Subject: [Pana] Issue 137: Clarify lifetimes (keys, SA)

From: Alper Yegin <[email-masked]>
Date: Wed, 08 Dec 2004 15:06:09 -0800

http://danforsberg.info:8080/pana-issues/issue137

I'll put lifetimes of AAA-Key-int and AAA-Key-new aside. These are
likely to be removed from the spec.

Otherwise, we have most of what is needed in the latest text. Please
see:

11.1

   The lifetime of the PANA SA is bounded by the AAA-authorized session
   lifetime with an additional tolerance period.  Unless PANA state is
   updated by executing another EAP authentication, the PANA SA is
   removed when the current session expires.

11.5

   The PANA SA lifetime is bounded by the AAA-Key lifetime.  Another
   execution of EAP method yields in a new AAA-Key, and updates the PANA
   SA, PANA_MAC_KEY and key ID. 

   ...

   The lifetime of PaC-EP master key is bounded by the lifetime of the
   PANA SA.  This key may be used with a secure association protocol
   [I-D.ietf-ipsec-ikev2] to produce further cipher-specific and
   transient keys.

For more clarity:

Replace (in 5.3):

   The created PANA SA is deleted when the corresponding PANA session is
   deleted.  The lifetime of the PANA SA is the same as the lifetime of
   the PANA session for simplicity.

With:

   PANA session lifetime is bounded by the lifetime granted by the
   authentication server (same as AAA-Key lifetime). The lifetime of the
   PANA SA (hence the PANA_MAC_KEY) is the same as the lifetime of
   the PANA session. The created PANA SA is deleted when the
corresponding
   PANA session is deleted.

Also, replace (in 11.1)   

   The lifetime of the PANA SA is bounded by the AAA-authorized session
   lifetime with an additional tolerance period.  Unless PANA state is
   updated by executing another EAP authentication, the PANA SA is
   removed when the current session expires.

With:

   The lifetime of the PANA SA is set to PANA session lifetime which
   is bounded by the lifetime granted by the authentication server. An
   implementation MAY add a tolerance period to that value. Unless 
   PANA state is updated by executing another EAP authentication, the 
   PANA SA is removed when the current PANA session expires.

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 07 Dec 2004 17:59:13 -0500

>    the PANA session. The created PANA SA is deleted when the

OK.

>    PANA SA is removed when the current PANA session expires.

I think "PANA state" is a little bit ambiguous.  How about this?

"
     The lifetime of the PANA SA is set to PANA session lifetime which
     is bounded by the lifetime granted by the authentication server. An
     implementation MAY add a tolerance period to that value. Unless the 
     PANA session lifetime is extended by executing another EAP
     authentication, the PANA SA is removed when the current PANA
     session expires.
"

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Thu, 09 Dec 2004 10:57:07 -0800

Taking Yoshi's comment into account:

For more clarity:

Replace (in 5.3):

With:

Also, replace (in 11.1)   

With:

   The lifetime of the PANA SA is set to PANA session lifetime which
   is bounded by the lifetime granted by the authentication server. An
   implementation MAY add a tolerance period to that value. Unless 
   PANA session is extended by executing another EAP authentication, the

   PANA SA is removed when the current session expires.

Alper

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:[email-masked]]
> Sent: Tuesday, December 07, 2004 2:59 PM
> To: Alper Yegin
> Cc: [email-masked]
> Subject: Re: [Pana] Issue 137: Clarify lifetimes (keys, SA)
> 
the

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 07 Dec 2004 20:45:42 -0500

Looks good, thanks.

Yoshihiro Ohba