Subject: Ciphering choice

From: Alper Yegin <[email-masked]>
Date: Mon, 04 Aug 2003 13:21:12 -0700

Some of the discussions around the choice of device identifier for Pac is
stemming from the choice of ciphering. If L2 ciphering will be used, than
the L2 address must be the DI. If L3 ciphering will be used (i.e., IPsec),
then the DI must be an IP address.

Two questions: 
a) Does it make sense to leave the selection to PaC, or should PAA mandate
which ciphering should be used?
b) Does it make sense to enable both L2 and L3 ciphering at the same time?

Based on the earlier discussions, in my personal opinion, the ciphering
selection should be based on the access network policy. Hence, this is not
something for the PaC to decide. I'd say PAA should mandate, and PaC should
obey the decision.

As for (b), it was not clear whether this is something needed and useful. In
order to bind the client authentication to data traffic, one is sufficient.

I recommend we let PAA specify which one of the two ciphering mechanisms
will be used (L2 vs. L3), PaC has to obey or leave the network, and the
device IDs are chosen accordingly.

Comments?

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 04 Aug 2003 15:22:47 -0700

> something for the PaC to decide. I'd say PAA should mandate, and PaC should

Agreed.

> order to bind the client authentication to data traffic, one is sufficient.

Now I don't mind binding the client authentication to either L2 or L3
ciphers, because there was not much support for bootstrapping both
ciphers from PANA.

> device IDs are chosen accordingly.

OK.

> Alper

Yoshihiro Ohba