 2)

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 01 Mar 2006 15:41:37 -0500

Here is the revised text based on Sasikanth's comment.

[1] In Section 3,

change:

"
   At some point after establishing the pre-authentication SA, the PaC
   moves to the access network of the r-PAA.  Then the PaC initiates a
   PANA-Update exchange to inform the PAA of the IP address change.  In
   this PANA-Update exchange, the P-bit is unset.  On successful
   completion of the PANA-Update exchange and post-authorization
   procedure, the pre-authentication SA becomes the active SA.  The
   active SA between the PaC and l-PAA may stay active for a while to
   deal with the case in which the PaC immediately switches back to the
   previous access network.
"

to:

"

   At some point after establishing the pre-authentication SA, the PaC
   moves to the access network of the r-PAA.  The r-PAA may be found
   by running PAA discovery over a newly created session or
   immediately when the PaC attaches a link-layer device that is
   acting as an EP whose device identifier was contained in the list
   of EP device identifiers advertised by the r-PAA in the
   pre-authentication procedure.  If the r-PAA is found, the PaC
   initiates a PANA-Update exchange over the session in which the
   pre-authentication SA has been maintained to inform the PAA of the
   IP address change.  In this PANA-Update exchange, the P-bit is
   unset.  On successful completion of the PANA-Update exchange and
   post-authorization procedure, the pre-authentication SA becomes the
   active SA.  The active SA between the PaC and l-PAA may stay active
   for a while to deal with the case in which the PaC immediately
   switches back to the previous access network.

   If no such an r-PAA is found but other PAA(s) in the new access
   network, a full PANA authentication or PANA mobility optimization
   may be performed between the PaC and one of those PAA(s) based on
   the procedures described in [I-D.ietf-pana-pana] and
   [I-D.ietf-pana-cxtp].
"

[2] In Section 5,

change:

"
   A pre-authorization and a post-authorization for the PaC may have
   different authorization policies.  For example, the pre-authorization
   policy may not allow the PaC to sent or receive packets through the
   EP(s) under control of the preparing PAA, while both the pre-
   authorization and post-authorization policies may allow installing
   credentials to the EP(s), where the credentials are used for
   establishing a security association for per-packet cryptographic
   filtering.
"

to:

"
   A pre-authorization and a post-authorization for the PaC may have
   different authorization policies.  For example, the pre-authorization
   policy may not allow the PaC to sent or receive packets through the
   EP(s) under control of the preparing PAA, while both the pre-
   authorization and post-authorization policies may allow installing
   credentials to the EP(s), where the credentials are used for
   establishing a security association for per-packet cryptographic
   filtering.  Different PANA session lifetimes may be
   used for pre-authorization and post-authorization.

   Before the lifetime of the PANA session for a pre-authentication SA
   expires, re-authentication MAY be performed for the session using
   the re-authentication procedure defined in [I-D.ietf-pana-pana].
"

Regards,
Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana