Subject: Issue5: Updating the device identifier

From: Alper Yegin <[email-masked]>
Date: Thu, 07 Aug 2003 15:01:15 -0700

As presented at IETF 57, the only valid case identified that requires a DI
change is this:

- A PaC performs PANA, configures an IP address via DHCP, binds the IP
address to PANA session, performs IKE for IPsec-based access control.

Needless to say, one wouldn't do this if physical security or L2 ciphering
capability is available in the network. A L2 address can be used as DI, we
won't need to use IKE or IPsec. This above is a very particular case where
IPsec-based access control is used and the clients are not allocated IP
address before they are authenticated. Unauthenticated hosts are allowed two
types of traffic: PANA and DHCP. DHCP is secured by some means (pending DHCP
WG's solution).

Proposed solution was to handle this case by allowing PaC to send its new DI
(i.e., the IP address obtained from DHCP) via PANA-reauth message. The new
DI overwrite the previous one (0::0, or 0.0.0.0 in this case).

Unless there is any objection, let's move forward with this solution.

Comments please.

Alper