Subject: RE: Location of authentication agent

From: George Tsirtsis <[email-masked]>
Date: Mon, 15 Apr 2002 17:23:59 -0400

James,

Why access routers HAVE to have SAs between them?????

George

-----Original Message-----
From: James Kempf [mailto:[email-masked]]
Sent: Monday, April 15, 2002 5:17 PM
To: Yoshihiro Ohba
Cc: Yoshihiro Ohba; George Tsirtsis; Hesham Soliman (ERA); Alper E. YEGIN;
[email-masked]
Subject: Re: Location of authentication agent

> I think that requires N^2 security associations for N access routers
> sharing the load.  If separation between PANA Agent and enforcement
> point is allowed, the number of security associations is reduced to N
> (PAA to each access router).
>

The routers have to have those security associations anyway, to handle
cryptographic security on their LSAs. Injecting the PANA agent requires
N more than would otherwise be necessary.

        jak

---

From: "James Kempf" <[email-masked]>
Date: Mon, 15 Apr 2002 14:52:23 -0700

> Why access routers HAVE to have SAs between them?????

They don't necessarily but if the network operator is concerned about
security and is using cryptographic security for exchange of LSAs, then
they will. Injecting a PANA agent means that the network operator is
concerned about security. Why would a network operator enable security
on traffic with a PANA agent and not between access routers?

            jak