Subject: Review and provide feedback

From: Alper Yegin <[email-masked]>
Date: Thu, 03 Jul 2003 11:15:59 -0700

Hello,

The new version of PANA draft is available now. Please review and provide
feedback before the IETF meeting.

http://www.ietf.org/internet-drafts/draft-ietf-pana-pana-01.txt

Alper

------ Forwarded Message
From: [email-masked]
Reply-To: [email-masked]
Date: Wed, 02 Jul 2003 16:33:10 -0400
To: IETF-Announce: ;
Cc: [email-masked]
Subject: I-D ACTION:draft-ietf-pana-pana-01.txt

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Protocol for carrying Authentication for
Network Access Working Group of the IETF.

    Title        : Protocol for Carrying Authentication for Network
                          Access (PANA)
    Author(s)    : D. Forsberg et al.
    Filename    : draft-ietf-pana-pana-01.txt
    Pages        : 52
    Date        : 2003-7-2
    
This document defines the Protocol for Carrying Authentication for
Network Access (PANA), a link-layer agnostic transport for
Extensible Authentication Protocol (EAP) to enable network access
authentication between clients and access networks. PANA can carry
any authentication method that can be specified as an EAP method,
and can be used on any link that can carry IP. PANA covers the
client-to-network access authentication part of an overall secure
network access framework, which additionally includes other
protocols and mechanisms for service provisioning, access control as
a result of initial authentication, and accounting.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-pana-pana-01.txt

To remove yourself from the IETF Announcement list, send a message to
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
    "get draft-ietf-pana-pana-01.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
    [email-masked].
In the body type:
    "FILE /internet-drafts/draft-ietf-pana-pana-01.txt".
    
NOTE:    The mail server at ietf.org can return the document in
    MIME-encoded form by using the "mpack" utility.  To use this
    feature, insert the command "ENCODING mime" before the "FILE"
    command.  To decode the response(s), you will need "munpack" or
    a MIME-compliant mail reader.  Different MIME-compliant mail readers
    exhibit different behavior, especially when dealing with
    "multipart" MIME messages (i.e. documents which have been split
    up into multiple messages), so check your local documentation on
    how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

------ End of Forwarded Message

---

From: Julien Bournelle <[email-masked]>
Date: Wed, 9 Jul 2003 15:25:53 +0200

Hello,

 Some quick comments:

- In the terminology section we have:
"
PANA Security Association:

 ...This security association includes the device identifier of the
peer, and a shared key when available"

On the other hand, we have section 4.1.5 PANA Security Association:

"A PANA SA is created of a PANA session when EAP authentication succeeds
with a creation of a MSK"

So I think that in a PANA SA we always have a shared key derived from
the EAP authentication. 
Maybe we need a change in the terminology section.

- In section 4.2 Discover and Initial Handshake Phase

. I guess that it lacks a word at the end of the first paragraph p. 11

. Figure 2 p 12

s/PANA-Start-Answer(x,y)/PANA-Start-Answer(y,x)

- Section 4.4 Re-authentication

.s/PANA-PAA-Discovery/PANA-PAA-Discover

.It is written that the PAA must search if it has an existing session
with a PaC sending a PANA-PAA-Discovery message by using DI. Isn't there
a potential risk of DoS attack ?

.Figure 5:

s/PANA-Reauth-Request/PANA-PAA-Discover ?

- section 4.5

It is stated that all messages exchanged during the termination phase
MSUT be protected by a MAC AVP. The problem is that it means that we
need a PANA SA with a shared key, as such, PANA MUST only carry EAP
methods enabling key derivation. Do I miss something ?

- Section 9.4.7

we don't have the notion of Command as in Diameter so I'm not sure if it
is necessary to incorporate the error COMMAND_UNSUPPORTED.

Just my 0.2 euros,

-- 
[email-masked]