Subject: [pcp] comments on Margaret's slides

From: Alper Yegin <[email-masked]>
Date: Fri, 9 Nov 2012 16:18:27 +0200

Let me highlight important issues with Margaret's slides, in preparation for the meeting.

PCP entities that do not implement PCP Authentication will see these packets as having an unsupported version number

– Errors will go back to PCP client in this case, not to PANA client

– An unspecified capability discovery mechanisms mandated to avoid this situation 

Alper> Well, version -03 does define this. So, there is no issue such as seeing an unsupported version being used. If the PCP server does not support auth, it'll not be used.

Alper> Regarding re-authentication timelines, it seems like you chose very low lifetime to illustrate the issue. I'm familiar with EAP session lifetimes such as 24hr, 80hr, etc. in network access application. Not sure how realistic the short lifetimes you picked.

PANA Model

Requires support for server-generated requests

–  To support server-initiated re-authentication and retransmissions

Alper> If "server-initiated re-auth" is deemed unnecesary, we can state that it shall/should not be used when PANA is used for PCP. This is trivia.

Alper> Besides, I don't understand what the issue is. If PANA requires rexmits, etc, it's PANA's business. It has no implication on the PCP implementation. 

–  To support “liveness” detection

Alper> We can disable that too. It's not a must-use for PANA operation. It's just one of the features.

–  Alternative is to update PANA to remove these things

Alper> Nope. All we need is, for anything that we don't want to see happen, we state so in the PCP spec. "When PANA is used for PCP auth, PANA ping shall not be used", etc.

Authentication and authorization tightly coupled – Supports ability to drop mappings immediately when

authentication expires

Alper> Both loosely and tightly coupled is possible with PANA.

Clients need to remain active on the network to retain their mappings

– Mappings are removed if the client goes away or fails to respond to re-authentication requests 

       Alper> Again, if we don't want this to happen on any deployment, or on select deployments, we can clearly state so. It's not like PANA does not work if PAA-intiated re-auth is not used.

Some/many of these feedback is repeat from past discussions. Please take them into account.

Alper