Subject: [Pana] Issue 75: Why is DI information exchanged during PBR/A?

From: Alper Yegin <[email-masked]>
Date: Thu, 22 Apr 2004 17:21:29 -0700

This is the proposed text for handling issue 75.
The text is built on top of the modified text proposed for issue 73.

Change from:

   When an EAP method that is capable of deriving keys is used during
   the authentication phase and the keys are successfully derived the
   PANA-Bind-Request and PANA-Bind-Answer messages and all subsequent
   PANA messages MUST contain a MAC AVP.  The PANA-Bind-Request and the
   PANA-Bind-Answer message exchange is also used for binding device
   identifiers of the PaC and the PAA to the PANA SA when the
identifiers
   are either IP or MAC addresses. To achieve this, the
PANA-Bind-Request 
   and the PANA-Bind-Answer SHOULD contain a device identifier of the 
   PAA and the PaC, respectively, in a Device-Id AVP.  The PaC MUST 
   use the same type of device identifier as contained in the 
   PANA-Bind-Request message.  

To:

   When an EAP method that is capable of deriving keys is used during
   the authentication phase and the keys are successfully derived the
   PANA-Bind-Request and PANA-Bind-Answer messages and all subsequent
   PANA messages MUST contain a MAC AVP.  The PANA-Bind-Request and the
   PANA-Bind-Answer message exchange is also used for binding device
   identifiers of the PaC and the PAA to the PANA SA when the
identifiers
   are either IP or MAC addresses. To achieve this, the
PANA-Bind-Request 
   and the PANA-Bind-Answer SHOULD contain a device identifier of the 
   PAA and the PaC, respectively, in a Device-Id AVP. Device identifier
   exchange that is protected by a MAC AVP prevents man-in-the-middle 
   attacks. The PaC MUST use the same type of device identifier as
contained 
   in the PANA-Bind-Request message.  

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana