Subject: Re: Re: Requirements draft is here! - Multicast

From: Paal Engelstad <[email-masked]>
Date: Tue, 5 Feb 2002 6:30:12 +0100

Reinaldo,

An untrusted node will not be able to "register with PAA" a "stolen" DI, anyway - he won't be able to authenticate with PAA.

Thus, this requirement ("At most one PANA client should be associated with a DI on a PANA authentication agent.)" addresses the problem of 2 trusted Pacs trying to register the same DI. Right?

Now, if the DIs are supposed to be unique (e.g. unique addresses) this is clearly an error condition, since the PaCs are trusted. 

If they are not supposed to be unique (multicast) the access network will probably deal with the situation according to some policy ( - the access network MAY for example refuse anyone to use multicast if it will comprise the security).

I thus wonder if this sentence/restriction/requirement can be left out of the requirements document - it does not feel right to mandate how a protocol deals with an error condition - that can be very protocol specific. It may also be left to implementors/operators to choose which policies fit there needs.

My own 'vision' of the use of the DI is only 2 fold:

1) It is a handle for policing
2) It narrows down a semantical gap between PPP and IP. (I.e PPP authentication based on only a NAI would mean that the user is present on the link. When a similar authentication is lifted up to the IP-layer, it translates into authenticating that the user is present somewhere on the Internet!) This gap can easlily be exploited by malicious nodes.

But there might be other reasons for this requirement that I have overlooked. I might simply have miss the point...

Paal

> 
> Fra: Reinaldo Penno <[email-masked]>
> Dato: 2002/02/05 Tue AM 03:58:14 CET
> Til: Paal Engelstad <[email-masked]>, 
>   "Alper E. YEGIN" <[email-masked]>, 
>   Pana E-mail <[email-masked]>
> Tema: Re: Requirements draft is here! - Multicast
> 
> Hello,
> 
> There are a list of issues we decided to let the main
> list decide. I prefer to raise them now so we get a
> consensus intead of coming back after we are more dow
> the raod. The first one is the multicast issue.
> 
> In the requirements it is said that.
> 
> "Device Identifier (DI) 
>     
> The identifier used by the network as a handle to 
> 
> ...<snip>...<snip>...
> 
> At most one PANA client should be associated with a DI
> on a PANA authentication agent. "
>     
> Given that the DI can an IP address, this means that
> in the multicast case you cannot use DI as an
> identifier (since several clients would be associated
> with a DI), or we need to change the above definition
> a little.
> 
> So the main question is: Would that be a case where
> you want to grant access to all members of a multicast
> group without caring to know each client individually?
>   
> 
> regards,
> 
> Reinaldo
> 
> 
> 
> 
> __________________________________________________
> Do You Yahoo!?
> Great stuff seeking new owners in Yahoo! Auctions! 
> http://auctions.yahoo.com
>

---

From: Paal Engelstad <[email-masked]>
Date: Tue, 5 Feb 2002 6:46:04 +0100

Reinaldo,

Paal