Subject: [Pana] NEW: [issue169] PANA lower layer ciphering

From: [email-masked]
Date: Thu, 16 Jun 2005 10:39:20 +0300

New submission from Dan Forsberg <[email-masked]>:

The PANA (draft-ietf-pana-pana-08) indicates that EAP keying material
may be used to create a PANA security association and lower layer
security associations.  The draft describes how to derive PANA keys from
the EAP AAA-Key.  I do not think the draft provides enough detail on the
use of keys for link-layer or network layer ciphering.  The draft needs
to ensure that the use of keys in the lower layer does not compromise
the security of the PANA communications.  Currently the draft contains
only brief text on this point.  The draft should specify how to derive a
key that can be used in the lower layer that is cryptographically
independent of the AAA-Key and the PANA keys.  This would help eliminate
the possibility that a AAA-key is used directly by a lower layer
protocol or that a lower-layer key is derived that is not
cryptographically independent from the PANA keys.  This should be
specified in the PANA protocol spec rather than trying to coordinate it
in multiple lower layer specs.  

I also have some questions on the Protection-Capability AVP.  

Shouldn't this capability be negotiated by the lower layers, why is it
necessary to do this in PANA?  

If negotiation is necessary then why is the Protection-Capability AVP
only indicated by the PAA, shouldn't the PaC be able to indicate this as
well?

Joe

----------
category: Technical
document: draft-ietf-pana-pana-08.txt
messages: 568
nosy: dforsber
priority: Must Fix
status: Pending
title: PANA lower layer ciphering
___________________________________________________
PANA Issues <[email-masked]>
<http://danforsberg.info:8080/pana-issues/issue169>
___________________________________________________
_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana