Subject: Re: [Pana] New [issue31] Init responsibility of for EAP level reauthentication?

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 06 Oct 2003 10:30:01 -0700

On Thu, Sep 25, 2003 at 11:29:26AM -0700, Alper Yegin wrote:
> Are we talking about restarting the EAP state machine, or engaging a
> EAP-method-specific re-auth mechanism?

The former.  

> 
> If former: PaC can send PANA-PAA-Discover to initiate, and PAA can send
> PANA-Start-Request to initiate or as a response.

I think this is not the only allowable sequence in the former case.
PAA can send PANA-Auth-Request to initiate EAP-based re-authentication
if the PAA already has an established PANA session for the PaC.  That
is why I mentioned race condition.

Yoshihiro Ohba

> 
> If latter: PAA can send PANA-Auth-Request. I don't think this is a valid
> case for PaC to send anything, because only the authenticator can send EAP
> requests. (how can the EAP peer initiate the EAP-method-level reauth?)
> 
> Alper
> 
> 
> 
> > For timer-based EAP level reauthentication, PAA should be responsible
> > for initiating the reauthentication because PaC does not know enough
> > information (such as grace period) to be able to perform the
> > reauthentication at an appropriate time.  On the other hand, if EAP
> > level reauthentication is to be performed for other reasons, I think
> > both PaC and PAA can initiate the reauthentication.
> > 
> > There would be one issue in the latter case.  What happens if both PaC
> > and PAA initate EAP level reauthentication at the same time?  When
> > this happens, the PaC will send a PANA-PAA-Discover message while the
> > PAA will send a PANA-Auth-Request message, according to the EAP level
> > reauthentication behavior described in section 4.4.  In this case, the
> > PAA can rely on the EAP restransmission (as a result multiple
> > PANA-Auth-Request message with carrying the same EAP message will be
> > generated) and simply ignore the received PANA-PAA-Discover message.
> > This way, the race condition can be resolved.
> > 
> > Yoshihiro Ohba
> > 
> > 
> > On Thu, Sep 18, 2003 at 04:33:05PM +0300, [email-masked] wrote:
> >> New submission from Dan Forsberg <[email-masked]>:
> >> 
> >> Is PaC or PAA responsible of initiating EAP level reauthentication? This
> >> MUST be clearly stated in the draft.
> >> 
> >> 
> >> ----------
> >> category: Technical
> >> document: draft-ietf-pana-pana-xx.txt
> >> messages: 86
> >> nosy: dforsber
> >> priority: Must Fix
> >> status: No Discussion
> >> title: Init responsibility of for EAP level reauthentication?
> >> ________________________________________________
> >> PANA Issues <[email-masked]>
> >> http://danforsberg.info:8080/pana-issues/issue31
> >> ________________________________________________
> >> 
> >> _______________________________________________
> >> Pana mailing list
> >> [email-masked]
> >> https://www1.ietf.org/mailman/listinfo/pana
> > 
> > _______________________________________________
> > Pana mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/pana
> > 
> 
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 06 Oct 2003 10:30:01 -0700

The former.  

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 08 Oct 2003 11:13:42 -0700

The race condition I mentioned is common to both initial EAP
authentication and EAP re-authentication, and this might be better
handled in a separate issue.

So I agree on the proposed text for issue 31 and let's close this
issue.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 08 Oct 2003 11:13:42 -0700

Yoshihiro Ohba