Subject: [Pana] Protection-Capability: AVP vs Flag

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 24 Jun 2005 13:05:49 -0400

In the current specification, we have Protection-Capability AVP to
indicate whether L2 or L3 ciphering needs to be enabled.  On the other
hand, the address family that is encoded in the Data field of
Device-Id AVP can be used as an indication of ciphering layer.  In
this case, we might consider defining Protection-Capability as a flag
in PANA header rather than an AVP.

This will also allow the scenario where one EP on an IP link does L2
ciphering while another EP on another IP link does L3 ciphering in the
realm of the same PAA, if the deployment wants to do that.

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Mon, 27 Jun 2005 14:07:21 -0700

Yoshi,

> in PANA header rather than an AVP.

The mapping between the DI and Protection-capability is not one-to-one.
An IP address DI may be used by an IPsec-based EP, or an EP multiple
hops away from the PaC.

> realm of the same PAA, if the deployment wants to do that.

We had agreed that this has issues. So, I don't think we need to make an
extra effort to enable this usage.

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 27 Jun 2005 16:45:19 -0400

> An IP address DI may be used by an IPsec-based EP, or an EP multiple

Yes, EP may be carried even when per-packet ciphering is not
bootstrapped from PANA.

> extra effort to enable this usage.

We agreed that this has issues when L2 and L3 ciphers are mixed on the
same IP link, but I am not sure this has issues when L2 and L3 ciphers
are mixed on the differnet IP links.  For example, I don't see much
difference in the following cases in terms of security characteristics
between PaC and EPs.

Case 1 (single-hop PAA):

[L2-ciphering EP on IP link X]/PAA---+
                                      \
                                    Router--(Internet)
                                      /
[L3-ciphering EP on IP link Y]/PAA---+

Case 2 (multi-hop PAA):

[L2-ciphering EP on IP link X]----+
                                   \
                                 Router/PAA--(Internet)
                                   /
[L3-ciphering EP on IP link Y]----+

Should we rule out Case 2?  

(I personally think that it might be simpler to use L3 ciphering for
both links in Case 2, but I'm not sure whether deployment always
allows it.)

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Tue, 28 Jun 2005 16:01:03 -0700

> both links in Case 2, but I'm not sure whether deployment always

For simplicity, I personally prefer not dealing with this. We shall not
be enabling all possible combination of scenarios, unless they are
justified.

Alper