Subject: Re: Device identifier

From: Paal Engelstad <[email-masked]>
Date: Wed, 27 Feb 2002 20:27:50 +0100

Alper,

>    When the DI is carried implicitly as the source of the PANA 
>    message, the protocol has to make sure that the DI's integrity is 
>    protected by some other means (e.g., physical verification of 
>    incoming port number of the PANA message in the case of 
>    switch port number as a DI and PAA co-located with the link-layer 
>    access device).
> 
> 
> Comments?

I think the fundamental concept of a DI is that it is integrity protected, no matter how you carry it. IMO, parameters in packet headers that are not integrity protected can be anything and are not part of the DI - by definition.

Thus, I think your latter paragraph (above) might better be covered by the fact that DI is optional, i.e. if PAA has some other means to enforce access control, DI will not be needed (explicit) and ignored (implicit).

Are not the existing requirements sufficient?

Paal

> alper

---

From: "Alper Yegin" <[email-masked]>
Date: Wed, 27 Feb 2002 14:27:27 -0800

Paal,

> I think the fundamental concept of a DI is that it is integrity protected,
no matter how you carry it.

Agreed.

> IMO, parameters in packet headers that are not integrity protected can be
anything and are not part of the DI - by definition.
>
> Thus, I think your latter paragraph (above) might better be covered by the
fact that DI is optional, i.e. if PAA has some other means to enforce access
control, DI will not be needed (explicit) and ignored (implicit).

"Carrying DI explicitly" is optional.
But, one way or the other, PAA should figure out the DI upon receiving a
PANA request.

alper