Subject: [pcp] issue#60: Loosely coupled vs. tightly coupled authentication

From: Alper Yegin <[email-masked]>
Date: Mon, 5 Nov 2012 13:12:37 +0200

Let me summarize my thoughts on each of these outstanding issues….

First of all, the issue description has lot of problems. See further below for more specifics… 
Nevertheless, here's what I can say about the essence of this discussion:

- EAP session lifetime, EAP session keys lifetime, hence PCP SA (security association) lifetime are all driven by the AAA server.
- The state created by the execution of PCP (i.e., NAT mappings, firewall rules) may have a lifetime different than the PCP SA lifetime. Such state's lifetime may be initially set to PCP SA lifetime (and may be not). Their lifetime may be extended or cut-down by actors other than PCP, without any coordination with the PCP SA lifetime. These are all scenario specific. I think all we can really say is, anything is possible. 

Coming back to the flaws in the issue description:

Loosely coupled: 
– Authentication needed only at the time of a request, to create/modify a mapping. 

Alper> Authentication of the end-point (the ID that gets authenticated via EAP) is what this text must be referring to.
Alper> There's also the "origin authentication for PCP packets (+ integrity and replay protection). 
Alper> Gotta be specific about which authentication we are talking about.
Alper> Since PCP server can be sending unsolicited messages updating the PCP client, that also needs to be taken into account.

– Authorization done separately, using the same mechanism as in non-authenticated PCP 

• Mappings are removed when authorization is revoked 

Alper> I have no idea what these two lines really mean. 

– Mapping lifetime is not tied to authentication lifetime

Alper> Good, this makes sense as the definition of "loosely coupled". 

Tightly coupled: 

– Authentication and authorization are performed using the same mechanism, or there is a link between them 

Alper> There's always. There's a corner case where AAA server authenticates the user, and the PCP server has a database mapping user IDs to authorization parameters. That way you can say AAA authenticates the user, PCP server authorizes the user. But that's such a corner case. Typically, user IDs (with credentials to authenticate) and the mapping to authorization parameters are maintained by the AAA server (remember the second A in that acronym).

– Mapping lifetime is tied to authentication lifetime

• Mappings are removed when keys expire OR authorization is revoke

Alper