Subject: RE: [Pana] EAP keying issues and PANA

From: Tschofenig Hannes <[email-masked]>
Date: Tue, 27 Jan 2004 08:27:55 +0100

hi alper, 

> >> When the PANA session expires, if the peers are interested in
> >> continuing the "access", another run of EAP is executed
> >> inside PANA. This should create a new EAP SA, hence a new PANA SA.
> > 
> > does this lead to a new session identifier?
> 
> I think I should have said "before the PANA session expires", 
> and in that
> case I'd answer your question as "the same session identifier 
> is preserved".
> It's like extending the lifetime of the ongoing session. If 
> the session
> expires on the PAA, I think we can consider it's gone and a 
> new session
> identifier will be allocated.

in this case you might want to have two sas concurrently to safely switch
from one sa to the other. to avoid some error cases where the pac or the paa
end up having no valid security association you need to distinguish these
two somehow. 

what do you think?
> Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana