Subject: [Pana] Issue 133: Clarify stateless

From: Alper Yegin <[email-masked]>
Date: Wed, 01 Dec 2004 11:53:11 -0800

http://danforsberg.info:8080/pana-issues/issue133

The following text is already added to the pana-07a to clarify what
stateless PAA discovery is (so, no actions required for first part):   

   A PANA-Start-Request message MAY carry a Cookie AVP that contains a
   cookie.  The cookie is used for preventing the PAA from resource
   consumption DoS attacks by blind attackers which bombard the PAA with
   PANA-PAA-Discover messages.  By relying on a cookie mechanism the PAA
   can avoid per-PaC state creation until after the PaC can produce the
   same cookie in its PANA-Start-Answer message.  In order to do that,
   the cookie MUST be computed in such a way that it does not require
   any per-session state maintenance on the PAA in order to verify the
   cookie returned in a PANA-Start-Answer message.  The PAA discovery
   that takes advantage of cookies is called "stateless PAA discovery".
   The exact algorithms and syntax used for generating cookies does not
   affect interoperability and hence is not specified here.

For the second part, replace (in 4.2):

   Initial EAP Request MAY be optionally carried by the
   PANA-Start-Request (as opposed to by a later PANA-Auth-Request)
   message in order to reduce the number of round-trips.  This
   optimization SHOULD NOT be used if the PAA discovery is desired to be
   stateless.

With:

   Initial EAP Request MAY be optionally carried by the
   PANA-Start-Request (as opposed to by a later PANA-Auth-Request)
   message in order to reduce the number of round-trips.  This
   optimization SHOULD NOT be used if the PAA discovery is desired to be
   stateless since transmission of an EAP request creates state at EAP
   layer [I-D.ietf-eap-statemachine].

Comments welcome.

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana