Subject: [Pana] pana-pana issue168: resolution

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 24 Jun 2005 17:55:47 -0400

I revised text based on Alper's comments:

[1] In section 4.3, change:

"
   The PANA-Bind-Request and the PANA-Bind-Answer message exchange is
   also used for binding device identifiers of the PaC and EP(s)to the
   PANA SA.  To achieve this, the PANA-Bind-Request message MUST contain
   the device identifier in a Device-Id AVP for each EP if a Protection-
   Capability AVP is included in the message.  Otherwise, the message
   SHOULD contain the device identifier in a Device-Id AVP for each EP
   when a link-layer or IP address is used as the device identifier of
   the PaC.
"

to:

"
   The PANA-Bind-Request and the PANA-Bind-Answer message exchange is
   also used for binding device identifiers of the PaC and EP(s) to
   the PANA SA.  To achieve this, if a Protection-Capability AVP is
   included in the PANA-Bind-Request message, the message MUST contain
   the device identifier in a Device-Id AVP for each EP.  
   Otherwise, if a Protection-Capability AVP is not included in
   the PANA-Bind-Request message, the message MUST contain the
   device identifier in a Device-Id AVP for each EP when a link-layer
   or IP address is used as the device identifier of the PaC.
"

[2] Add the following section 

"
5.X PaC-EP-Master-Key

As described in section 4.3, use of a cryptographic filtering
mechanism is indicated by inclusion of a Protection-Capability AVP in
the PANA-Bind-Request message in the authentication and authorization
phase.  In this case, a PaC-EP-Master-Key is derived from the
AAA-Key for each EP and used by a secure association protocol for
bootstrapping link-layer or IPsec ciphering betweeen the PaC and EP.
The PaC-EP-Master-Key derivation algorithm is defined as follows.

PaC-EP-Master-Key = HMAC-SHA-1 (AAA-Key, "PaC-EP master key" |
                                Session ID | Key-ID | EP-Device-Id)

EP-Device-Id is the Data field of the Device-Id AVP for the
corresponding EP.
"

[3]  In section 10.5, change:

"
   When link-layer or network-layer ciphering [I-D.ietf-pana-ipsec] is
   enabled as a result of successful PANA authentication, a separate
   PaC-EP master key is generated based on the AAA-Key, session
   identifier, key identifier, and EP device identifier.
"

to:

"
   When link-layer or network-layer ciphering [I-D.ietf-pana-ipsec] is
   enabled as a result of successful PANA authentication, a
   PaC-EP-Master-Key is generated for each EP from the AAA-Key,
   session identifier, key identifier, and the EP device identifier.
   The PaC-EP-Master-Key derivation algorithm defined in section 5.X
   ensures cryptographic independency among different
   PaC-EP-Master-Keys.
"

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Sat, 25 Jun 2005 23:54:57 -0700

Thanks for the update. This looks good.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of
> Yoshihiro Ohba
> Sent: Friday, June 24, 2005 2:56 PM
> To: [email-masked]
> Subject: [Pana] pana-pana issue168: resolution
>