Subject: [Pana] issue165: resolution

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 21 Jun 2005 08:59:05 -0400

[1] In section 4.2, change:

"
   A Nonce AVP MUST be included in the PANA-Start-Request and PANA-
   Start-Answer messages.  The nonces are used to establish a fresh
   PANA_MAC_KEY (see Section 5.3) which is a transient session key in
   the EAP key hierarchy [I-D.ietf-eap-keying] and is used only in the
   PANA protocol.  A Nonce AVP MUST be included in the PANA-Start-
   Request and PANA-Start-Answer messages.  The nonces are used to
   establish a PANA SA.
"

to:

"
   When stateless PAA discovery is not used, a Nonce AVP MUST be
   included in the PANA-Start-Request and PANA-Start-Answer messages.
   Otherwise, a Nonce AVP MUST NOT be included in the
   PANA-Start-Request and PANA-Start-Answer messages.
"

(The purpose of Nonce AVP is described elsewhere in the specification
and does not need to be explained here.)

[2] Remove Nonce AVPs from Figures 2 and 3.

[3] Insert the following paragraph between the 1st and 2nd paragraph
of section 4.3:

" 
   When stateless PAA discovery was performed in the discovery and
   handshake phase, a Nonce AVP MUST be included in the first
   PANA-Start-Request and PANA-Start-Answer messages and MUST NOT be
   included in the subsequent PANA-Start-Request and PANA-Start-Answer
   messages.  When stateless PAA discovery was not performed in the
   discovery and handshake phase, a Nonce AVP MUST NOT be included in
   all PANA-Start-Request and PANA-Start-Answer messages.
"

[4] Add the following paragraph in section 4.5:

"
A Nonce AVP MUST NOT be included in all PANA-Start-Request and
PANA-Start-Answer messages exchanged in the re-authentication phase.
"

[5] Update Figure 4 as follows.

      PaC      PAA  Message(sequence number)[AVPs]
      --------------------------------------------------------------------
                    (continued from the discovery and handshake phase 
                     with stateless PAA discovery)
         <-----     PANA-Auth-Request(x+1)
                       [Session-Id, Nonce, EAP{Request}]
         ----->     PANA-Auth-Answer(x+1)      // No piggybacking EAP Response
                       [Session-Id, Nonce]
         ----->     PANA-Auth-Request(y)
                       [Session-Id, EAP{Response}]
         <-----     PANA-Auth-Answer(y)
                       [Session-Id]
         <-----     PANA-Auth-Request(x+2)
                       [Session-Id, EAP{Request}]
         ----->     PANA-Auth-Answer(x+2)      // Piggybacking EAP Response
                       [Session-Id, EAP{Response}]
         <-----     PANA-Bind-Request(x+3)
                       [Session-Id, Result-Code, EAP{Success}, Device-Id,
                        Key-Id, Lifetime, Protection-Cap., PPAC, MAC]
         ----->     PANA-Bind-Answer(x+3)
                       [Session-Id, Device-Id, Key-Id, PPAC, MAC]

    Figure 4: Example sequence for the authentication and authorization

[6] Make Nonce AVP optional in the ABNF of PSR in section 7.2.2.

[7] Make Nonce AVP optional in the ABNF of PSA in section 7.2.3.

[8] Add an optional Nonce AVP to the ABNF of PAR in section 7.2.4.

[9] Add an optional Nonce AVP to the ABNF of PAN in section 7.2.5.

[10] In Figure 10, put '0-1' to the PSR, PSA, PAR and PAN entries in
Nonce AVP row.

[11] In Figure 12, remove Nonce AVPs from PSR and PSA, and add Nonce
AVPs to the first PAR and PAN.

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 21 Jun 2005 13:38:24 -0700

Yoshi,

>    PANA-Start-Request and PANA-Start-Answer messages.

This text does not say anything about Nonce AVP inclusion in the
PAR-PAN. Shouldn't it read:

	A Nonce AVP MUST be included in the first PANA-Auth-Request and 
	PANA-Auth-Answer messages when stateless PAA discovery is used, 
	and in PANA-Start-Request and PANA-Start-Answer messages
otherwise.

> [2] Remove Nonce AVPs from Figures 2 and 3.

I think either way is fine.

>    all PANA-Start-Request and PANA-Start-Answer messages.

Are there really any subsequent PSR/PSA? I think there is only one
PSR/PSN in a PANA session. 

> PANA-Start-Answer messages exchanged in the re-authentication phase.

Same issue as above.

>     Figure 4: Example sequence for the authentication and
authorization

I see, this is aligned with the figures 2 and 3.

> AVPs to the first PAR and PAN.

Thanks.

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 21 Jun 2005 12:44:57 -0400

> 	and in PANA-Start-Request and PANA-Start-Answer messages

Yes, that is better.

> PSR/PSN in a PANA session. 

Sorry, I meant s/Start/Auth/.

> > PANA-Start-Answer messages exchanged in the re-authentication phase.

Same as above (s/Start/Auth/).

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Tue, 21 Jun 2005 15:48:39 -0700

Yoshi,

> Sorry, I meant s/Start/Auth/.

OK, I see. I think we can condense the text as follows than:

	When stateless PAA discovery was performed in the discovery and
	handshake phase, a Nonce AVP MUST be included in the first
	PANA-Auth-Request and PANA-Auth-Answer messages.

I think this, coupled with the earlier text in Section 2, covers all the
bases.

> Same as above (s/Start/Auth/).

I think this is also redundant. Earlier we said it is only included in
the first PAR. I don't think we need to say elsewhere that it is not
included elsewhere.

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 21 Jun 2005 13:55:14 -0400

I agree with all of your comments below.

Yoshihiro Ohba

---

From: Sasikanth Bharadwaj <[email-masked]>
Date: Wed, 22 Jun 2005 10:01:51 +0530

----- Original Message ----- 
From: "Yoshihiro Ohba" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, June 21, 2005 6:29 PM
Subject: [Pana] issue165: resolution

> [2] Remove Nonce AVPs from Figures 2 and 3.
This is not required because the figures do not mention that
stateless discovery is being performed. 
Rest of the things look fine

Thanks

Sasikanth

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 22 Jun 2005 08:13:41 -0400

> stateless discovery is being performed. 

In the figures stateless discovery is implied because Cookie AVP is
included.

Yoshihiro Ohba