Subject: [Pana] issue 40 (proposed text)

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 23 Jan 2004 19:43:10 -0800

Here is a proposed text for issue 40.
(Sorry if I had already sent this.)

- Add the following item in section 4.1.1:

"o Key-Id AVP: contains an MSK identifier."

- In section 4.1.5, Change:

   "A PANA SA is created as an attribute of a PANA session when EAP
   authentication succeeds with a creation of a Master Session Key (MSK)
   [I-D.ietf-eap-rfc2284bis].  A PANA SA is not created when the PANA
   authentication fails or no MSK is produced by any EAP authentication
   method. In the case where two EAP authentications are performed in a
   sequence in a single PANA authentication, it is possible that two
   MSKs are derived. If this happens, the PANA SA MUST be bound to the
   MSK derived from the first EAP authentication.  When a new MSK is
   derived as a result of EAP-based re-authentication, any key derived
   from the old MSK MUST be updated to a new one that is derived from
   the new MSK."

to:

   A PANA SA is created as an attribute of a PANA session when EAP
   authentication succeeds with a creation of a Master Session Key
   (MSK) [I-D.ietf-eap-rfc2284bis].  A PANA SA is not created when the
   PANA authentication fails or no MSK is produced by any EAP
   authentication method. In the case where two EAP authentications
   are performed in a sequence in a single PANA authentication, it is
   possible that two MSKs are derived. If this happens, the PANA SA
   MUST be bound to the MSK derived from the first EAP authentication.
   When a new MSK is derived as a result of EAP-based
   re-authentication, any key derived from the old MSK MUST be updated
   to a new one that is derived from the new MSK.  In order to
   distinguish the new MSK from old ones, one Key-Id AVP MUST be
   carried in PANA-Bind-Request and PANA-Bind-Answer message at the
   end of the authentication phase which resulted in deriving a new
   MSK.  The Key-Id AVP is of type Unsigned32 and MUST contain a value
   that uniquely identifies the MSK within the PANA session.  The
   PANA-Bind-Answer message sent in response to a PANA-Bind-Request
   with a Key-Id AVP MUST contain a Key-Id AVP with the same MSK
   identifier carried in the request.  PANA-Bind-Request and
   PANA-Bind-Answer messages with a Key-Id AVP MUST also carry a MAC
   AVP whose value is computed by using the new MSK."

- In section 4.1.5, change:

"      *  PANA SA attributes:

         +  MSK

         +  PANA_MAC_Key"

to:

"      *  PANA SA attributes:

         +  MSK

	 +  MSK identifier

         +  PANA_MAC_Key"

- Add the following section:

"9.4.16 Key-Id AVP

   The Key-Id AVP (AVP Code: 1039) is of type Integer32, and contains
   an MSK identifier.  The MSK identifier is assigned by PAA and MUST
   be unique within the PANA session."

- Update ABNF and AVP occurrence table for PANA-Bind-Request/Answer to
contain optional Key-Id AVP.

Comments?

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana