Subject: [pcp] I-D Action: draft-ietf-pcp-authentication-04.txt

From: [email-masked]
Date: Mon, 21 Jul 2014 06:27:17 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Port Control Protocol Working Group of the IETF.

        Title           : Port Control Protocol (PCP) Authentication Mechanism
        Authors         : Margaret Wasserman
                          Sam Hartman
                          Dacheng Zhang
	Filename        : draft-ietf-pcp-authentication-04.txt
	Pages           : 24
	Date            : 2014-07-21

Abstract:
   An IPv4 or IPv6 host can use the Port Control Protocol (PCP) to
   flexibly manage the IP address and port mapping information on
   Network Address Translators (NATs) or firewalls, to facilitate
   communications with remote hosts.  However, the un-controlled
   generation or deletion of IP address mappings on such network devices
   may cause security risks and should be avoided.  In some cases the
   client may need to prove that it is authorized to modify, create or
   delete PCP mappings.  This document proposes an in-band
   authentication mechanism for PCP that can be used in those cases.
   The Extensible Authentication Protocol (EAP) is used to perform
   authentication between PCP devices.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-pcp-authentication/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-pcp-authentication-04

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-pcp-authentication-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Dacheng Zhang <[email-masked]>
Date: Mon, 21 Jul 2014 11:04:43 -0400

Hi, in this version of the document, we try to address the comments got since the last meeting.  Particularly, we:
   o  Refine the retransmission policies.

   o  Provide the discussion about how to instruct a PCP client to
      choose proper credential during authenticaiton, and an ID
      Indication Option is defined for that purpose.
In addition, it is advised that we should remove the key ID from the PCP authentication message, and only use one key for a PCP session. However, this indicates we will use the MSK to generate MACs for PCP message directly. We would like to check with the group again before including it into the document. 

Any comments and suggestions are appreciated.

Cheers

Dacheng

> _______________________________________________
> pcp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pcp
>

---

From: Dave Thaler <[email-masked]>
Date: Mon, 21 Jul 2014 15:09:21 +0000

Thanks Dacheng for the update!

There are currently 4 open tickets (see
http://trac.tools.ietf.org/wg/pcp/trac/query?status=new&status=assigned&status=reopened&component=authentication).
What do you believe the current status of each is, based on this update?

-Dave

> -----Original Message-----
> From: pcp [mailto:[email-masked]] On Behalf Of Dacheng Zhang
> Sent: Monday, July 21, 2014 11:05 AM
> To: [email-masked]
> Subject: [pcp] I-D Action: draft-ietf-pcp-authentication-04.txt
> 
> In addition, it is advised that we should remove the key ID from the PCP
> authentication message, and only use one key for a PCP session. However,
> this indicates we will use the MSK to generate MACs for PCP message directly.
> We would like to check with the group again before including it into the
> document.
> 
> > Please note that it may take a couple of minutes from the time of
> > submission until the htmlized version and diff are available at tools.ietf.org.
> >

---

From: Dacheng Zhang <[email-masked]>
Date: Mon, 21 Jul 2014 14:34:43 -0400

Hi, Dave:

We didn't see any discussion about #60 and #62 in draft-reddy-pcp-auth-req-04. It seems the group didn't reach conclusions on those two issues.  Follows are the current status of the tickets.

#60: In the design we do not explicitly define the relationship between the life period of mappings and PCP-Auth sessions. However, it is assumed that the life period of a mapping could be longer than the period of the session where the mapping information is generated.

#61:  Unsolicited re-authenticaiton is defined in Section 3.3 since it is listed in draft-reddy-pcp-auth-req-04

#62: In the current design, re-transmission could be driven by either the client or the server. The PCP-auth protocol rather than EAP is responsible for retransmission.

＃72：An new Option is defined in Section 6.11 to transport the information helping client to choose proper credentials during authentication.  That option MAY be transported in the initial PA-Sever message. But the way of specifying such information is out of scope of this paper.

Cheers

Dacheng