Subject: [Pana] issue 40 (proposed text)

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 23 Jan 2004 19:43:10 -0800

Here is a proposed text for issue 40.
(Sorry if I had already sent this.)

- Add the following item in section 4.1.1:

"o Key-Id AVP: contains an MSK identifier."

- In section 4.1.5, Change:

   "A PANA SA is created as an attribute of a PANA session when EAP
   authentication succeeds with a creation of a Master Session Key (MSK)
   [I-D.ietf-eap-rfc2284bis].  A PANA SA is not created when the PANA
   authentication fails or no MSK is produced by any EAP authentication
   method. In the case where two EAP authentications are performed in a
   sequence in a single PANA authentication, it is possible that two
   MSKs are derived. If this happens, the PANA SA MUST be bound to the
   MSK derived from the first EAP authentication.  When a new MSK is
   derived as a result of EAP-based re-authentication, any key derived
   from the old MSK MUST be updated to a new one that is derived from
   the new MSK."

to:

   A PANA SA is created as an attribute of a PANA session when EAP
   authentication succeeds with a creation of a Master Session Key
   (MSK) [I-D.ietf-eap-rfc2284bis].  A PANA SA is not created when the
   PANA authentication fails or no MSK is produced by any EAP
   authentication method. In the case where two EAP authentications
   are performed in a sequence in a single PANA authentication, it is
   possible that two MSKs are derived. If this happens, the PANA SA
   MUST be bound to the MSK derived from the first EAP authentication.
   When a new MSK is derived as a result of EAP-based
   re-authentication, any key derived from the old MSK MUST be updated
   to a new one that is derived from the new MSK.  In order to
   distinguish the new MSK from old ones, one Key-Id AVP MUST be
   carried in PANA-Bind-Request and PANA-Bind-Answer message at the
   end of the authentication phase which resulted in deriving a new
   MSK.  The Key-Id AVP is of type Unsigned32 and MUST contain a value
   that uniquely identifies the MSK within the PANA session.  The
   PANA-Bind-Answer message sent in response to a PANA-Bind-Request
   with a Key-Id AVP MUST contain a Key-Id AVP with the same MSK
   identifier carried in the request.  PANA-Bind-Request and
   PANA-Bind-Answer messages with a Key-Id AVP MUST also carry a MAC
   AVP whose value is computed by using the new MSK."

- In section 4.1.5, change:

"      *  PANA SA attributes:

         +  MSK

         +  PANA_MAC_Key"

to:

"      *  PANA SA attributes:

         +  MSK

	 +  MSK identifier

         +  PANA_MAC_Key"

- Add the following section:

"9.4.16 Key-Id AVP

   The Key-Id AVP (AVP Code: 1039) is of type Integer32, and contains
   an MSK identifier.  The MSK identifier is assigned by PAA and MUST
   be unique within the PANA session."

- Update ABNF and AVP occurrence table for PANA-Bind-Request/Answer to
contain optional Key-Id AVP.

Comments?

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 26 Jan 2004 17:24:17 -0800

As long as PAA maintains uniqueness on the key-id within the PANA
session, any assignment method should be ok, including monotically
increasing numbers and random value.  (but monotically increasing
numbers is much easier to maintain.)

Yoshihiro Ohba

On Mon, Jan 26, 2004 at 01:21:55PM -0800, Alper Yegin wrote:
> 
> Any considerations regarding whether the key ID should be monotonically
> increasing or just a random value?
> 
> Alper
> 
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 26 Jan 2004 17:24:17 -0800

Yoshihiro Ohba

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 26 Jan 2004 18:57:59 -0800

> numbers is much easier to maintain.)
Monotonically increasing numbers sounds good to me.

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 26 Jan 2004 18:57:59 -0800

-mohan

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 27 Jan 2004 08:54:07 -0800

Then how about adding the following sentence?

"Although the specification does not mandate a particular method for
calculation of Key-Id AVP value, a simple method is to use
monotonically increasing numbers."

We do not have to mandate monotonically increasing numbers, like 
we do not mandate a particular cookie calculation mothod.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 27 Jan 2004 08:54:07 -0800

Yoshihiro Ohba

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 27 Jan 2004 09:18:35 -0800

Sounds good.

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 27 Jan 2004 09:18:35 -0800

Sounds good.

-mohan

---

From: Alper Yegin <[email-masked]>
Date: Mon, 26 Jan 2004 13:21:55 -0800

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 26 Jan 2004 13:21:55 -0800

Alper