Subject: [Pana] status of wg documents

From: Jari Arkko <[email-masked]>
Date: Wed, 03 Jun 2009 14:21:27 +0300

Draft-ietf-pana-statemachine: this draft went through the IESG review, 
and the current version actually satisfies all concerns from the IESG; 
the main issue that was raised was how the machine deals with EAP state 
machine silently discarding messages. Both me and the Discussing AD 
(Pasi) are happy with the latest revision in this respect, but we have 
an ongoing discussion with Alper about whether the chosen solution 
should do something else. I will send a separate e-mail about this.

Draft-ietf-pana-ipsec: what's up with this? If I remember correctly, we 
talked about finding an editor and there were some volunteers. Has a 
decision been reached on who is doing the edits? Secondly, we talked 
about what needs to be done with the draft, and at least one issue was 
identified about the selection of keys. I have not seen a conclusion 
from this thread, nor any updates to the draft. Are we ready to make the 
conclusion, or is more discussion needed? Can people go through the 
draft identify other remaining issues?

Jari

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 3 Jun 2009 18:50:00 +0700

Jari Arkko [mailto://[email-masked]] writes:

...

> Draft-ietf-pana-ipsec: what's up with this? 

I was wondering the same thing.

> If I remember correctly, we
> talked about finding an editor and there were some volunteers. 

I believe that I was one of them.

> Has a

---

From: <[email-masked]>
Date: Fri, 5 Jun 2009 17:57:04 +0200

Hi Jari,

> draft identify other remaining issues?

Regarding this I-D, I do not believe there is sufficient interest or energy
to complete the work. Hence rather than being bogged down in the process of
updating the I-D and progressing it, it would be best to drop this I-D from
the WG charter and let it expire. I will send another note to the ML and
ensure there is consensus on this decision.

-Raj

> 
> Jari
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pana

---

From: "Glen Zorn" <[email-masked]>
Date: Sat, 6 Jun 2009 11:08:04 +0700

[email-masked] writes:

> to complete the work. 

That's an interesting statement.  Upon what evidence is it based: the fact
that at least one person volunteered to edit the draft?  Perhaps the
apparently general agreement that there are no major technical issues with
it & that all the changes needed are editorial (the only technical issue I
could find was one w/Yoshi's key derivation draft, successfully quashed by
Alper)?

> Hence rather than being bogged down in the
> process of
> the WG charter and let it expire. 

I could have sworn that being thus "bogged down" was the major purpose of
IETF WGs!  

> I will send another note to the ML
> and

I think you already did, or will I need to recapitulate this response?

---

From: <[email-masked]>
Date: Mon, 8 Jun 2009 23:20:20 +0200

Hi Glen,

Your willingness to take on the editorship of this I-D had been noted.
However here are a few reasons why I think it is better to drop working on
this I-D:
1. The I-D has not been revised since 2005. It is not just editorial
corrections that need to be made. The base protocol itself has evolved quite
a bit since 2005. Additionally there were review comments received in 2005
which were never addressed. And from my recollection, these were not just
editorial ones.

2. I do not expect to receive reviews from WG members even if the I-D were
to be updated. Hence taking a document to the IESG for publication without
sufficient reviews is futile.

3. The WG is better off using whatever cycles of energy are left on
completing any other I-Ds which are considered more useful w.r.t PANA.

As I have said in an earlier email, I do not see IPsec essentially being
used as a means to secure the access link (between the PaC and EP). Either
the link technology itself has its own security mechanism or the client
simply uses IPsec VPNs if security is desired. There is no real
justification for this solution now. This conclusion is derived from
discussions and work over the past few years in PANA.

-Raj

---

From: "Glen Zorn" <[email-masked]>
Date: Tue, 9 Jun 2009 10:59:23 +0700

[email-masked] [mailto:[email-masked]] writes:

...

> simply uses IPsec VPNs if security is desired. 

Fair enough, though you leave out what is by far the most popular option (in
the absence of a standard): none.  However, I'm much more interested in the
security of the PAA-EP link.  RFC 5191 says that 

   The protocol exchange between the PAA and EP for provisioning authorized
PaC information on the EP must be protected for authentication, integrity,
and replay protection.

but I can't find anything in any document that says how to do this.  What am
I missing?

...

---

From: <[email-masked]>
Date: Tue, 9 Jun 2009 17:28:26 +0200

Hi Glen,

> PaC information on the EP must be protected for authentication, integrity,

We had a pretty lengthy discussion about this. The PAA/EP can be colocated
or could be separate. In the case where the PAA/EP are separate, the link
needs to be secured. The conclusion (in the WG) was that the security
mechanism between the PAA and EP is a choice of the deployment and hence
does not need to be specified.
> but I can't find anything in any document that says how to do this.  What am

Does the above explanation help?

-Raj

---

From: Jari Arkko <[email-masked]>
Date: Tue, 09 Jun 2009 19:29:34 +0300

To avoid just running a yes - no argument, it might be helpful to 
remember what the original poll on the mailing list resulted in. As far 
as I could tell, there were three people expressing interest to the 
draft and/or willingness to help, and a bunch of other people who seemed 
mostly focused on what key usage is appropriate in general.

Not an overwhelming statement of support.

Of course, we don't have an absolute bar for sufficient interest, but 
its certainly food for thought. Glen, are there some circumstances that 
would speak in favor of doing this work? Implementations? Deployments? 
Adoption for some special purpose situation? Interest from people who we 
have not seen on the list?

Jari

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 10 Jun 2009 12:56:50 +0700

> does not need to be specified.

That's rather bizarre; the ADs are OK with this?

> Does the above explanation help?

Quite clarifying, thank you.

---

From: Jari Arkko <[email-masked]>
Date: Wed, 10 Jun 2009 10:35:55 +0300

Glen,

>> The conclusion (in the WG) was that the security

Frankly, I'm not thrilled about it. Generally speaking this sort of 
thing should be a part of our specifications. However, as I noted in the 
other e-mail, the overall level of effort and interest on the IPsec 
document is not very high. You could say that I'm equally unhappy with 
both of the possible outcomes...

Jari

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 10 Jun 2009 14:57:36 +0700

Jari Arkko [mailto:[email-masked]] writes:

> document is not very high. 

Well, the IPsec draft talks about securing the entire path from the PaC to
the EP.  I guess if the consensus is to use link-layer security (802.11?
How would this work id the PAA & EP aren't co-located?) or a VPN (From the
PaC to the EP?  How would this work at all?) that may be fine, but unless
I'm terribly mistaken (always a possibility!) the PAA-EP link is actually
part of the PANA infrastructure in the access network & it seems very odd
that we would leave it w/no specified method of protection...

> You could say that I'm equally unhappy with

---

From: Julien Bournelle <[email-masked]>
Date: Wed, 10 Jun 2009 11:28:06 +0200

Hi glen all,

> That's rather bizarre; the ADs are OK with this?

At a time of PANA specification, a huge work happened to simplify the PANA
protocol and its companions documents. (see:
http://www.ietf.org/mail-archive/web/pana/current/msg02261.html)

We had a proposal based on SNMPv3 (
http://tools.ietf.org/html/draft-ietf-pana-snmp-06) to implement the
PAA-to-EP protocol which has been finally rejected as mentionned by Raj.

 My 2 cents,

 Best regards,

 Julien

---

From: <[email-masked]>
Date: Wed, 10 Jun 2009 21:43:00 +0200

Hi Glen,

> that we would leave it w/no specified method of protection...

The intent of the IPsec SA was to secure the user plane traffic. The I-D
says:
"   The IPsec security association protects the traffic between the PaC
   and EP. In IPsec terms, the EP is a security gateway (therefore a
   router) and forwards packets coming from the PaC to other nodes.
"

It is true that the PAA is part of the PANA infrastructure. And as Julien
mentioned as well, there was discussion about specifying SNMP as the
protocol between PAA and EP which was rejected.  The WG decided to leave the
protocol between PAA/EP and the security for the same unspecified. In case
of the PAA/EP being separate, the deployment can establish an IPsec SA for
securing the signaling between the two (it depends on the deployment model
and in case where the PAA/EP are within the same domain for example it may
not be necessary). PANA does not have to specify it.

The operation of PANA itself is not constrained by not having an IETF
specified method for securing the PAA/EP signaling when they are separate. A
recommendation that the link needs to be secure is sufficient.

-Raj