Subject: [Pana] Review of draft-ietf-pana-pana-06

From: Giaretta Gerardo <[email-masked]>
Date: Thu, 28 Oct 2004 19:00:43 +0200

Hi Alper and Yoshi,

I have some comments about PANA protocol draft.

Two general comments: 

1. the draft specifies that there must be one hop between PaC and PAA.
This is not mentioned in section 3 (Introduction) and only in section
4.1 this is mentioned and partially motivated for the first time. I'd
suggest to write this requirement also in section 3. Moreover I have not
found in any PANA document a complete explanation of the reasons of this
choice (nor in draft-ietf-pana-requirements-09 where this requirement is
introduced). I think these reasons should be better explained in a PANA
WG document (which one? PANA framework?): in particular, this is
important since draft-tschofenig-mip6-bootstrapping-pana-00 proposes to
relax this assumption (even though in a complete different scenario).

2. I think the draft lacks of enough considerations about lifetimes of
PANA session, of PANA SA and of the keys defined in the draft (i.e.
PANA_MAC_KEY, AAA-key-int, AAA-key-new). For example, it's not clear to
me which are the relationships between the AAA-key lifetime and the PANA
session lifetime and the PANA SA lifetime. In the draft it is stated
that "The lifetime of the PANA SA is the same as the lifetime of the
PANA session for simplicity" (section 5.6) and "The PANA SA lifetime is
bounded by the AAA-Key lifetime.  Another execution of EAP method yields
in a new AAA-Key, and updates the PANA SA, PANA_MAC_KEY and key ID"
(sec. considerations section). Does it mean that (PANA session
lifetime)=(PANA SA lifetime)=(AAA-key lifetime)? 
Moreover, which are the lifetimes of PANA_MAC_KEY, AAA-key-int and
AAA-key-new? Is it equal to the AAA-key lifetime? I think something
about this should be mentioned.

Some other (more detailed) comments:

- there are some terms used in the draft that are not defined in the
terminology section (Pre PANA Address, Post PANA Address, IPsec Tunnel
Inner Address, etc.). Since most of them are defined in PANA framework
terminology section, maybe it could be useful to have a reference to it
in the terminology section of PANA draft.

- section 3, bullet 2: the term ISP is not introduced, nor the
difference between NAP and ISP authentication. Maybe a possibility could
be to introduce ISP in the terminology section or include here a refence
to PANA framework.

- section 3, figure 1: I'd suggest to specify that this is an example in
case of a 1 RTT EAP method.

- section 4.1, first paragraph: it would seem that the only reason to
have PaC and PAA one hop away is the discovery process. I would suggest
to add a paragraph in introduction in order to state the motivations of
this choice or as, I stated before, introduce some text in PANA
framework and reference to it.

- section 4.1, figure 3: the figure shows that a L2 trigger at the EP
could trigger PANA protocol. This is certainly true, but there is not
any reference to this in the text. I'd suggest to add some text at the
end of paragraph 3, page 10.

- section 4.2, paragraph 2: "When an EAP Success/Failure message is sent
from a PAA, the message is carried in a PANA-Bind-Request (PBR)
message". This is not completly true because in case of separate NAP/ISP
authentication EAP Success/Failure message can be carried also in a
PFER. I'd suggest to add this comment in text. This is useful also
because, in paragraph 3, PFER and PFEA are mentioned together with PBR
and PBA.

- section 5.1 Provider-ID-AVP and Provider-Name-AVP are lacking. Is it
your choice? 

- section 5.1, bullet 8: this bullet partially repeats what is specified
in bullet 3. Remove bullet 3?

- section 5.6: which is the reason to repeat the Key-Id AVP also in PBA?

- section 5.10, paragraph 2: "PAA should initiate EAP authentication
before the current session lifetime expires". Maybe
s/authentication/reauthentication?

- I don't understand the reason of section 6.1. It does not specify any
protocol details and it repeats a lot of details previously described.
Moreover it sounds like a "second" security consideration sectio.n

- section 6.2: CTP requires the usage of CTAR in order to trigger and
authorize the transfer. This means that the MN (PaC) has an active role
and CTP operations cannot be performed only by PAAs as suggested in this
section. This issue is tackled deeply in draft-bournelle-pana-ctp-01.
Maybe it is a CTP issue and not a PANA one but I think this should be
mentioned in the draft when the reference to CTP is made. 
Another issue about the mobility handling is the need to communicate to
the AAA infrastructure the new NAS (PAA) to which the PaC is attached.
Again, maybe this is not directly a PANA issue but i think it should be
mentioned.

- section 8.2.1: there is still a reference to two sequence numbers.

- section 8.2.4: if EAP messages are not piggybacked, PARs can be sent
also by PaC. Same for section 8.2.5 and PAAs.   

Editorial nits:

- caption of figure 2: double space between Phase and when

- caption of figure 8: I'd suggest to add "triggered by PaC"

- section 5.5, bullet 3: double "in MAC or or IP header": s/or or/or
                                        
- section 8.2.9: s/PANA-Result-Request/PANA-Bind-Request

- section 8.3.18: "The IP-Address (AVP Code 18) contains an IP address
of n a PaC or PAA": s/of n a PaC/of a PaC

- section 10.1: ")" is lacking

Regards,

--Gerardo

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to
[email-masked]. Thank you
====================================================================

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana