Subject: [pcp] I-D Action: draft-ietf-pcp-authentication-01.txt

From: [email-masked]
Date: Fri, 19 Oct 2012 01:05:50 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Port Control Protocol Working Group of the IETF.

	Title           : Port Control Protocol (PCP) Authentication Mechanism
	Author(s)       : Margaret Wasserman
                          Sam Hartman
                          Dacheng Zhang
	Filename        : draft-ietf-pcp-authentication-01.txt
	Pages           : 19
	Date            : 2012-10-19

Abstract:
   An IPv4 or IPv6 host can use the Port Control Protocol (PCP) to
   flexibly manage the IP address and port mapping information on
   Network Address Translators (NATs) or firewalls, to facilitate
   communications with remote hosts.  However, the un-controlled
   generation or deletion of IP address mappings on such network devices
   may cause security risks and should be avoided.  In some cases the
   client may need to prove that it is authorized to modify, create or
   delete PCP mappings.  This document proposes an in-band
   authentication mechanism for PCP that can be used in those cases.
   The Extensible Authentication Protocol (EAP) is used to perform
   authentication between PCP devices.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-pcp-authentication

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-pcp-authentication-01

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-pcp-authentication-01

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 22 Oct 2012 22:30:21 +0900

I have some comments in Section 4 of pcp-authenication-01.

[1] The following statement is incorrect because both PANA approaches use
PCP port number to indicate that the PANA session was being used for PCP
authentication.  The sentence should be removed.

"For the first approach [I-D.ohba-pcp-pana-encap], we would define an 
AVP for
PANA to indicate that the PANA session was being used for PCP
authentication, not for network access purposes.  "

[2]  I fail to see in the following sentence what the technical problem
with the existence of overlapping fields is.

"The first approach introduces little change on PANA.  Howerer, there
are criticisms about the existence of overlapping fields on the PANA
and PCP headers that need to be check for consistency."

[3] The 2nd sentence of the following text should be removed for the 
same reason as commented in [1].  Also, depending on resolution of 
comment [2], the 1st sentence may also need be removed.

"Compared with the first approach, the second approach does not have 
this problem. However, addition work needs to be done to help an PCP 
implementation to distinguish a PANA message from a PCP message."

Regards,
Yoshihiro Ohba

(2012/10/19 17:05), [email-masked] wrote:
> _______________________________________________
> pcp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pcp
>

---

From: Alper Yegin <[email-masked]>
Date: Wed, 31 Oct 2012 12:19:30 +0200

Furthermore:

   In pricinpal, the PANA message can be transported either through the
   PCP port or through an different port.  The latter option has been
   abandoned by the working group since it may impose unnecessary
   management burdens and cause issues in securely binding the PCP
   session to the PANA session initiation.

I think this last part is based on a misunderstanding. I had challenged that issue on the reflector, but didn't see anyone coming forward with an explanation. Use of same or different port adds no value to "crypto binding". This may not affect the ongoing discussions, but I'd rather not leave a trail of misconceptions in published documents.

   There are some functions of PANA which are not necessary for PCP.
   For example, it would not be necessary for these servers to support
   IP Address Reconfiguration and re-authentication.

Well, the re-auth discussion is still open. We shall not add that under the clause "are not necessary".

Thanks.

Alper

On Oct 22, 2012, at 4:30 PM, Yoshihiro Ohba wrote:

> "For the first approach [I-D.ohba-pcp-pana-encap], we would define an AVP for
> [3] The 2nd sentence of the following text should be removed for the same reason as commented in [1].  Also, depending on resolution of comment [2], the 1st sentence may also need be removed.
> 
> "Compared with the first approach, the second approach does not have this problem. However, addition work needs to be done to help an PCP implementation to distinguish a PANA message from a PCP message."
> 
> Regards,
> Yoshihiro Ohba
>