Subject: RE: [Pana] PANA and lower layer ciphering

From: "Salowey, Joe" <[email-masked]>
Date: Wed, 22 Jun 2005 08:34:44 -0700

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:[email-masked]] 
> Sent: Wednesday, June 22, 2005 5:08 AM
> To: Salowey, Joe
> Cc: Yoshihiro Ohba; Jari Arkko; [email-masked]
> Subject: Re: [Pana] PANA and lower layer ciphering
> 
> Hi Joe,
> 
> On Tue, Jun 21, 2005 at 08:17:46PM -0700, Salowey, Joe wrote:
> >  
> > 
> > > I think that we do not need to seperate the first and 
> second halves, 
> > > since each EP is uniquely identified by the address-family and 
> > > address pair and the pair is contained in Device-Id AVP.  We can 
> > > simply involve not only the address but also 
> address-family in the 
> > > computation of PaC-EP master keys, something like:
> > > 
> > > 
> > > PaC-EP-Master-Key = HMAC-SHA-1 (AAA-Key, "PaC-EP master key" |
> > >                                 Session ID | Key-ID | 
> EP-Device-Id)
> > > 
> > > (EP-Device-Id: the value field of Device-Id AVP)
> > > 
> > 
> > [Joe] This seems OK.  Just to clarify the device ID appears to be
> > optional ( this is OK, but you need to specify what to do 
> if it isn't
> > there).  
> 
> Why should device ID be optional?  I would assume that every EP that
> is capable of ciphering has a device id, except for PPP EP.  So are
> you considering bootstrapping PPP encryption from PANA?

[Joe] The wording in the spec indicated that it was optional.  I expect
that in many cases where there is interest in this information it would
be included.  I would also expect that there would be cases where it may
not be available or required. I hadn't considered bootstrapping PPP
encryption from PANA, but I suppose it's possible. 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 22 Jun 2005 13:33:10 -0400

> encryption from PANA, but I suppose it's possible. 

Device-Id is not optional when L2/L3 ciphering is bootstrapped from PANA:

"
   The PANA-Bind-Request and the PANA-Bind-Answer message exchange is
   also used for binding device identifiers of the PaC and EP(s)to the
   PANA SA.  To achieve this, the PANA-Bind-Request message MUST contain
   the device identifier in a Device-Id AVP for each EP if a Protection-
   Capability AVP is included in the message.  
"

When L2/L3 ciphering is not bootstrapped from PANA, Device-Id is
optional but in this case, there is no need to have PaC-EP master
keys.

The quoted text also means that bootstrapping PPP ciphering is
currently not supported.  If we want to support it, we might need to
change the wording "MUST" to "SHOULD" with stating the exceptional
case for PPP.

Yoshihiro Ohba