Subject: [Pana] Review of draft-ietf-pana-preauth-04

From: Victor Fajardo <[email-masked]>
Date: Tue, 20 Jan 2009 16:25:47 -0500

The document is in good shape. I just have a few minor comments inline:

3.  Pre-authentication Procedure

   A PaC that supports pre-authentication may establish a PANA session
   for each CPAA.

[Victor: /for each CPAA/for each CPAA in the domain that it intends to move to./s]

   There may be a number of criteria for CPAA selection, the timing to
   start pre-authentication and the timing to make a pre-authorization
   SA a post-authorization SA (and hence the CPAA becomes the SPAA).
   Such criteria can be implementation specific and thus are outside the
   scope of this document.

[Victor: Is the paragraph describing the scenario where pre-authz may not yet be complete before handover occurs ? and therefore it should select the CPAA carefully ? ]

   o  Once the PaC and CPAA have agreed on performing pre-authentication
      using the 'S' (Start) and 'E' (prE-authentication) bits, the
      subsequent PANA messages exchanged between them MUST have the 'E'
      (prE-authentication) bit set.

[Victor: Does this also include Re-Authentication between PaC and CPAA (in case re-authentication occurs before handover ?]

   If there is another CPAA with which the PaC has a pre-authorization
   SA and the PaC wants to keep the pre-authorization SA after the
   change of SPAA, the PaC also performs an IP address update procedure

[Victor: /the PaC also performs/the PaC may also preform/s]

5.  Authorization and Accounting Considerations

   A pre-authorization and a post-authorization for the PaC may have
   different authorization policies.  For example, the pre-authorization
   policy may not allow the PaC to sent or receive packets through an

[Victor: Is it better to say: s/sent or receive packets/send or receive data packets/, so as not to include PANA messages in the EP filter ?]

   Enforcement Point (EP) that is under control of the CPAA, while both
   the pre-authorization and post-authorization policies may allow
   installing credentials to the EP, where the credentials are used for
   establishing a security association for per-packet cryptographic
   filtering.

   In an access network where accounting is performed, accounting starts
   when the pre-authorization SA becomes the post-authorization SA by
   default.  Depending on the pre-authorization policy, accounting may

[Victor: s/Depending on/However, depending on/

   start immediately after the pre-authorization SA is established.

   When pre-authentication is initiated by a CPAA, it is possible that
   the PaC simultaneously communicates with multiple CPAAs initiating
   pre-authentication.  In order to avoid possible resource consumption
   attacks on the PaC caused by a blind attacker initiating pre-
   authentication for the PaC by changing source addresses, the PaC
   SHOULD limit the maximum number of CPAAs allowed to communicate.

[Victor: Would it also be useful to mention that such an attack is possible on the CPAA side ?]

regards,
victor

_______________________________________________
Pana mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pana