Subject: [Pana] Nonce and Stateless Discovery

From: Sasikanth Bharadwaj <[email-masked]>
Date: Wed, 15 Jun 2005 16:54:51 +0530

Hi All

I have a question related to stateless discovery
How does a PAA using stateless discovery keep track
of the nonce it had sent to a PaC in the Start-Request
message? As per the draft

"  By relying on a cookie mechanism the PAA
   can avoid per-PaC state creation until after the PaC can produce the
   same cookie in its PANA-Start-Answer message.  In order to do that,
   the cookie MUST be computed in such a way that it does not require
   any per-session state maintenance on the PAA in order to verify the
   cookie returned in the PANA-Start-Answer message "

The cookie can be recomputed at the PAA and verified without the need
to create any state but the nonce is just a random value and cannot be
recomputed. It can neither be stored because that again amounts to state
creation
Once the session is created and authentication succeeds, PANA_MAC_KEY
needs to be computed but the PAA nonce is not available. Why not allow the
Auth-Request and Answer messages to carry the nonces rather than the
Start-Request and Answer messages? That way, the nonces are exchanged only
after state creation and that would solve the problem

Thanks and Regards

Sasikanth

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 15 Jun 2005 08:24:16 -0400

Hi Sasikanth,

I think you are right that inclusion of both a Nonce AVP and a Cookie
AVP in a PSR is conflicting in terms of the stateless nature of
stateless discovery.  On the other hand, Nonce AVP in PSR/PSA is
needed for pana-mobopts where PAR/PAN exchange is not performed.

To resolve these, I'd like to suggest the following change: 

- In case of stateless discovery, Nonce AVPs are included in the first
PAR/PAN exchange.

- In case of stateful discovery, Nonce AVPs are included in PSR/PSA
exchange.

- Make pana-mobopts work only with stateful discovery.

Yoshihiro Ohba