Subject: [Pana] New [issue31] Init responsibility of for EAP level reauthentication?

From: [email-masked]
Date: Thu, 18 Sep 2003 16:33:05 +0300

New submission from Dan Forsberg <[email-masked]>:

Is PaC or PAA responsible of initiating EAP level reauthentication? This
MUST be clearly stated in the draft.

----------
category: Technical
document: draft-ietf-pana-pana-xx.txt
messages: 86
nosy: dforsber
priority: Must Fix
status: No Discussion
title: Init responsibility of for EAP level reauthentication?
________________________________________________
PANA Issues <[email-masked]>
http://danforsberg.info:8080/pana-issues/issue31
________________________________________________

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 18 Sep 2003 08:13:25 -0700

For timer-based EAP level reauthentication, PAA should be responsible
for initiating the reauthentication because PaC does not know enough
information (such as grace period) to be able to perform the
reauthentication at an appropriate time.  On the other hand, if EAP
level reauthentication is to be performed for other reasons, I think
both PaC and PAA can initiate the reauthentication.

There would be one issue in the latter case.  What happens if both PaC
and PAA initate EAP level reauthentication at the same time?  When
this happens, the PaC will send a PANA-PAA-Discover message while the
PAA will send a PANA-Auth-Request message, according to the EAP level
reauthentication behavior described in section 4.4.  In this case, the
PAA can rely on the EAP restransmission (as a result multiple
PANA-Auth-Request message with carrying the same EAP message will be
generated) and simply ignore the received PANA-PAA-Discover message.
This way, the race condition can be resolved.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 18 Sep 2003 08:13:25 -0700

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Thu, 25 Sep 2003 11:29:26 -0700

Are we talking about restarting the EAP state machine, or engaging a
EAP-method-specific re-auth mechanism?

If former: PaC can send PANA-PAA-Discover to initiate, and PAA can send
PANA-Start-Request to initiate or as a response.

If latter: PAA can send PANA-Auth-Request. I don't think this is a valid
case for PaC to send anything, because only the authenticator can send EAP
requests. (how can the EAP peer initiate the EAP-method-level reauth?)

Alper

---

From: Alper Yegin <[email-masked]>
Date: Thu, 25 Sep 2003 11:29:26 -0700

Alper