Subject: [Pana] issue116: resolution

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 06 Dec 2004 15:28:09 -0500

Change the following text in section 4.3 of pana-pana-07a:

"
   The PANA-Bind-Request and the PANA-Bind-Answer message exchange is
   also used for binding device identifiers of the PaC and EP(s), and
   the IP address of the PAA to the PANA SA.  To achieve this, the
   PANA-Bind-Request SHOULD contain the device identifier(s) of the
   EP(s) in Device-Id AVP(s) when they are either MAC or IP address(es),
   and the IP address of the PAA in an IP-Address AVP.  PANA-Bind-Answer
   SHOULD contain PaC's device identifier in a Device-Id AVP when it is
   already presented with that of EP(s).  The PaC MUST use the same type
   of device identifier as contained in the PANA-Bind-Request message.
"

to:

"
   The PANA-Bind-Request and the PANA-Bind-Answer message exchange is
   also used for binding device identifiers of the PaC and EP(s), and
   the IP address of the PAA to the PANA SA.  To achieve this, the
   PANA-Bind-Request message MUST contain the device identifier(s) of
   EP(s) in Device-Id AVP(s) when a Protection-Capability AVP is
   included in the message.  When a Protection-Capability AVP is not
   included in the message, the device identifier is taken from the
   link-layer or the IP header of the message.  The PANA-Bind-Request
   message MUST also contain the IP address of the PAA in an
   IP-Address AVP.  The PANA-Bind-Answer message MUST contain the
   PaC's device identifier in a Device-Id AVP when it is already
   presented with that of EP(s) in the request with using the same
   type of device identifier as contained in the request.  If the
   PANA-Bind-Answer message sent from the PaC does not contain a
   Device-Id AVP with the same device identifier type contained in the
   request, the PAA sends a PANA-Error-Request message with a
   PANA_MISSING_AVP result code, and wait for a PANA-Error-Answer
   message to terminate the session. 
"

Change the following text in section 4.3 of pana-pana-07a:

"
   The PANA-Bind-Request message MAY also contain a
   Protection-Capability AVP to indicate if link-layer or network-layer
   ciphering should be initiated after PANA.  
"

to:

"
   The PANA-Bind-Request message with a PANA_SUCCESS result code MUST 
   also contain a Protection-Capability AVP to indicate if link-layer
   or network-layer ciphering should be initiated after PANA.
"

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 07 Dec 2004 15:27:20 -0800

Yoshi,

Here is what I think:

- DIs MUST be included when PPAC is included (which implies L2 or L3
ciphering will be enabled after successful PANA).
- DIs SHOULD be included when they have significance beyond the local
node (e.g., MAC or IP address)

And:

- Protection-Capability AVP is included only when L2 or L3 ciphering is
enabled after PANA -- that's, not always.

If you agree with these statements, we shall update the text
accordingly.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of
> Yoshihiro Ohba
> Sent: Monday, December 06, 2004 12:28 PM
> To: [email-masked]
> Subject: [Pana] issue116: resolution
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 07 Dec 2004 09:53:30 -0500

> ciphering will be enabled after successful PANA).

I guess "PPAC" should read "Protection-Capability".  I agree on the
rest of the statements.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 07 Dec 2004 11:16:55 -0500

Here is revised text.  Comments are appreciated.

---

"

to:

"
   The PANA-Bind-Request and the PANA-Bind-Answer message exchange is
   also used for binding device identifiers of the PaC and EP(s), and
   the IP address of the PAA to the PANA SA.  To achieve this, the
   PANA-Bind-Request message MUST contain the device identifier in a
   Device-Id AVP for each EP if a Protection-Capability AVP is
   included in the message.  Otherwise, the message SHOULD contain the
   device identifier in a Device-Id AVP for each EP when a link-layer
   or IP address is used as the device identifier of the PaC.  The
   PANA-Bind-Request message MUST also contain the IP address of the
   PAA in an IP-Address AVP.  The PANA-Bind-Answer message MUST
   contain the PaC's device identifier in a Device-Id AVP when it is
   already presented with that of EP(s) in the request with using the
   same type of device identifier as contained in the request.  If the
   PANA-Bind-Answer message sent from the PaC does not contain a
   Device-Id AVP with the same device identifier type contained in the
   request, the PAA sends a PANA-Error-Request message with a
   PANA_MISSING_AVP result code, and wait for a PANA-Error-Answer
   message to terminate the session.
"

"

to:

"
   The PANA-Bind-Request message with a PANA_SUCCESS result code MUST
   also contain a Protection-Capability AVP if link-layer or
   network-layer ciphering is enabled after the authentication phase.
"

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Tue, 14 Dec 2004 11:00:45 -0800

This looks good.

Alper

Of
> Yoshihiro Ohba
> Sent: Tuesday, December 07, 2004 8:17 AM
> To: Alper Yegin
> Cc: 'Yoshihiro Ohba'; [email-masked]
> Subject: Re: [Pana] issue116: resolution
>