Subject: [pcp] Agenda question about Wednesday's meeting

From: Sam Hartman <[email-masked]>
Date: Mon, 15 Oct 2012 23:56:40 -0400

Hi.
First, I want to thank the folks working on the PANA proposals.
Based on discussion, I think the issues resolved at the last meeting
regarding  version negotiation and other discussions that were
PANA-specific brought up at the meeting have been resolved to my
satisfaction.
I still prefer the PANA encapsulation option to the PANA
demultiplexing option, although I agree that both PANA options will
work.

At last meeting, we got kind of stuck in the details of the specific
proposals. It was good that we discussed the specific version number to
use and it was good that we discussed some of the rationale for single
ports.
However, we didn't get around to discussing the broader architectural
questions like:

1) Does PCP need re-authentication

2) Do we want authentication to be server or client initiated in PCP?

ETc.
We had some great discussion leading up to the last meeting and  were
approaching understanding of the architectural issues that I think we
need to consider in order to make a decision about the authentication
approach.
However, we got stuck  in the details and didn't get a chance to discuss
these issues.

I want to confirm that we're going to give priority to these
architectural issues in this call, focusing on them rather than updates
to the PANA proposals or discussion of the specifics of the PCP-specific
approach.  I hope we're all on the same page on that.  If not, I'd like
to start an agenda bashing discussion now.

---

From: Dave Thaler <[email-masked]>
Date: Tue, 16 Oct 2012 04:36:36 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Sam Hartman
> Sent: Monday, October 15, 2012 8:57 PM
> To: [email-masked]
> Subject: [pcp] Agenda question about Wednesday's meeting
> 
> Hi.
> Based on discussion, I think the issues resolved at the last meeting regarding
> version negotiation and other discussions that were PANA-specific brought
> up at the meeting have been resolved to my satisfaction.
> I still prefer the PANA encapsulation option to the PANA demultiplexing
> option, although I agree that both PANA options will work.
> 
> At last meeting, we got kind of stuck in the details of the specific proposals. It
> was good that we discussed the specific version number to use and it was
> good that we discussed some of the rationale for single ports.
> approaching understanding of the architectural issues that I think we need to
> consider in order to make a decision about the authentication approach.
> However, we got stuck  in the details and didn't get a chance to discuss these
> issues.
> 
> I want to confirm that we're going to give priority to these architectural issues
> in this call, focusing on them rather than updates to the PANA proposals or
> discussion of the specifics of the PCP-specific approach.  I hope we're all on
> the same page on that.  If not, I'd like to start an agenda bashing discussion
> now.
> _______________________________________________
> pcp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pcp

Unless my co-chair disagrees, that is my plan.   We didn't get to Margaret's
slides last time so assuming she's willing, I'll let her present first and hopefully
that will generate a good discussion of architectural issues.   

The two PANA drafts are quite short and last meeting I think folks generally
understood at a high level the differences, although it's great to see they got
updated/written up accordingly.

-Dave

---

From: Alper Yegin <[email-masked]>
Date: Tue, 16 Oct 2012 09:25:16 +0300

Hi Sam,

> However, we didn't get around to discussing the broader architectural

Let's get these rolling….

> 1) Does PCP need re-authentication

Authentication is for authorization, and it comes with finite lifetime.
The authorized service (e.g., "port mapping", "firewall rule") is good within the authorized lifetime of the service.
Before the lifetime exceeds, authorization either needs to be "extended" via re-authentication, or left to expire and disappear.

We need to support re-authentication for PCP.

> 2) Do we want authentication to be server or client initiated in PCP?

EAP (RFC 3748) by its design is server initiated and driven (requests always come from the server side).
"EAP" can be triggered externally (e.g., by the mean of "EAP lower layer") from client side.

Having provided these background info, what's the significance of this question?

Alper