Subject: RE: EP, AR and PANA

From: <[email-masked]>
Date: Mon, 30 Sep 2002 10:45:44 -0500

> 
> > > This reads like it will only filter based on some clear text field
> > > in a packet. There might be cases when one needs to have stronger
> > > security i.e. the ability to apply cryptographically 
> strong methods
> > > to associate packets with the authenticated PaC.
> 
> do you suggest that it could be necessary to set Security Association
> (e.g. AH) between PaC and EP ?

Possibly. I guess this is something we are still discussing. 

> 
> [email-masked]

-Basavaraj

---

From: <[email-masked]>
Date: Mon, 30 Sep 2002 15:06:35 -0500

Yoshi,

>> 
>> The statement about "cryptogrpahically strong method" is
>> confusing. Does it mean that secure means beyond the scope of PANA may
>> be in place and PANA by itself with the DI is unable to afford
>> protection? 
>
>Although I'm not sure what "afford protection" exactly means in this
>context, per-packet protection itself is beyond the scope of PANA but
>ability to enable per-packet protection (by using LSA) can be the
>scope of PANA.  If PANA is completely independent of per-packet
>protection mechanism, there should be no need to mention per-packet
>protection at all in the definition of EP, IMHO.

If per-packet authentication is a vulnerability as a result of
authentication being moved up to L3, then we need to address it,
otherwise PANA is a non-starter. 
Hence the scope needs to identify ways of providing per-packet
protection. 
>Yoshihiro Ohba

-Basavaraj