Subject: [Pana] Unique identifier per session

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 17 Dec 2003 21:02:09 -0800

Hello,

PANA session ID uniquely identifies a session. But, it also does not change
across a reauthentication.
The PANA-IPsec draft needs something unique to identify the pre-shared keys
within a sub-session.
Two possibilities.

1) During re-authentication, change the session ID also in reauth-answer.
2) Invent another ID that changes with every reauth and hence uniquely
identifies the keys derived
    during a reauth.

Any other possibilities ?

-mohan

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Tschofenig Hannes <[email-masked]>
Date: Thu, 18 Dec 2003 16:32:50 +0100

hi all, 

the problem i currently see is the following: 
for mobility and for rekyeing in pana itself you need to have the ability to
uniquely identify a session key (in both directions: pac-> paa and
pac<-paa). the session identifier itself is not able to provide this
functionality since it is not supposed to change. all (let's say most)
security protocols have a concept to differentiate the different versions of
a key. kerberos, for example, calls it key version number. ike and ikev2
have spis. i think we can reuse the same concepts as other security
protocols do -> no rocket science issues here. 

this issue is applicable to both, pana and pana-ipsec. 

in order to get the key naming right we need to look at some other
protocols. let me try to propose a small text until next week. 

ciao
hannes

btw, to be honest bernard aboba discussed this issue with me at a phone
conference some time ago. unfortunately, i was very busy and i had no time
to tackle this issue. 

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:[email-masked]]
> Sent: Thursday, December 18, 2003 4:03 PM
> To: Mohan Parthasarathy
> Cc: [email-masked]
> Subject: Re: [Pana] Unique identifier per session
> 
> 
> On Wed, Dec 17, 2003 at 09:02:09PM -0800, Mohan Parthasarathy wrote:
> > Hello,
> > 
> I think it does not make sense to change the PANA Session-ID 
> across (re-)authentications just for this purpose.
> 
> How about using <PANA Session-Id> | <N> as the IKE pre-shared key
> identifier, where N is the number of EAP-based re-authentications
> occured for the Session-ID?
> 
> Yoshihiro Ohba
> 
> 
> >

---

From: Tschofenig Hannes <[email-masked]>
Date: Thu, 18 Dec 2003 16:32:50 +0100

hi all, 

ciao
hannes