Subject: RE: some questions

From: <[email-masked]>
Date: Fri, 4 Oct 2002 15:07:31 -0500

>
>In PANA requirement document there is a requirement that "PANA must provide
>reliability and congestion control. It can do so by using techniques like
>re-transmissions, cyclic redundancy check, delayed initialization and
>exponential back-off."

The reason this was introduced was to avoid a large number of nodes
flooding the PAA at any given instant. For example if there is a power
outage or an Access Router (NAS) goes down and as a result the
authorization state at the AR is lost, there is a flood of PANA
authentication requests sent by the PaCs to re-establish the
state. In order to have some sort of congestion control, the above
requirement has been incorporated for PANA.

>
>If I am not understanding wrong, PANA will be a general solution for all
>kinds of network media, including wireless network. But most wireless
>handholds, such as PDA, cell phone, don't have powerful cpu or large memory
>to afford the big cost of crypto graphical computation and transportation
>layer control. 

PANA is intended to be lightweight. I do not see the above issues
causing concerns for the WG at this time.

>Wireless users will experience a big delay. Is it better to
>let PANA support multiple methods so that users can choose based on their
>practical needs?

I am not sure what delays you are refering to here. PANA is used for
authenticating the user for network access. This is accomplished by
exchanging a few Req/Resp messages between the PaC and the PAA. The
delay here is the time required to complete this messaging
sequence. Delay is not introduced for any subsequent data exchange.

>
>Also the bandwidth in wireless network is critical to the local network
>performance (stealing bandwidth can cause another kind of DoS attack),
>should we take into consideration that how to prevent some attackers
>illegally using an authenticated IP address if he can eavesdrop the
>traffic?

There is a security threats draft being worked on by Mohan P. and
should be announced shortly. Security issues are something that need
to be dealt with as we get into the solution discussion. If the IP
address is the DI that is used to allow access for packets, then we do
need to worry about spooffing etc...

>fan

-Basavaraj

---

From: "fan zhao" <[email-masked]>
Date: Mon, 7 Oct 2002 15:00:53 -0700

Hello Reinaldo, Alper, Basavaraj, Brijesh and Michael.

Thanks for your prompt replies.
I understand your points.
I totally agree that we should work out the security threats draft.

regards,
fan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: 2002?10?4? 13:08
To: [email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]
Subject: RE: some questions

-Basavaraj