Subject: RE: Separation of PAA and Access router (multi access router scenario)

From: <[email-masked]>
Date: Wed, 2 Oct 2002 13:26:40 -0500

> 
> I think we might need both actually. A general rule
> would be to push from the PAA to the EPs. However, 
> the protocol should also allow for a pull to allow 
> for the case of an EP crashing then coming up
> again. 

Agreed.

> Hesham

---

From: Reinaldo Penno <[email-masked]>
Date: Wed, 2 Oct 2002 11:47:13 -0700 (PDT)

agreed also.

> > for the case of an EP crashing then coming up

__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

---

From: "fan zhao" <[email-masked]>
Date: Thu, 3 Oct 2002 20:57:22 -0700

Deal all,

I'd like to bring these questions for discussion.

In PANA requirement document there is a requirement that "PANA must provide
reliability and congestion control. It can do so by using techniques like
re-transmissions, cyclic redundancy check, delayed initialization and
exponential back-off."

If I am not understanding wrong, PANA will be a general solution for all
kinds of network media, including wireless network. But most wireless
handholds, such as PDA, cell phone, don't have powerful cpu or large memory
to afford the big cost of crypto graphical computation and transportation
layer control. Wireless users will experience a big delay. Is it better to
let PANA support multiple methods so that users can choose based on their
practical needs?

Also the bandwidth in wireless network is critical to the local network
performance (stealing bandwidth can cause another kind of DoS attack),
should we take into consideration that how to prevent some attackers
illegally using an authenticated IP address if he can eavesdrop the traffic?

fan

---

From: Reinaldo Penno <[email-masked]>
Date: Fri, 4 Oct 2002 10:06:30 -0700 (PDT)

Hello Fan Zhao,

you have to remeber that PANA is only used for a brief
period of time while the device/user is being
authenticated. 

Even then, I believe most PDAs, handhleds, need to
support TCP, given the work on TCP PEP, so they should
have enough memory. If I'm not mistaken, WAP has TLS
or something equivalent, so even the first gen devices
should be able to support these requirements. Some new
cell/handhelds can even run IPsec clients. 

regards,

Reinaldo

---

From: "Brijesh Kumar" <[email-masked]>
Date: Fri, 4 Oct 2002 11:56:10 -0700

----- Original Message -----
From: "Reinaldo Penno" <[email-masked]>

> cell/handhelds can even run IPsec clients.

The TCP code itself is pretty small so memory isn't an issue. That should
not be deemed as a major issue at all.

The most important requirement for a PANA solution should be its ability to
quickly and securely establish the access by doing the minimal number of
possible transactions (thereby using minimum usable bandwidth and minimum
delay) when a device roams to a new coverage area.
For someone who has been involved with the design of a number of low power
wireless devices and systems, I would say you want to keep the wireless
communication simple, and with minimal non-essential computation so that the
battery life is improved, and most importanatly, your roaming experience is
continuous. A device with a longer battery life will win in the user
preference over a device that drains its battery because of its exotic
security computations. IPSEC has its usage in many situations, but putting
everything on top of IPSEC in a handheld  is perhaps overkill (there is so
much else happening in the device from continuous channel scanning to bcd
code computations, and cdma power control to drain the battery). Most users
will be happy with a secure wireless link layer.

Cheers,

--brijesh

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Fri, 4 Oct 2002 12:32:32 -0700

Hello Fan,

> let PANA support multiple methods so that users can choose based on their

When you say "method", do you mean "authentication method for client
access"?
If yes, since PANA carries EAP, client and the access network have a chance
to negotiate authentication methods and converge on a suitable one.

If you mean per-packet authentication/encryption, it's not within
the scope of PANA (protocol). The architecture has to decide on a
suitable method for that.

> illegally using an authenticated IP address if he can eavesdrop the
traffic?

Yes. The upcoming security threats draft will be covering
such threats.

alper

---

From: Reinaldo Penno <[email-masked]>
Date: Fri, 4 Oct 2002 19:13:43 -0700 (PDT)

> will be happy with a secure wireless link layer.

IPsec is end to end. People usually use IPsec to
connect to their companies/institutions, securing only
the wireless portion is not enough. 

> > > In PANA requirement document there is a
> requirement
> > > that "PANA must provide
> > > reliability and congestion control. It can do so
> by
> > > using techniques like
> > > re-transmissions, cyclic redundancy check,
> delayed
> > > initialization and
> > > exponential back-off."
> > >
> > > kinds of network media, including wireless
> network.
> > > But most wireless
> > > layer control. Wireless users will experience a
> big
> > > delay. Is it better to
> > > let PANA support multiple methods so that users
> can
> > > choose based on their
> > > practical needs?
> > >
> > > Also the bandwidth in wireless network is
> critical
> > > to the local network
> > > performance (stealing bandwidth can cause
> another
> > > kind of DoS attack),
> > > illegally using an authenticated IP address if
> he
> > > can eavesdrop the traffic?
> > >
> > > fan
> > >
> >
> >

__________________________________________________
Do you Yahoo!?
Faith Hill - Exclusive Performances, Videos & More
http://faith.yahoo.com

---

From: "Brijesh Kumar" <[email-masked]>
Date: Sat, 5 Oct 2002 13:40:27 -0700

Reinaldo,

I think you missed the point.

In most cases, you don't need IPSEC on a device to have secure access to
your network if your wirelink access is secure. If you trust your ISP
(wireless or otherwise), you can have secure access to your corporate VPNs
with the use of NAS initiated tunnel with L2TP. This is a quite effective
model in the carrier access equipment.

Cheers,

--brijesh

----- Original Message -----
> > >
> IPSEC has its usage in many
> > situations, but putting

---

From: Michael Richardson <[email-masked]>
Date: Sat, 05 Oct 2002 20:57:32 -0400

>>>>> "Brijesh" == Brijesh Kumar <[email-masked]> writes:
    Brijesh> I think you missed the point.

    Brijesh> In most cases, you don't need IPSEC on a device to have secure access to
    Brijesh> your network if your wirelink access is secure. If you trust your ISP
    Brijesh> (wireless or otherwise), you can have secure access to your corporate VPNs
    Brijesh> with the use of NAS initiated tunnel with L2TP. This is a quite effective
    Brijesh> model in the carrier access equipment.

  Yes, very effective, and it may very well sell, but it isn't security, sorry.
  
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

---

From: Reinaldo Penno <[email-masked]>
Date: Mon, 7 Oct 2002 15:20:48 -0700 (PDT)

yep, agree with Michael. Access but no security.
Security means IPsec or the like. 

--- Michael Richardson <[email-masked]>
wrote:
> ] [email-masked]
> http://www.sandelman.ottawa.on.ca/ |device driver[