Subject: RE: [Pana] EAP-Request/Identity & PANA-Start-Request

From: [email-masked]
Date: Thu, 16 Oct 2003 11:11:58 +0300

Hi Yoshi,

I don't know the EAP state machines, but I guess they are 
intepretations of the EAP protocol specification. 

You said that EAP-Request/Response Identity message exchange 
is optional. This seems to imply that the EAP authenticator
does not have to be stateful during identity "discovery"?
How does the authenticator skip the identity request/response 
part when the identity is known outside EAP already?

This is why I can't see your separation to stateless or 
stateful.

- Dan

> -----Original Message-----
> From: ext Yoshihiro Ohba [mailto:[email-masked]]
> Sent: 15 October, 2003 19:39
> To: Forsberg Dan (NRC/Helsinki)
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Pana] EAP-Request/Identity & PANA-Start-Request
>
>
> Hi Dan,
>
> On Wed, Oct 15, 2003 at 11:47:18AM +0300,
> [email-masked] wrote:
> > >
> > > The issue we are discussing is: which PANA message should
> carry the
> > > initial EAP Request/Identity and here is my suggestion:
> > >
> > >   "When a Cookie-AVP is carried in a PANA-Start-Request
> message, the
> > >   initial EAP Request MUST NOT be carried in the
> PANA-Start-Request
> > >   message in order for the PAA to be stateful.
> >
> > I don't think that the Cookie makes PAA necessarily
> stateful. PAA could
> > use a timestamp and a hash of PaC's address, encrypt that
> with a secret
> > key and use it as a cookie. When PAA checks the cookie, it
> decrypts it
> > and checks the timestamp and address hash. No state
> required. I'm not a
> > cookie expert, though.
>
> Sorry, that is a typo, "stateful" should read "stateless".
>
> >
> > >
> > >   When a Cookie-AVP is not carried in a
> PANA-Start-Request message,
> > >   the PAA does not need to be stateful.  In this case,
> the initial EAP
>
> This is the same typo, "stateful" should read "stateless".
>
> > >   Request message MAY be carried in the
> PANA-Start-Request message.
> > >   If the initial EAP Request message is carried in the
> > >   PANA-Start-Request message, an EAP Response message
> MUST be carried
> > >   in the PANA-Start-Answer message returned to the PAA.
> > > 
> > >   In any case, PANA MUST NOT generate an EAP message on behalf of
> > >   EAP peer or EAP authenticator."
> >
> > Just for clarification and for easier understanding what about:
> >    "In any case, PANA MUST NOT generate an EAP message on behalf of
> >     EAP peer or EAP (passthrough) authenticator."
>
> OK.
>
> >
> > >
> > > I think this allows saving one round trip when PAA does
> not need to be
> > > stateless.
> >
> > Ok, but I don't fully agree about the separation of Cookie
> and EAP-Request.
> > See the comment above.
>
>
> After fixing the typo, I guess we are in agreement.
>
> Yoshihiro Ohba
>
>
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 16 Oct 2003 09:58:22 -0700

> does not have to be stateful during identity "discovery"?

I think whether PAA becomes stateful or stateless during discovery and
initial handshake phase is implementation dependent (please see Note
below), and orthogonal to whether EAP-Request/Response Identity
exchange is performed or not.

When PAA is implemented to be stateless by using Cookie during
discovery and initial handshake phase, carrying the initial EAP
Request (which may or may not be an EAP Request/Identity) in
PANA-Start-Request will make the PAA stateful because the EAP
authenticator on the box will create a state at EAP layer when
generating the initial EAP Request.  I can't imagine how PAA can be
stateless while EAP authenticator has created a state.  Even if PAA
could be stateless when EAP authenticator has created a state, the
machine where the PAA and EAP authenticator are implemented becomes
stateful and this breaks the purpose of using Cookie.

Note: When PANA is implemented on point-to-point links, PAA can be
stateful because there is at most one PaC on each link and using
Cookie does not make much sense. Using Cookie (and PAA becomes
stateless) makes sense only when there can be multiple PaCs connected
to the same link at the same time.

> part when the identity is known outside EAP already?

The authenticator can immediately perform an EAP authentication method
when the identity is known outside EAP already.

Or if the identity is obtained in an EAP authentication method, the
authenticator can skip initial identity request/response exchange and
can immediately performs the EAP authentication method.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 16 Oct 2003 09:58:22 -0700

Yoshihiro Ohba