From pana-bounces@ietf.org Tue Jun 1 00:16:45 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA05519 for ; Tue, 1 Jun 2004 00:16:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BV0b4-00014C-7P; Tue, 01 Jun 2004 00:09:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BV0Vy-0000cl-Bl for pana@megatron.ietf.org; Tue, 01 Jun 2004 00:04:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA05071 for ; Tue, 1 Jun 2004 00:04:35 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BV0Vw-0002Ig-Cp for pana@ietf.org; Tue, 01 Jun 2004 00:04:36 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BV0V8-0001ss-00 for pana@ietf.org; Tue, 01 Jun 2004 00:03:46 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1BV0US-0001SS-00 for pana@ietf.org; Tue, 01 Jun 2004 00:03:05 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5142vgH012333; Tue, 1 Jun 2004 13:02:57 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5142vFH023679; Tue, 1 Jun 2004 13:02:57 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id PAA23673 ; Tue, 1 Jun 2004 13:02:57 +0900 Received: from mx4.toshiba.co.jp by tis2.tis.toshiba.co.jp id NAA26951; Tue, 1 Jun 2004 13:02:56 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id NAA10930; Tue, 1 Jun 2004 13:02:43 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5142hCR020490; Tue, 1 Jun 2004 13:02:43 +0900 (JST) Received: from steelhead (iVPN01-123.mobile.toshiba.co.jp) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HYM00CEN38HKI@tsbpo1.po.toshiba.co.jp>; Tue, 1 Jun 2004 13:02:42 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BV0Tj-00008b-00; Mon, 31 May 2004 21:02:19 -0700 Date: Mon, 31 May 2004 21:02:12 -0700 From: Yoshihiro Ohba Subject: Re: [Pana] Some comments about PANA drafts In-reply-to: <052E0C61B69C3741AFA5FE88ACC775A6122422@esebe023.ntc.nokia.com> To: Pasi.Eronen@nokia.com Message-id: <20040601040212.GE23542@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: Pasi.Eronen@nokia.com, pana@ietf.org User-Agent: Mutt/1.5.6i References: <052E0C61B69C3741AFA5FE88ACC775A6122422@esebe023.ntc.nokia.com> X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Cc: pana@ietf.org X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Hi Pari, Thank you for reviewing the drafts. I have one quick comment on the PANA framework draft. On Mon, May 31, 2004 at 12:41:17PM +0300, Pasi.Eronen@nokia.com wrote: > > > Comments about draft-ietf-pana-framework-00: > > Section 10.2.2: First, let's say that I have some doubts about > whether anyone will actually implement this. It also seems that > there are not enough details about e.g. PANA would actually work > together with 802.11 and .11i state machines and procedures, but > maybe this isn't necessary in a "framework" document. (BTW, the > 4-way handshake is started by the AP; bullet 4 in 10.2.2.2 seems > to assume otherwise.) An update to section 10.2.2 is being discussed on the mailing list: http://www1.ietf.org/mail-archive/web/pana/current/msg00693.html (Any comment on the above thread is appreciated.) There is some plan to implement the model in Open Diameter project. You are right that 4-way handshake is started by the AP and bullet 4 in 10.2.2.2 is ambiguous on it. We will revise the text. Regards, Yoshihiro Ohba _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From mailman-bounces@ietf.org Tue Jun 1 06:18:20 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA12743 for ; Tue, 1 Jun 2004 06:18:20 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BV5O1-0006gK-Nz for pana-archive@lists.ietf.org; Tue, 01 Jun 2004 05:16:45 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: ietf.org mailing list memberships reminder From: mailman-owner@ietf.org To: pana-archive@ietf.org X-No-Archive: yes Message-ID: Date: Tue, 01 Jun 2004 05:02:40 -0400 Precedence: bulk X-BeenThere: mailman@lists.ietf.org X-Mailman-Version: 2.1.5 List-Id: Mailman site list X-List-Administrivia: yes Sender: mailman-bounces@ietf.org Errors-To: mailman-bounces@ietf.org Content-Transfer-Encoding: 7bit This is a reminder, sent out once a month, about your ietf.org mailing list memberships. It includes your subscription info and how to use it to change it or unsubscribe from a list. You can visit the URLs to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. In addition to the URL interfaces, you can also use email to make such changes. For more info, send a message to the '-request' address of the list (for example, mailman-request@ietf.org) containing just the word 'help' in the message body, and an email message will be sent to you with instructions. If you have questions, problems, comments, etc, send them to mailman-owner@ietf.org. Thanks! Passwords for pana-archive@lists.ietf.org: List Password // URL ---- -------- pana@ietf.org onobde https://www1.ietf.org/mailman/options/pana/pana-archive%40lists.ietf.org From mailman-admin@ietf.org Tue Jun 1 10:25:00 2004 Received: from optimus.ietf.org ([132.151.1.18]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06898 for ; Tue, 1 Jun 2004 10:25:00 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BV8y6-0003SO-6U for pana-archive@lists.ietf.org; Tue, 01 Jun 2004 09:06:14 -0400 Date: Tue, 01 Jun 2004 09:06:14 -0400 Message-ID: <20040601130614.26555.40304.Mailman@www1.ietf.org> Subject: ietf.org mailing list memberships reminder From: mailman-owner@www1.ietf.org To: pana-archive@ietf.org X-No-Archive: yes X-Ack: no Sender: mailman-admin@ietf.org Errors-To: mailman-admin@ietf.org X-BeenThere: mailman@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk This is a reminder, sent out once a month, about your ietf.org mailing list memberships. It includes your subscription info and how to use it to change it or unsubscribe from a list. You can visit the URLs to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. In addition to the URL interfaces, you can also use email to make such changes. For more info, send a message to the '-request' address of the list (for example, pana-request@ietf.org) containing just the word 'help' in the message body, and an email message will be sent to you with instructions. *************************************************************************** Note Well All statements related to the activities of the IETF and addressed to the IETF are subject to all provisions of Section 10 of RFC 2026, which grants to the IETF and its participants certain licenses and rights in such statements. Such statements include verbal statements in IETF meetings, as well as written and electronic communications made at any time or place, which are addressed to * the IETF plenary session, * any IETF working group or portion thereof, * the IESG, or any member thereof on behalf of the IESG, * the IAB or any member thereof on behalf of the IAB, * any IETF mailing list, including the IETF list itself, any working group or design team list, or any other list functioning under IETF auspices, * the RFC Editor or the Internet-Drafts function Statements made outside of an IETF meeting, mailing list or other function, that are clearly not intended to be input to an IETF activity, group or function, are not subject to these provisions. *************************************************************************** If you have questions, problems, comments, etc, send them to mailman-owner@www1.ietf.org. Thanks! Passwords for pana-archive@lists.ietf.org: List Password // URL ---- -------- pana@ietf.org onobde https://www1.ietf.org/mailman/options/pana/pana-archive%40lists.ietf.org From pana-bounces@ietf.org Tue Jun 1 20:21:02 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA09251 for ; Tue, 1 Jun 2004 20:21:02 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVJMW-0003hh-QQ; Tue, 01 Jun 2004 20:12:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVDIq-00076z-Jn for pana@megatron.ietf.org; Tue, 01 Jun 2004 13:43:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA00682 for ; Tue, 1 Jun 2004 13:43:53 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BVDIp-0005Ov-Cv for pana@ietf.org; Tue, 01 Jun 2004 13:43:55 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BVDEE-00040t-00 for pana@ietf.org; Tue, 01 Jun 2004 13:39:11 -0400 Received: from smtp814.mail.sc5.yahoo.com ([66.163.170.84]) by ietf-mx with smtp (Exim 4.12) id 1BVD9i-0002vZ-00 for pana@ietf.org; Tue, 01 Jun 2004 13:34:30 -0400 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@192.103.17.134 with login) by smtp814.mail.sc5.yahoo.com with SMTP; 1 Jun 2004 17:34:29 -0000 Message-ID: <007901c447fe$b00c5500$861167c0@adithya> From: "Mohan Parthasarathy" To: Date: Tue, 1 Jun 2004 10:34:26 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Subject: [Pana] New Issues on PANA threats draft X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7bit I have opened four new issues 86,87,88,89 on PANA threats draft after AD's review. These are the big ones and rest are mostly editorial. I will post the resolution to these in a separate email. Please send your comments there. -mohan _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 1 22:26:31 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA15557 for ; Tue, 1 Jun 2004 22:26:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVLD1-0001NX-0o; Tue, 01 Jun 2004 22:10:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVFJx-0001BN-Bq for pana@megatron.ietf.org; Tue, 01 Jun 2004 15:53:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19072 for ; Tue, 1 Jun 2004 15:53:00 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BVFJl-0002qF-9W for pana@ietf.org; Tue, 01 Jun 2004 15:53:01 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BVFB9-0000ng-00 for pana@ietf.org; Tue, 01 Jun 2004 15:44:08 -0400 Received: from smtp811.mail.sc5.yahoo.com ([66.163.170.81]) by ietf-mx with smtp (Exim 4.12) id 1BVEur-0004zB-00 for pana@ietf.org; Tue, 01 Jun 2004 15:27:17 -0400 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@192.103.17.134 with login) by smtp811.mail.sc5.yahoo.com with SMTP; 1 Jun 2004 19:14:19 -0000 Message-ID: <00a201c4480c$a1eba940$861167c0@adithya> From: "Mohan Parthasarathy" To: Date: Tue, 1 Jun 2004 12:14:15 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Subject: [Pana] PANA threats Issue 86 X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7bit Hi, Following is the resolution to Issue 86: Include a new threat in Section 6.4: T6.4.2: PaC can leave the network without notifying the PAA or EP e.g., the Ethernet cable is unplugged, system crash. An attacker can pretend to be the PaC and start using the network. And change FROM: If the link is not shared, this threat is absent as ingress filtering can prevent one node from impersonating as another node. TO: If the link is not shared, T6.4.1 is absent as ingress filtering can prevent one node from impersonating as another node. Threat T6.4.2 is still possible as the disconnect may not be seen reliably by the network always. And Change the Requirement to drop "on shared links". Also, update the summary at the end. Comments ? -mohan _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 1 22:28:36 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA15814 for ; Tue, 1 Jun 2004 22:28:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVLDE-0001RO-4e; Tue, 01 Jun 2004 22:10:40 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVFRh-0003Ye-Fe for pana@megatron.ietf.org; Tue, 01 Jun 2004 16:01:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA20228 for ; Tue, 1 Jun 2004 16:01:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BVFRf-00054q-V5 for pana@ietf.org; Tue, 01 Jun 2004 16:01:12 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BVFNn-00045w-00 for pana@ietf.org; Tue, 01 Jun 2004 15:57:12 -0400 Received: from smtp813.mail.sc5.yahoo.com ([66.163.170.83]) by ietf-mx with smtp (Exim 4.12) id 1BVFFs-0001yE-00 for pana@ietf.org; Tue, 01 Jun 2004 15:49:00 -0400 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@192.103.17.134 with login) by smtp813.mail.sc5.yahoo.com with SMTP; 1 Jun 2004 19:47:21 -0000 Message-ID: <00ac01c44811$3eca0f50$861167c0@adithya> From: "Mohan Parthasarathy" To: , References: <052E0C61B69C3741AFA5FE88ACC775A6122422@esebe023.ntc.nokia.com> Subject: Re: [Pana] Some comments about PANA drafts Date: Tue, 1 Jun 2004 12:47:17 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7bit Pasi, Thanks for your comments. I will address the IPsec issue here : >Comments about draft-ietf-pana-ipsec-03: > >Section 5: What happens if there were two EAP authentications, >resulting in two AAA-Keys? Do you know what happens in 802.11i for this case ? We can follow the same here. >Section 8: The special rule for PANA_PORT should be included >in Section 8.1 and 8.2, rather than described separately. Okay. I was trying to save space :-) >Also, inbound SPD/SAD entries don't contain outer IP addresses. It is more of a symmetric representation of EP's outbound SPD entry matching PaC's inbound SPD entry and vice-versa. In terms of policy enforcement for each packet after decryption, i agree that the outer address don't make sense for tunnel mode. But SPD also is consulted to see whether i as the receiver can negotiate keys with the initiator or not. In that sense, the SPD's outer address makes sense. -mohan _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Wed Jun 2 01:05:53 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA26674 for ; Wed, 2 Jun 2004 01:05:53 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVN6q-0004Io-Mp; Wed, 02 Jun 2004 00:12:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVH0c-0008AT-8n for pana@megatron.ietf.org; Tue, 01 Jun 2004 17:41:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26936 for ; Tue, 1 Jun 2004 17:41:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BVH0a-0004Dn-Rp for pana@ietf.org; Tue, 01 Jun 2004 17:41:20 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BVGzY-0003fc-00 for pana@ietf.org; Tue, 01 Jun 2004 17:40:17 -0400 Received: from smtp809.mail.sc5.yahoo.com ([66.163.168.188]) by ietf-mx with smtp (Exim 4.12) id 1BVGyE-0002hA-00 for pana@ietf.org; Tue, 01 Jun 2004 17:38:54 -0400 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@192.103.17.134 with login) by smtp809.mail.sc5.yahoo.com with SMTP; 1 Jun 2004 21:34:42 -0000 Message-ID: <00c901c44820$3d635590$861167c0@adithya> From: "Mohan Parthasarathy" To: Date: Tue, 1 Jun 2004 14:34:37 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Subject: [Pana] PANA threats Issue 88 X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7bit Resolution for Issue 88. I think the following is simple enough and should address the concern. Modify the section 6.1 last paragraph FROM: The advertisement may be used to include other information like supported authentication methods etc., besides the discovery of the PAA itself. This can lead to a bidding down attack, as a malicious node can send a spoofed advertisement with capabilities that indicate less secure authentication methods than what the real PAA supports, thereby fooling the PaC into negotiating a less secure authentication method than what would otherwise be available. This is best avoided by limiting the amount of security-critical information sent during the PAA discovery process. Requirement 1 PANA MUST not assume that the discovery process is protected. Since, it is difficult to protect the discovery process, the security- critical information exchanged during the discovery process SHOULD be limited. TO The advertisement may be used to include other information like supported authentication methods etc., besides the discovery of the PAA itself. This can lead to a bidding down attack, as a malicious node can send a spoofed advertisement with capabilities that indicate less secure authentication methods than what the real PAA supports, thereby fooling the PaC into negotiating a less secure authentication method than what would otherwise be available. Requirement 1 PANA MUST not assume that the discovery process is protected. Also update the summary at the end. Comments ? -mohan _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Wed Jun 2 22:45:47 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12111 for ; Wed, 2 Jun 2004 22:45:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVhz5-0002ES-PU; Wed, 02 Jun 2004 22:29:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVbn3-0000Th-Rh for pana@megatron.ietf.org; Wed, 02 Jun 2004 15:52:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA15148 for ; Wed, 2 Jun 2004 15:52:42 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BVbn1-0007eu-Gk for pana@ietf.org; Wed, 02 Jun 2004 15:52:43 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BVblf-0006rk-00 for pana@ietf.org; Wed, 02 Jun 2004 15:51:20 -0400 Received: from mailout2.samsung.com ([203.254.224.25]) by ietf-mx with esmtp (Exim 4.12) id 1BVbjy-0006FP-00 for pana@ietf.org; Wed, 02 Jun 2004 15:49:35 -0400 Received: from custom-daemon.mailout2.samsung.com by mailout2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) id <0HYP005015PRSC@mailout2.samsung.com> for pana@ietf.org; Thu, 03 Jun 2004 04:49:03 +0900 (KST) Received: from ep_mmp2 (mailout2.samsung.com [203.254.224.25]) by mailout2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTP id <0HYP00HQ55PQDC@mailout2.samsung.com> for pana@ietf.org; Thu, 03 Jun 2004 04:49:03 +0900 (KST) Received: from Alperyegin ([105.144.29.157]) by mmp2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTPA id <0HYP0062W5PORM@mmp2.samsung.com> for pana@ietf.org; Thu, 03 Jun 2004 04:49:02 +0900 (KST) Date: Wed, 02 Jun 2004 12:48:59 -0700 From: Alper Yegin Subject: RE: [Pana] PANA threats Issue 86 In-reply-to: <00a201c4480c$a1eba940$861167c0@adithya> To: "'Mohan Parthasarathy'" , pana@ietf.org Message-id: <006f01c448da$a7381f40$9d1d9069@sisa.samsung.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-Mailer: Microsoft Outlook, Build 10.0.2627 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7BIT X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7BIT > Hi, > > Following is the resolution to Issue 86: > > Include a new threat in Section 6.4: > > T6.4.2: PaC can leave the network without notifying the PAA or EP > e.g., the Ethernet cable is unplugged, system crash. An > attacker can > pretend to be the PaC and start using the network. > > And change FROM: > > If the link is not shared, this threat is absent as ingress > filtering > can prevent one node from impersonating as another node. > > TO: > > If the link is not shared, T6.4.1 is absent as ingress > filtering can prevent > one node from impersonating as another node. It might not be obvious why ingress filtering is relevant here. I think what we mean is: "If the link is not shared, T6.4.1 is absent as there can only be one client on the link, and ingress filtering can prevent attacker's use of the authorized IP and MAC address on another link." Alper > Threat T6.4.2 is > still possible > as the disconnect may not be seen reliably by the network > always. > > And Change the Requirement to drop "on shared links". Also, update the > summary > at the end. > > Comments ? > > -mohan > > > > _______________________________________________ > Pana mailing list > Pana@ietf.org > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Wed Jun 2 22:46:36 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12191 for ; Wed, 2 Jun 2004 22:46:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVhz6-0002Eg-BS; Wed, 02 Jun 2004 22:29:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BVbrI-00020A-5C for pana@megatron.ietf.org; Wed, 02 Jun 2004 15:57:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA15430 for ; Wed, 2 Jun 2004 15:56:45 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BVbqw-0001ed-Ij for pana@ietf.org; Wed, 02 Jun 2004 15:56:46 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BVbpx-0001Bc-00 for pana@ietf.org; Wed, 02 Jun 2004 15:55:45 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BVbom-0000hW-00 for pana@ietf.org; Wed, 02 Jun 2004 15:54:32 -0400 Received: from mailout1.samsung.com ([203.254.224.24]) by mx2.foretec.com with esmtp (Exim 4.24) id 1BVboo-0004j1-HQ for pana@ietf.org; Wed, 02 Jun 2004 15:54:34 -0400 Received: from custom-daemon.mailout1.samsung.com by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) id <0HYP001045XTAK@mailout1.samsung.com> for pana@ietf.org; Thu, 03 Jun 2004 04:53:53 +0900 (KST) Received: from ep_mmp2 (mailout1.samsung.com [203.254.224.24]) by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTP id <0HYP00FR45XSKP@mailout1.samsung.com> for pana@ietf.org; Thu, 03 Jun 2004 04:53:53 +0900 (KST) Received: from Alperyegin ([105.144.29.157]) by mmp2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTPA id <0HYP00LOM5XQE6@mmp2.samsung.com> for pana@ietf.org; Thu, 03 Jun 2004 04:53:52 +0900 (KST) Date: Wed, 02 Jun 2004 12:53:49 -0700 From: Alper Yegin Subject: RE: [Pana] PANA threats Issue 88 In-reply-to: <00c901c44820$3d635590$861167c0@adithya> To: "'Mohan Parthasarathy'" , pana@ietf.org Message-id: <007001c448db$540c0c90$9d1d9069@sisa.samsung.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-Mailer: Microsoft Outlook, Build 10.0.2627 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7BIT X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7BIT This looks good to me. Alper > > Resolution for Issue 88. > > I think the following is simple enough and should address the concern. > > Modify the section 6.1 last paragraph FROM: > > The advertisement may be used to include other information like > supported authentication methods etc., besides the discovery of the > PAA itself. This can lead to a bidding down attack, as a malicious > node can send a spoofed advertisement with capabilities that indicate > less secure authentication methods than what the real PAA supports, > thereby fooling the PaC into negotiating a less secure authentication > method than what would otherwise be available. This is best avoided > by limiting the amount of security-critical information sent during > the PAA discovery process. > > Requirement 1 > > PANA MUST not assume that the discovery process is protected. Since, > it is difficult to protect the discovery process, the security- > critical information exchanged during the discovery process SHOULD be > limited. > > TO > The advertisement may be used to include other information like > supported authentication methods etc., besides the discovery of the > PAA itself. This can lead to a bidding down attack, as a malicious > node can send a spoofed advertisement with capabilities that indicate > less secure authentication methods than what the real PAA supports, > thereby fooling the PaC into negotiating a less secure authentication > method than what would otherwise be available. > > Requirement 1 > > PANA MUST not assume that the discovery process is protected. > > Also update the summary at the end. > > Comments ? > > -mohan > > > > _______________________________________________ > Pana mailing list > Pana@ietf.org > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Thu Jun 3 20:25:56 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12767 for ; Thu, 3 Jun 2004 20:25:55 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BW2M0-000890-U8; Thu, 03 Jun 2004 20:14:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BW2B5-0004pM-3z for pana@megatron.ietf.org; Thu, 03 Jun 2004 20:03:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA11182 for ; Thu, 3 Jun 2004 20:03:17 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BW2B3-0006xf-9b for pana@ietf.org; Thu, 03 Jun 2004 20:03:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BW29s-0006TT-00 for pana@ietf.org; Thu, 03 Jun 2004 20:02:05 -0400 Received: from mailout1.samsung.com ([203.254.224.24]) by ietf-mx with esmtp (Exim 4.12) id 1BW28W-0005ae-00 for pana@ietf.org; Thu, 03 Jun 2004 20:00:41 -0400 Received: from custom-daemon.mailout1.samsung.com by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) id <0HYR00CEHC04YD@mailout1.samsung.com> for pana@ietf.org; Fri, 04 Jun 2004 09:00:04 +0900 (KST) Received: from ep_mmp1 (mailout1.samsung.com [203.254.224.24]) by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTP id <0HYR003QJBXPFY@mailout1.samsung.com> for pana@ietf.org; Fri, 04 Jun 2004 08:58:37 +0900 (KST) Received: from Alperyegin ([105.253.155.22]) by mmp1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTPA id <0HYR006IXBXMN6@mmp1.samsung.com> for pana@ietf.org; Fri, 04 Jun 2004 08:58:37 +0900 (KST) Date: Thu, 03 Jun 2004 16:58:32 -0700 From: Alper Yegin To: pana@ietf.org Message-id: <000001c449c6$aeb55c50$6401a8c0@sisa.samsung.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-Mailer: Microsoft Outlook, Build 10.0.2627 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7BIT Subject: [Pana] Cliff Wang's contact info X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7BIT Hello, I'm updating the PANA requirements draft. I know Cliff Wang's contact info has changed, but I don't have the latest, and I cannot reach him. Does anyone know how to reach him? Thanks. Alper _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Mon Jun 7 21:55:26 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09723 for ; Mon, 7 Jun 2004 21:55:26 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BXVgW-0002k1-NM; Mon, 07 Jun 2004 21:45:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BXVdZ-0001aP-22 for pana@megatron.ietf.org; Mon, 07 Jun 2004 21:42:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA08941 for ; Mon, 7 Jun 2004 21:42:47 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BXVdW-0002kQ-Va for pana@ietf.org; Mon, 07 Jun 2004 21:42:47 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BXVcY-00029l-00 for pana@ietf.org; Mon, 07 Jun 2004 21:41:46 -0400 Received: from smtp808.mail.sc5.yahoo.com ([66.163.168.187]) by ietf-mx with smtp (Exim 4.12) id 1BXVbK-00012Z-00 for pana@ietf.org; Mon, 07 Jun 2004 21:40:30 -0400 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@192.103.17.134 with login) by smtp808.mail.sc5.yahoo.com with SMTP; 8 Jun 2004 01:40:23 -0000 Message-ID: <01b401c44cf9$907ec010$861167c0@adithya> From: "Mohan Parthasarathy" To: Date: Mon, 7 Jun 2004 18:40:22 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Subject: [Pana] PANA threats Issue 89 X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7bit Hi, Following is the clarification text for Issue 89: Change the following text FROM: All the PaCs may be authenticated to the access network at layer 2 (e.g., 3GPP2 CDMA network) and share a security association with layer 2 authentication agent (e.g., 802.11 [IEEE-802.11] Access point), but still do not trust each other. TO: All the PaCs may be authenticated to the access network at layer 2 (e.g., 3GPP2 CDMA network) and share a security association with layer 2 authentication agent (e.g., 802.11 [IEEE-802.11] Access point). The PaCs still don't trust each other i.e., any PaC can pretend to be PAA, spoof IP addresses and launch various other attacks. Comments ? -mohan _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Mon Jun 7 21:55:47 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09742 for ; Mon, 7 Jun 2004 21:55:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BXVgX-0002k6-4X; Mon, 07 Jun 2004 21:45:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BXVdg-0001f2-Lz for pana@megatron.ietf.org; Mon, 07 Jun 2004 21:42:57 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA08971 for ; Mon, 7 Jun 2004 21:42:54 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BXVde-0002lO-RV for pana@ietf.org; Mon, 07 Jun 2004 21:42:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BXVci-0002BQ-00 for pana@ietf.org; Mon, 07 Jun 2004 21:41:56 -0400 Received: from smtp801.mail.sc5.yahoo.com ([66.163.168.180]) by ietf-mx with smtp (Exim 4.12) id 1BXVcB-0001bj-00 for pana@ietf.org; Mon, 07 Jun 2004 21:41:23 -0400 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@192.103.17.134 with login) by smtp801.mail.sc5.yahoo.com with SMTP; 8 Jun 2004 01:41:23 -0000 Message-ID: <01c301c44cf9$b42f1a50$861167c0@adithya> From: "Mohan Parthasarathy" To: "Alper Yegin" , References: <006f01c448da$a7381f40$9d1d9069@sisa.samsung.com> Subject: Re: [Pana] PANA threats Issue 86 Date: Mon, 7 Jun 2004 18:41:22 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7bit > > Hi, > > > > Following is the resolution to Issue 86: > > > > Include a new threat in Section 6.4: > > > > T6.4.2: PaC can leave the network without notifying the PAA or EP > > e.g., the Ethernet cable is unplugged, system crash. An > > attacker can > > pretend to be the PaC and start using the network. > > > > And change FROM: > > > > If the link is not shared, this threat is absent as > ingress > > filtering > > can prevent one node from impersonating as another node. > > > > TO: > > > > If the link is not shared, T6.4.1 is absent as ingress > > filtering can prevent > > one node from impersonating as another node. > > It might not be obvious why ingress filtering is relevant here. I think > what we mean is: > > "If the link is not shared, T6.4.1 is absent as there can only be one > client on the link, and ingress filtering can prevent attacker's use of > the authorized IP and MAC address on another link." > Ok. -thanks mohan > Alper > > > > Threat T6.4.2 is > > still possible > > as the disconnect may not be seen reliably by the network > > always. > > > > And Change the Requirement to drop "on shared links". Also, update the > > summary > > at the end. > > > > Comments ? > > > > -mohan > > > > > > > > _______________________________________________ > > Pana mailing list > > Pana@ietf.org > > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 8 18:50:57 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA04119 for ; Tue, 8 Jun 2004 18:50:57 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BXpEf-00013y-4Q; Tue, 08 Jun 2004 18:38:25 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BXohK-0002sm-Bs for pana@megatron.ietf.org; Tue, 08 Jun 2004 18:03:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA27551 for ; Tue, 8 Jun 2004 18:03:55 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BXohI-000151-Q3 for pana@ietf.org; Tue, 08 Jun 2004 18:03:56 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BXob7-0006du-00 for pana@ietf.org; Tue, 08 Jun 2004 17:57:35 -0400 Received: from mailout1.samsung.com ([203.254.224.24]) by ietf-mx with esmtp (Exim 4.12) id 1BXoV3-0003Q5-00 for pana@ietf.org; Tue, 08 Jun 2004 17:51:17 -0400 Received: from custom-daemon.mailout1.samsung.com by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) id <0HZ000I01FCMHS@mailout1.samsung.com> for pana@ietf.org; Wed, 09 Jun 2004 06:50:46 +0900 (KST) Received: from ep_mmp1 (mailout1.samsung.com [203.254.224.24]) by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTP id <0HZ0002GCFCMM2@mailout1.samsung.com> for pana@ietf.org; Wed, 09 Jun 2004 06:50:46 +0900 (KST) Received: from Alperyegin ([105.144.29.156]) by mmp1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTPA id <0HZ0006X1FCJ4Y@mmp1.samsung.com> for pana@ietf.org; Wed, 09 Jun 2004 06:50:46 +0900 (KST) Date: Tue, 08 Jun 2004 14:50:41 -0700 From: Alper Yegin Subject: Pasi's pana-04 comments (was RE: [Pana] Some comments about PANA drafts) In-reply-to: <052E0C61B69C3741AFA5FE88ACC775A6122422@esebe023.ntc.nokia.com> To: Pasi.Eronen@nokia.com, pana@ietf.org Message-id: <001c01c44da2$a5cfdb80$9c1d9069@sisa.samsung.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-Mailer: Microsoft Outlook, Build 10.0.2627 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7BIT X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7BIT Hi Pasi, Thank you for the review and the feedback. Let me walk through your comments on the pana-pana-04 document. > Comments draft-ietf-pana-pana-04: > > The document would probably benefit from explaining the "big > picture" first, e.g. what PANA messages are sent in a typical > situation (something like Section 4.6), and only then specific > details such as contents of PANA SA, calculation of MAC AVP and > processing of the S-flag. Right. We should beef up Section 3. [we shall open an issue on this and track it] > Section 4.1.5: Key derivation seems to assume that the integrity > protection algorithm needs at most 160 bit key (so if some new > algorithm later needs more, also the key derivation needs to be > updated). N=160 is based on the selected integrity algorithm, HMAC-SHA1. If the algorithm changes, we need to change N as well. Since an algorithm change would require a spec change anyways, I think setting the N value should be fine in this document. > Section 4.2: HMAC-SHA1 takes two parameters, not one OK, we shall fix that [another new issue]. > > Section 6.3: Diameter uses SMI enterprise numbers for Vendor-Id; > does PANA use that also, or does it define its own number space? Yes. We shall spell this out in the document [a new issue]. > Section 6.5.5 (Protection-Capability): Is it assumed that only a > single L2 mechanism can exist? Or that if multiple L2 mechanisms > are possible, the correct one can be determined from some L2 > messages? The latter. It is assumed that a shared key is sufficient to bootstrap L2 ciphering. > Section 6.5.13 (Provider-Identifier): What the client is > supposed to do with this information? This is used for ISP discovery and selection. And also separating ISP authentication from NAP authentication, when needed. These are discussed in Section 4.2 Discovery and Initial Handshake Phase > (And usually the > enterprise numbers are used to identify vendors, not network > operators--but of course a network operator could get an > enterprise number as well...) Hmmmm, we should verify that..... > > Section 7: The retransmission behavior seems quite complicated; > IMHO it would have been simpler to have one end (probably PaC) > to be responsible for all timer-based retransmissions. OK, let us look into this. > > Section 9: Overall, this section is quite heavy reading, and > it's not clear that someone not very familiar with PANA, EAP, > etc. can actually get a very accurate picture of the relevant > security properties of PANA. So this section would certainly > benefit from some editorial work. I agree [hence, a new issue for the tracker]. > > Part a (discovery message exchange) should probably explain that > if including Protection-Capability and PPAC AVPs in PSR is not > recommended, why are they allowed at all (especially since it > seems the client won't actually need the information until PBR > anyway). The recommendation is for networks that are susceptible to spoofing. Other types (e.g., physically secured networks) can use them. > This section should also mention that any information in PANA > messages before PBR/PBA (such as ISP-Information) can be > spoofed, and the implications of that. OK. >(BTW, perhaps it would > have been a good idea to integrity protect all previous PANA > messages in PBR/PBA.) Hmmm, sounds a little too heavy weight. Is this a generally recommended behavior for EAP lower layers? > > It should be clarified what exactly is meant when it's said that > a network is already "secure" before PANA is run. E.g. it seems > that such networks should have reasonably reliable disconnect > indications? What about ppreventing IP address spoofing? Yes, we should briefly expand that. Spoofing and eavesdropping should be prevented. Disconnect indication is needed unless the lower-layer security is based on a crypto scheme. IP address spoofing is not needed. [a new issue for the tracker]. > > References: Some of the normative references should probably be > informative (e.g. EAP-TLS). OK. [issue tracker] Thank you. Alper _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 8 21:23:36 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA16137 for ; Tue, 8 Jun 2004 21:23:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BXrf9-00087O-FW; Tue, 08 Jun 2004 21:13:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BXrbP-0006hl-Jj for pana@megatron.ietf.org; Tue, 08 Jun 2004 21:10:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA15433 for ; Tue, 8 Jun 2004 21:10:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BXrbN-0003AG-Hy for pana@ietf.org; Tue, 08 Jun 2004 21:10:01 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BXraQ-0002Ku-00 for pana@ietf.org; Tue, 08 Jun 2004 21:09:03 -0400 Received: from smtp806.mail.sc5.yahoo.com ([66.163.168.185]) by ietf-mx with smtp (Exim 4.12) id 1BXrZW-0001Vg-00 for pana@ietf.org; Tue, 08 Jun 2004 21:08:06 -0400 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@192.103.17.134 with login) by smtp806.mail.sc5.yahoo.com with SMTP; 9 Jun 2004 01:08:06 -0000 Message-ID: <01d401c44dbe$38cfe450$861167c0@adithya> From: "Mohan Parthasarathy" To: Date: Tue, 8 Jun 2004 18:08:06 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Subject: [Pana] PANA threats Issue 87 X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7bit Here is the resolution for Issue 87: Change FROM: It might be possible for the EP to filter out the packets coming from PaC that resembles PAA packets and hence this threat can be prevented in such environments. TO: In deployments where EP can police the data packets that are sent among the PaCs, it is possible to filter out the unauthorized PANA packets (e.g., PAA advertisements sent by a PaC) and prevent this threat. Comments ? -mohan _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 8 21:55:16 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA18135 for ; Tue, 8 Jun 2004 21:55:16 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BXsC4-0004Ka-Eg; Tue, 08 Jun 2004 21:47:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BXs6T-0001Uq-O9 for pana@megatron.ietf.org; Tue, 08 Jun 2004 21:42:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA17618 for ; Tue, 8 Jun 2004 21:42:07 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BXs6R-0002bK-DT for pana@ietf.org; Tue, 08 Jun 2004 21:42:07 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BXs5S-0001kk-00 for pana@ietf.org; Tue, 08 Jun 2004 21:41:07 -0400 Received: from mailout3.samsung.com ([203.254.224.33]) by ietf-mx with esmtp (Exim 4.12) id 1BXs4Q-00008N-00 for pana@ietf.org; Tue, 08 Jun 2004 21:40:02 -0400 Received: from custom-daemon.mailout3.samsung.com by mailout3.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) id <0HZ000AS2PXUAS@mailout3.samsung.com> for pana@ietf.org; Wed, 09 Jun 2004 10:39:30 +0900 (KST) Received: from ep_mmp2 (mailout3.samsung.com [203.254.224.33]) by mailout3.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTP id <0HZ000ENDPW52O@mailout3.samsung.com> for pana@ietf.org; Wed, 09 Jun 2004 10:38:29 +0900 (KST) Received: from Alperyegin ([105.144.29.156]) by mmp2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTPA id <0HZ00001DPW2PK@mmp2.samsung.com> for pana@ietf.org; Wed, 09 Jun 2004 10:38:28 +0900 (KST) Date: Tue, 08 Jun 2004 18:38:23 -0700 From: Alper Yegin Subject: RE: [Pana] PANA threats Issue 89 In-reply-to: <01b401c44cf9$907ec010$861167c0@adithya> To: "'Mohan Parthasarathy'" , pana@ietf.org Message-id: <00bf01c44dc2$74e4c380$9c1d9069@sisa.samsung.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-Mailer: Microsoft Outlook, Build 10.0.2627 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7BIT X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7BIT > TO: > > All the PaCs may be authenticated to the access network at > layer 2 (e.g., 3GPP2 CDMA network) and share a security > association with layer 2 authentication agent (e.g., 802.11 > [IEEE-802.11] Access point). The PaCs still don't trust each > other i.e., any PaC can pretend to be PAA, spoof > IP addresses and launch various other attacks. I think we should align the examples in the text, such as "(e.g., 3GPP2 cdma2000 network)" and "(e.g., base transceiver subsystem - BTS)". Alper _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Wed Jun 9 11:46:21 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22813 for ; Wed, 9 Jun 2004 11:46:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4w3-0008NF-09; Wed, 09 Jun 2004 11:24:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4dY-0001dy-Bl for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:05:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10223 for ; Wed, 9 Jun 2004 07:47:29 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BY1YH-0002sx-V1 for pana@ietf.org; Wed, 09 Jun 2004 07:47:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BY1XG-00023C-00 for pana@ietf.org; Wed, 09 Jun 2004 07:46:26 -0400 Received: from mgw-x2.nokia.com ([131.228.20.22]) by ietf-mx with esmtp (Exim 4.12) id 1BY1WO-0001Dl-00 for pana@ietf.org; Wed, 09 Jun 2004 07:45:32 -0400 Received: from esdks001.ntc.nokia.com (esdks001.ntc.nokia.com [172.21.138.120]) by mgw-x2.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59BjUH09080 for ; Wed, 9 Jun 2004 14:45:30 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 14:45:19 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks001.ntc.nokia.com (8.12.9/8.12.9) id i59BjJSX017673 for ; Wed, 9 Jun 2004 14:45:19 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks001.ntc.nokia.com 00MGJPos; Wed, 09 Jun 2004 14:45:17 EEST Received: from esebh003.NOE.Nokia.com (esebh003.ntc.nokia.com [172.21.138.82]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59BimH07077 for ; Wed, 9 Jun 2004 14:44:48 +0300 (EET DST) Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh003.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 14:43:47 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 14:43:46 +0300 Message-ID: Thread-Topic: [issue92] HMAC-SHA1 parameters Thread-Index: AcRN6kdMHVGpCSFPTFqwVkP0bwU2rwAAZFkQ To: X-OriginalArrivalTime: 09 Jun 2004 11:43:47.0968 (UTC) FILETIME=[06DE9000:01C44E17] X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL, NO_REAL_NAME autolearn=no version=2.60 Subject: [Pana] [issue92] HMAC-SHA1 parameters X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1190900840==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============1190900840== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQpGcm9tIFBhc2kgRXJvbmVuOg0KPiBTZWN0aW9uIDQuMjogSE1BQy1TSEExIHRha2VzIHR3 byBwYXJhbWV0ZXJzLCBub3Qgb25lLg0KDQotLS0tLS0tLS0tDQpjYXRlZ29yeTogVGVjaG5pY2Fs DQpkb2N1bWVudDogZHJhZnQtaWV0Zi1wYW5hLXBhbmEtMDQudHh0DQptZXNzYWdlczogMzE5DQpu b3N5OiBkZm9yc2Jlcg0KcHJpb3JpdHk6IE11c3QgRml4DQpzdGF0dXM6IFBlbmRpbmcNCnRpdGxl OiBITUFDLVNIQTEgcGFyYW1ldGVycw0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NClBBTkEgSXNzdWVzIDxwYW5hX2lzc3Vlc0BkYW5mb3JzYmVyZy5p bmZvPg0KPGh0dHA6Ly9kYW5mb3JzYmVyZy5pbmZvOjgwODAvcGFuYS1pc3N1ZXMvaXNzdWU5Mj4N Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo= --===============1190900840== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============1190900840==-- From pana-bounces@ietf.org Wed Jun 9 11:46:58 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22834 for ; Wed, 9 Jun 2004 11:46:58 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4w3-0008Ns-OZ; Wed, 09 Jun 2004 11:24:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4dY-0001dy-FW for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:05:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10210 for ; Wed, 9 Jun 2004 07:47:25 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BY1YE-0002sW-GG for pana@ietf.org; Wed, 09 Jun 2004 07:47:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BY1XC-00022U-00 for pana@ietf.org; Wed, 09 Jun 2004 07:46:22 -0400 Received: from mgw-x2.nokia.com ([131.228.20.22]) by ietf-mx with esmtp (Exim 4.12) id 1BY1WD-0001CQ-00 for pana@ietf.org; Wed, 09 Jun 2004 07:45:21 -0400 Received: from esdks001.ntc.nokia.com (esdks001.ntc.nokia.com [172.21.138.120]) by mgw-x2.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59BjKH08762 for ; Wed, 9 Jun 2004 14:45:20 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 14:45:13 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks001.ntc.nokia.com (8.12.9/8.12.9) id i59BjDxo017253 for ; Wed, 9 Jun 2004 14:45:13 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks001.ntc.nokia.com 00CKghil; Wed, 09 Jun 2004 14:45:12 EEST Received: from esebh003.NOE.Nokia.com (esebh003.ntc.nokia.com [172.21.138.82]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59Bj3H07397 for ; Wed, 9 Jun 2004 14:45:03 +0300 (EET DST) Received: from esebh005.NOE.Nokia.com ([172.21.138.86]) by esebh003.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 14:45:02 +0300 Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh005.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 14:45:02 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 14:44:30 +0300 Message-ID: Thread-Topic: [issue96] Normative references Thread-Index: AcRN62tv1ADUwO29TiOupO4pJfTsWwAAIY8w To: X-OriginalArrivalTime: 09 Jun 2004 11:45:02.0617 (UTC) FILETIME=[335D1890:01C44E17] X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL, NO_REAL_NAME autolearn=no version=2.60 Subject: [Pana] [issue96] Normative references X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1445588180==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============1445588180== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQpGcm9tIFBhc2kgRXJvbmVuOg0KPiBSZWZlcmVuY2VzOiBTb21lIG9mIHRoZSBub3JtYXRp dmUgcmVmZXJlbmNlcyBzaG91bGQgcHJvYmFibHkgYmUNCj4gaW5mb3JtYXRpdmUgKGUuZy4gRUFQ LVRMUykuDQoNCi0tLS0tLS0tLS0NCmNhdGVnb3J5OiBFZGl0b3JpYWwNCmRvY3VtZW50OiBkcmFm dC1pZXRmLXBhbmEtcGFuYS0wNC50eHQNCm1lc3NhZ2VzOiAzMjMNCm5vc3k6IGRmb3JzYmVyDQpw cmlvcml0eTogTXVzdCBGaXgNCnN0YXR1czogUGVuZGluZw0KdGl0bGU6IE5vcm1hdGl2ZSByZWZl cmVuY2VzDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KUEFOQSBJc3N1ZXMgPHBhbmFfaXNzdWVzQGRhbmZvcnNiZXJnLmluZm8+DQo8aHR0cDovL2Rh bmZvcnNiZXJnLmluZm86ODA4MC9wYW5hLWlzc3Vlcy9pc3N1ZTk2Pg0KX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg== --===============1445588180== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============1445588180==-- From pana-bounces@ietf.org Wed Jun 9 11:47:11 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22852 for ; Wed, 9 Jun 2004 11:47:11 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4w4-0008O4-2w; Wed, 09 Jun 2004 11:24:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4dY-0001dy-T8 for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:05:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10169 for ; Wed, 9 Jun 2004 07:46:26 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BY1XH-00023K-4H for pana@ietf.org; Wed, 09 Jun 2004 07:46:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BY1WR-0001EF-00 for pana@ietf.org; Wed, 09 Jun 2004 07:45:35 -0400 Received: from mgw-x1.nokia.com ([131.228.20.21]) by ietf-mx with esmtp (Exim 4.12) id 1BY1Vb-0000OR-00 for pana@ietf.org; Wed, 09 Jun 2004 07:44:43 -0400 Received: from esdks004.ntc.nokia.com (esdks004.ntc.nokia.com [172.21.138.159]) by mgw-x1.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59Bigd18830 for ; Wed, 9 Jun 2004 14:44:42 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 14:44:32 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks004.ntc.nokia.com (8.12.9/8.12.9) id i59BiWJG025115 for ; Wed, 9 Jun 2004 14:44:32 +0300 Received: from mgw-int2.ntc.nokia.com (172.21.143.97) by esdks004.ntc.nokia.com 0011IN3F; Wed, 09 Jun 2004 14:44:26 EEST Received: from esebh004.NOE.Nokia.com (esebh004.ntc.nokia.com [172.21.138.84]) by mgw-int2.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59BiQH14448 for ; Wed, 9 Jun 2004 14:44:26 +0300 (EET DST) Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh004.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 14:44:00 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 14:43:59 +0300 Message-ID: Thread-Topic: [issue93] SMI enterprise numbers for Vendor-Id? Thread-Index: AcRN6kiOjTSxkxt1QDmdn0rGFWY+hwAAZgwQ To: X-OriginalArrivalTime: 09 Jun 2004 11:44:00.0247 (UTC) FILETIME=[0E303070:01C44E17] X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL, NO_REAL_NAME autolearn=no version=2.60 Subject: [Pana] [issue93] SMI enterprise numbers for Vendor-Id? X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1014449095==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============1014449095== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQpGcm9tIFBhc2kgRXJvbmVuOg0KPiBTZWN0aW9uIDYuMzogRGlhbWV0ZXIgdXNlcyBTTUkg ZW50ZXJwcmlzZSBudW1iZXJzIGZvciBWZW5kb3ItSWQ7DQo+IGRvZXMgUEFOQSB1c2UgdGhhdCBh bHNvLCBvciBkb2VzIGl0IGRlZmluZSBpdHMgb3duIG51bWJlciBzcGFjZT8NCg0KLS0tLS0tLS0t LQ0KY2F0ZWdvcnk6IFRlY2huaWNhbA0KZG9jdW1lbnQ6IGRyYWZ0LWlldGYtcGFuYS1wYW5hLTA0 LnR4dA0KbWVzc2FnZXM6IDMyMA0Kbm9zeTogZGZvcnNiZXINCnByaW9yaXR5OiBNdXN0IEZpeA0K c3RhdHVzOiBQZW5kaW5nDQp0aXRsZTogU01JIGVudGVycHJpc2UgbnVtYmVycyBmb3IgVmVuZG9y LUlkPw0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18N ClBBTkEgSXNzdWVzIDxwYW5hX2lzc3Vlc0BkYW5mb3JzYmVyZy5pbmZvPg0KPGh0dHA6Ly9kYW5m b3JzYmVyZy5pbmZvOjgwODAvcGFuYS1pc3N1ZXMvaXNzdWU5Mz4NCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo= --===============1014449095== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============1014449095==-- From pana-bounces@ietf.org Wed Jun 9 11:47:31 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22871 for ; Wed, 9 Jun 2004 11:47:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4w4-0008OO-GR; Wed, 09 Jun 2004 11:24:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4da-0001dy-2F for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:05:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10226 for ; Wed, 9 Jun 2004 07:47:30 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BY1YI-0002t3-JE for pana@ietf.org; Wed, 09 Jun 2004 07:47:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BY1XH-00023P-00 for pana@ietf.org; Wed, 09 Jun 2004 07:46:27 -0400 Received: from mgw-x3.nokia.com ([131.228.20.26]) by ietf-mx with esmtp (Exim 4.12) id 1BY1Wb-0001EO-00 for pana@ietf.org; Wed, 09 Jun 2004 07:45:46 -0400 Received: from esdks001.ntc.nokia.com (esdks001.ntc.nokia.com [172.21.138.120]) by mgw-x3.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59BjiJ18150 for ; Wed, 9 Jun 2004 14:45:44 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 14:45:33 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks001.ntc.nokia.com (8.12.9/8.12.9) id i59BjX8g018544 for ; Wed, 9 Jun 2004 14:45:33 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks001.ntc.nokia.com 00hPBNeS; Wed, 09 Jun 2004 14:45:31 EEST Received: from esebh004.NOE.Nokia.com (esebh004.ntc.nokia.com [172.21.138.84]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59BjQH07936 for ; Wed, 9 Jun 2004 14:45:26 +0300 (EET DST) Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh004.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 14:45:07 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 14:44:49 +0300 Message-ID: Thread-Topic: [issue97] Retransmission behaviour check Thread-Index: AcRN7kVeu3GO2d65R/+rIKgWjDkU2wAA4N/A To: X-OriginalArrivalTime: 09 Jun 2004 11:45:07.0386 (UTC) FILETIME=[3634C9A0:01C44E17] X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL, NO_REAL_NAME autolearn=no version=2.60 Subject: [Pana] [issue97] Retransmission behaviour check X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1536397191==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============1536397191== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQpGcm9tIFBhc2kgRXJvbmVuOg0KPiBTZWN0aW9uIDc6IFRoZSByZXRyYW5zbWlzc2lvbiBi ZWhhdmlvciBzZWVtcyBxdWl0ZSBjb21wbGljYXRlZDsNCj4gSU1ITyBpdCB3b3VsZCBoYXZlIGJl ZW4gc2ltcGxlciB0byBoYXZlIG9uZSBlbmQgKHByb2JhYmx5IFBhQykNCj4gdG8gYmUgcmVzcG9u c2libGUgZm9yIGFsbCB0aW1lci1iYXNlZCByZXRyYW5zbWlzc2lvbnMuDQoNCi0tLS0tLS0tLS0N CmNhdGVnb3J5OiBUZWNobmljYWwNCmRvY3VtZW50OiBkcmFmdC1pZXRmLXBhbmEtcGFuYS14eC50 eHQNCm1lc3NhZ2VzOiAzMjUNCm5vc3k6IGRmb3JzYmVyDQpwcmlvcml0eTogTWF5IEZpeA0Kc3Rh dHVzOiBQZW5kaW5nDQp0aXRsZTogUmV0cmFuc21pc3Npb24gYmVoYXZpb3VyIGNoZWNrDQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KUEFOQSBJc3N1 ZXMgPHBhbmFfaXNzdWVzQGRhbmZvcnNiZXJnLmluZm8+DQo8aHR0cDovL2RhbmZvcnNiZXJnLmlu Zm86ODA4MC9wYW5hLWlzc3Vlcy9pc3N1ZTk3Pg0KX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18NCg== --===============1536397191== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============1536397191==-- From pana-bounces@ietf.org Wed Jun 9 11:48:15 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22961 for ; Wed, 9 Jun 2004 11:48:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4w6-0008Pp-AW; Wed, 09 Jun 2004 11:24:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4db-0001dy-3C for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:05:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10200 for ; Wed, 9 Jun 2004 07:47:24 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BY1YC-0002sJ-PP for pana@ietf.org; Wed, 09 Jun 2004 07:47:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BY1XA-00022A-00 for pana@ietf.org; Wed, 09 Jun 2004 07:46:20 -0400 Received: from mgw-x1.nokia.com ([131.228.20.21]) by ietf-mx with esmtp (Exim 4.12) id 1BY1W7-000129-00 for pana@ietf.org; Wed, 09 Jun 2004 07:45:15 -0400 Received: from esdks001.ntc.nokia.com (esdks001.ntc.nokia.com [172.21.138.120]) by mgw-x1.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59BjEd19472 for ; Wed, 9 Jun 2004 14:45:14 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 14:44:57 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks001.ntc.nokia.com (8.12.9/8.12.9) id i59BivoT016248 for ; Wed, 9 Jun 2004 14:44:57 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks001.ntc.nokia.com 00ZVEfwW; Wed, 09 Jun 2004 14:44:57 EEST Received: from esebh003.NOE.Nokia.com (esebh003.ntc.nokia.com [172.21.138.82]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59BimH07075 for ; Wed, 9 Jun 2004 14:44:48 +0300 (EET DST) Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh003.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 14:43:34 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 14:43:32 +0300 Message-ID: Thread-Topic: [issue91] Big picture Thread-Index: AcRN6d7H/7MjDn9BQNWn+XQ/EHztcQAAfGIw To: X-OriginalArrivalTime: 09 Jun 2004 11:43:34.0041 (UTC) FILETIME=[FE917890:01C44E16] X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL, NO_REAL_NAME autolearn=no version=2.60 Subject: [Pana] [issue91] Big picture X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0688264266==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============0688264266== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQpGcm9tIFBhc2kgRXJvbmVuOg0KPiBUaGUgZG9jdW1lbnQgd291bGQgcHJvYmFibHkgYmVu ZWZpdCBmcm9tIGV4cGxhaW5pbmcgdGhlICJiaWcNCj4gcGljdHVyZSIgZmlyc3QsIGUuZy4gd2hh dCBQQU5BIG1lc3NhZ2VzIGFyZSBzZW50IGluIGEgdHlwaWNhbA0KPiBzaXR1YXRpb24gKHNvbWV0 aGluZyBsaWtlIFNlY3Rpb24gNC42KSwgYW5kIG9ubHkgdGhlbiBzcGVjaWZpYw0KPiBkZXRhaWxz IHN1Y2ggYXMgY29udGVudHMgb2YgUEFOQSBTQSwgY2FsY3VsYXRpb24gb2YgTUFDIEFWUCBhbmQN Cj4gcHJvY2Vzc2luZyBvZiB0aGUgUy1mbGFnLg0KDQotLS0tLS0tLS0tDQpjYXRlZ29yeTogRWRp dG9yaWFsDQpkb2N1bWVudDogZHJhZnQtaWV0Zi1wYW5hLXBhbmEtMDQudHh0DQptZXNzYWdlczog MzE4DQpub3N5OiBkZm9yc2Jlcg0KcHJpb3JpdHk6IFNob3VsZCBGaXgNCnN0YXR1czogUGVuZGlu Zw0KdGl0bGU6IEJpZyBwaWN0dXJlDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXw0KUEFOQSBJc3N1ZXMgPHBhbmFfaXNzdWVzQGRhbmZvcnNiZXJnLmlu Zm8+DQo8aHR0cDovL2RhbmZvcnNiZXJnLmluZm86ODA4MC9wYW5hLWlzc3Vlcy9pc3N1ZTkxPg0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg== --===============0688264266== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============0688264266==-- From pana-bounces@ietf.org Wed Jun 9 11:50:00 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23180 for ; Wed, 9 Jun 2004 11:49:59 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4w9-0008SW-4o; Wed, 09 Jun 2004 11:24:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4dc-0001dy-Bi for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:05:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10220 for ; Wed, 9 Jun 2004 07:47:28 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BY1YH-0002ss-Ae for pana@ietf.org; Wed, 09 Jun 2004 07:47:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BY1XF-000234-00 for pana@ietf.org; Wed, 09 Jun 2004 07:46:25 -0400 Received: from mgw-x1.nokia.com ([131.228.20.21]) by ietf-mx with esmtp (Exim 4.12) id 1BY1WL-0001DU-00 for pana@ietf.org; Wed, 09 Jun 2004 07:45:29 -0400 Received: from esdks004.ntc.nokia.com (esdks004.ntc.nokia.com [172.21.138.159]) by mgw-x1.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59BjSd19785 for ; Wed, 9 Jun 2004 14:45:28 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 14:45:23 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks004.ntc.nokia.com (8.12.9/8.12.9) id i59BjN8d028015 for ; Wed, 9 Jun 2004 14:45:23 +0300 Received: from mgw-int2.ntc.nokia.com (172.21.143.97) by esdks004.ntc.nokia.com 00iM7FIl; Wed, 09 Jun 2004 14:45:22 EEST Received: from esebh002.NOE.Nokia.com (esebh002.ntc.nokia.com [172.21.138.77]) by mgw-int2.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59BjHH15289 for ; Wed, 9 Jun 2004 14:45:17 +0300 (EET DST) Received: from esebh005.NOE.Nokia.com ([172.21.138.86]) by esebh002.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 14:44:18 +0300 Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh005.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 14:44:19 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 14:44:18 +0300 Message-ID: Thread-Topic: [issue95] Meaning of "secure network" Thread-Index: AcRN6yQ2dXA7Ii9UQxmG8aHMSuLBDAAAMRDw To: X-OriginalArrivalTime: 09 Jun 2004 11:44:19.0163 (UTC) FILETIME=[19768AB0:01C44E17] X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL, NO_REAL_NAME autolearn=no version=2.60 Subject: [Pana] [issue95] Meaning of "secure network" X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0935371618==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============0935371618== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQo+IEZyb20gUGFzaSBFcm9uZW46DQo+IEl0IHNob3VsZCBiZSBjbGFyaWZpZWQgd2hhdCBl eGFjdGx5IGlzIG1lYW50IHdoZW4gaXQncyBzYWlkIHRoYXQNCj4gYSBuZXR3b3JrIGlzIGFscmVh ZHkgInNlY3VyZSIgYmVmb3JlIFBBTkEgaXMgcnVuLiBFLmcuIGl0IHNlZW1zDQo+IHRoYXQgc3Vj aCBuZXR3b3JrcyBzaG91bGQgaGF2ZSByZWFzb25hYmx5IHJlbGlhYmxlIGRpc2Nvbm5lY3QNCj4g aW5kaWNhdGlvbnM/IFdoYXQgYWJvdXQgcHByZXZlbnRpbmcgSVAgYWRkcmVzcyBzcG9vZmluZz8N Cg0KQWxwZXIgWWVnaW46DQpZZXMsIHdlIHNob3VsZCBicmllZmx5IGV4cGFuZCB0aGF0LiBTcG9v ZmluZyBhbmQgZWF2ZXNkcm9wcGluZyBzaG91bGQgYmUNCnByZXZlbnRlZC4gRGlzY29ubmVjdCBp bmRpY2F0aW9uIGlzIG5lZWRlZCB1bmxlc3MgdGhlIGxvd2VyLWxheWVyDQpzZWN1cml0eSBpcyBi YXNlZCBvbiBhIGNyeXB0byBzY2hlbWUuIElQIGFkZHJlc3Mgc3Bvb2ZpbmcgaXMgbm90IG5lZWRl ZC4NClthIG5ldyBpc3N1ZSBmb3IgdGhlIHRyYWNrZXJdLg0KDQotLS0tLS0tLS0tDQpjYXRlZ29y eTogRWRpdG9yaWFsDQpkb2N1bWVudDogZHJhZnQtaWV0Zi1wYW5hLXBhbmEtMDQudHh0DQptZXNz YWdlczogMzIyDQpub3N5OiBkZm9yc2Jlcg0KcHJpb3JpdHk6IE11c3QgRml4DQpzdGF0dXM6IFBl bmRpbmcNCnRpdGxlOiBNZWFuaW5nIG9mICJzZWN1cmUgbmV0d29yayINCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpQQU5BIElzc3VlcyA8cGFuYV9p c3N1ZXNAZGFuZm9yc2JlcmcuaW5mbz4NCjxodHRwOi8vZGFuZm9yc2JlcmcuaW5mbzo4MDgwL3Bh bmEtaXNzdWVzL2lzc3VlOTU+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXw0K --===============0935371618== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============0935371618==-- From pana-bounces@ietf.org Wed Jun 9 11:50:12 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23235 for ; Wed, 9 Jun 2004 11:50:11 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4w9-0008Si-Ct; Wed, 09 Jun 2004 11:24:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY4dc-0001dy-Dg for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:05:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10122 for ; Wed, 9 Jun 2004 07:45:26 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BY1WJ-0001DE-Fn for pana@ietf.org; Wed, 09 Jun 2004 07:45:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BY1VK-0000Mo-00 for pana@ietf.org; Wed, 09 Jun 2004 07:44:27 -0400 Received: from mgw-x2.nokia.com ([131.228.20.22]) by ietf-mx with esmtp (Exim 4.12) id 1BY1U6-0006zn-00 for pana@ietf.org; Wed, 09 Jun 2004 07:43:10 -0400 Received: from esdks001.ntc.nokia.com (esdks001.ntc.nokia.com [172.21.138.120]) by mgw-x2.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59Bh9H05705 for ; Wed, 9 Jun 2004 14:43:09 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 14:43:08 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks001.ntc.nokia.com (8.12.9/8.12.9) id i59Bh88c009945 for ; Wed, 9 Jun 2004 14:43:08 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks001.ntc.nokia.com 00eI9qSc; Wed, 09 Jun 2004 14:43:06 EEST Received: from esebh002.NOE.Nokia.com (esebh002.ntc.nokia.com [172.21.138.77]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i59BgeH04119 for ; Wed, 9 Jun 2004 14:42:40 +0300 (EET DST) Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh002.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 14:42:37 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 14:42:36 +0300 Message-ID: Thread-Topic: [issue94] Chapter 9 editorial work Thread-Index: AcRN65czuPAeVCjLSRyc/jQO6x5ozAAABPzA To: X-OriginalArrivalTime: 09 Jun 2004 11:42:37.0368 (UTC) FILETIME=[DCC9DB80:01C44E16] X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL, NO_REAL_NAME autolearn=no version=2.60 Subject: [Pana] [issue94] Chapter 9 editorial work X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1560527465==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============1560527465== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQo+IEZyb20gUGFzaSBFcm9uZW46DQo+IFNlY3Rpb24gOTogT3ZlcmFsbCwgdGhpcyBzZWN0 aW9uIGlzIHF1aXRlIGhlYXZ5IHJlYWRpbmcsIGFuZA0KPiBpdCdzIG5vdCBjbGVhciB0aGF0IHNv bWVvbmUgbm90IHZlcnkgZmFtaWxpYXIgd2l0aCBQQU5BLCBFQVAsDQo+IGV0Yy4gY2FuIGFjdHVh bGx5IGdldCBhIHZlcnkgYWNjdXJhdGUgcGljdHVyZSBvZiB0aGUgcmVsZXZhbnQNCj4gc2VjdXJp dHkgcHJvcGVydGllcyBvZiBQQU5BLiBTbyB0aGlzIHNlY3Rpb24gd291bGQgY2VydGFpbmx5DQo+ IGJlbmVmaXQgZnJvbSBzb21lIGVkaXRvcmlhbCB3b3JrLg0KDQpBbHBlcjoNCkkgYWdyZWUgW2hl bmNlLCBhIG5ldyBpc3N1ZSBmb3IgdGhlIHRyYWNrZXJdLg0KDQo+IA0KPiBQYXJ0IGEgKGRpc2Nv dmVyeSBtZXNzYWdlIGV4Y2hhbmdlKSBzaG91bGQgcHJvYmFibHkgZXhwbGFpbiB0aGF0DQo+IGlm IGluY2x1ZGluZyBQcm90ZWN0aW9uLUNhcGFiaWxpdHkgYW5kIFBQQUMgQVZQcyBpbiBQU1IgaXMg bm90DQo+IHJlY29tbWVuZGVkLCB3aHkgYXJlIHRoZXkgYWxsb3dlZCBhdCBhbGwgKGVzcGVjaWFs bHkgc2luY2UgaXQNCj4gc2VlbXMgdGhlIGNsaWVudCB3b24ndCBhY3R1YWxseSBuZWVkIHRoZSBp bmZvcm1hdGlvbiB1bnRpbCBQQlINCj4gYW55d2F5KS4NCg0KVGhlIHJlY29tbWVuZGF0aW9uIGlz IGZvciBuZXR3b3JrcyB0aGF0IGFyZSBzdXNjZXB0aWJsZSB0byBzcG9vZmluZy4NCk90aGVyIHR5 cGVzIChlLmcuLCBwaHlzaWNhbGx5IHNlY3VyZWQgbmV0d29ya3MpIGNhbiB1c2UgdGhlbS4NCg0K PiBUaGlzIHNlY3Rpb24gc2hvdWxkIGFsc28gbWVudGlvbiB0aGF0IGFueSBpbmZvcm1hdGlvbiBp biBQQU5BDQo+IG1lc3NhZ2VzIGJlZm9yZSBQQlIvUEJBIChzdWNoIGFzIElTUC1JbmZvcm1hdGlv bikgY2FuIGJlDQo+IHNwb29mZWQsIGFuZCB0aGUgaW1wbGljYXRpb25zIG9mIHRoYXQuIA0KDQpP Sy4NCg0KLS0tLS0tLS0tLQ0KY2F0ZWdvcnk6IEVkaXRvcmlhbA0KZG9jdW1lbnQ6IGRyYWZ0LWll dGYtcGFuYS1wYW5hLTA0LnR4dA0KbWVzc2FnZXM6IDMyMQ0Kbm9zeTogZGZvcnNiZXINCnByaW9y aXR5OiBTaG91bGQgRml4DQpzdGF0dXM6IFBlbmRpbmcNCnRpdGxlOiBDaGFwdGVyIDkgZWRpdG9y aWFsIHdvcmsNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fDQpQQU5BIElzc3VlcyA8cGFuYV9pc3N1ZXNAZGFuZm9yc2JlcmcuaW5mbz4NCjxodHRwOi8v ZGFuZm9yc2JlcmcuaW5mbzo4MDgwL3BhbmEtaXNzdWVzL2lzc3VlOTQ+DQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K --===============1560527465== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============1560527465==-- From pana-bounces@ietf.org Wed Jun 9 13:16:55 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA00041 for ; Wed, 9 Jun 2004 13:16:55 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5r0-0001Js-4o; Wed, 09 Jun 2004 12:23:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5Sa-0000NP-MK for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:57:52 -0400 Received: from mgw-x3.nokia.com (mgw-x3.nokia.com [131.228.20.26]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA29447 for ; Wed, 9 Jun 2004 02:53:35 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from esdks003.ntc.nokia.com (esdks003.ntc.nokia.com [172.21.138.158]) by mgw-x3.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596rXJ19916 for ; Wed, 9 Jun 2004 09:53:33 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 09:53:08 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks003.ntc.nokia.com (8.12.9/8.12.9) id i596r8nR012511 for ; Wed, 9 Jun 2004 09:53:08 +0300 Received: from mgw-int2.ntc.nokia.com (172.21.143.97) by esdks003.ntc.nokia.com 00tFbvcw; Wed, 09 Jun 2004 09:53:06 EEST Received: from esebh002.NOE.Nokia.com (esebh002.ntc.nokia.com [172.21.138.77]) by mgw-int2.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596Z9H29636 for ; Wed, 9 Jun 2004 09:35:09 +0300 (EET DST) Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh002.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 09:35:07 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 09:35:05 +0300 Message-ID: Thread-Topic: [issue93] SMI enterprise numbers for Vendor-Id? Thread-Index: AcRN6kiOjTSxkxt1QDmdn0rGFWY+hwAAZgwQ To: X-OriginalArrivalTime: 09 Jun 2004 06:35:07.0665 (UTC) FILETIME=[E7E89810:01C44DEB] Subject: [Pana] [issue93] SMI enterprise numbers for Vendor-Id? X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1446754568==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============1446754568== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQpGcm9tIFBhc2kgRXJvbmVuOg0KPiBTZWN0aW9uIDYuMzogRGlhbWV0ZXIgdXNlcyBTTUkg ZW50ZXJwcmlzZSBudW1iZXJzIGZvciBWZW5kb3ItSWQ7DQo+IGRvZXMgUEFOQSB1c2UgdGhhdCBh bHNvLCBvciBkb2VzIGl0IGRlZmluZSBpdHMgb3duIG51bWJlciBzcGFjZT8NCg0KLS0tLS0tLS0t LQ0KY2F0ZWdvcnk6IFRlY2huaWNhbA0KZG9jdW1lbnQ6IGRyYWZ0LWlldGYtcGFuYS1wYW5hLTA0 LnR4dA0KbWVzc2FnZXM6IDMyMA0Kbm9zeTogZGZvcnNiZXINCnByaW9yaXR5OiBNdXN0IEZpeA0K c3RhdHVzOiBQZW5kaW5nDQp0aXRsZTogU01JIGVudGVycHJpc2UgbnVtYmVycyBmb3IgVmVuZG9y LUlkPw0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18N ClBBTkEgSXNzdWVzIDxwYW5hX2lzc3Vlc0BkYW5mb3JzYmVyZy5pbmZvPg0KPGh0dHA6Ly9kYW5m b3JzYmVyZy5pbmZvOjgwODAvcGFuYS1pc3N1ZXMvaXNzdWU5Mz4NCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo= --===============1446754568== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============1446754568==-- From pana-bounces@ietf.org Wed Jun 9 13:17:19 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA00061 for ; Wed, 9 Jun 2004 13:17:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5r8-0001Mh-5t; Wed, 09 Jun 2004 12:23:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5Se-0007uq-IT for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:57:56 -0400 Received: from mgw-x2.nokia.com (mgw-x2.nokia.com [131.228.20.22]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA00400 for ; Wed, 9 Jun 2004 03:18:47 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from esdks003.ntc.nokia.com (esdks003.ntc.nokia.com [172.21.138.158]) by mgw-x2.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i597IlH00895 for ; Wed, 9 Jun 2004 10:18:47 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 10:18:44 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks003.ntc.nokia.com (8.12.9/8.12.9) id i597IiWI014261 for ; Wed, 9 Jun 2004 10:18:44 +0300 Received: from mgw-int2.ntc.nokia.com (172.21.143.97) by esdks003.ntc.nokia.com 00kW2FVk; Wed, 09 Jun 2004 10:18:33 EEST Received: from esebh001.NOE.Nokia.com (esebh001.ntc.nokia.com [172.21.138.28]) by mgw-int2.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i597IUH28753 for ; Wed, 9 Jun 2004 10:18:30 +0300 (EET DST) Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh001.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 10:17:25 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 10:17:23 +0300 Message-ID: Thread-Topic: [issue97] Retransmission behaviour check Thread-Index: AcRN7kVeu3GO2d65R/+rIKgWjDkU2wAA4N/A To: X-OriginalArrivalTime: 09 Jun 2004 07:17:25.0396 (UTC) FILETIME=[D0839D40:01C44DF1] Subject: [Pana] [issue97] Retransmission behaviour check X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0756124822==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============0756124822== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQpGcm9tIFBhc2kgRXJvbmVuOg0KPiBTZWN0aW9uIDc6IFRoZSByZXRyYW5zbWlzc2lvbiBi ZWhhdmlvciBzZWVtcyBxdWl0ZSBjb21wbGljYXRlZDsNCj4gSU1ITyBpdCB3b3VsZCBoYXZlIGJl ZW4gc2ltcGxlciB0byBoYXZlIG9uZSBlbmQgKHByb2JhYmx5IFBhQykNCj4gdG8gYmUgcmVzcG9u c2libGUgZm9yIGFsbCB0aW1lci1iYXNlZCByZXRyYW5zbWlzc2lvbnMuDQoNCi0tLS0tLS0tLS0N CmNhdGVnb3J5OiBUZWNobmljYWwNCmRvY3VtZW50OiBkcmFmdC1pZXRmLXBhbmEtcGFuYS14eC50 eHQNCm1lc3NhZ2VzOiAzMjUNCm5vc3k6IGRmb3JzYmVyDQpwcmlvcml0eTogTWF5IEZpeA0Kc3Rh dHVzOiBQZW5kaW5nDQp0aXRsZTogUmV0cmFuc21pc3Npb24gYmVoYXZpb3VyIGNoZWNrDQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KUEFOQSBJc3N1 ZXMgPHBhbmFfaXNzdWVzQGRhbmZvcnNiZXJnLmluZm8+DQo8aHR0cDovL2RhbmZvcnNiZXJnLmlu Zm86ODA4MC9wYW5hLWlzc3Vlcy9pc3N1ZTk3Pg0KX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18NCg== --===============0756124822== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============0756124822==-- From pana-bounces@ietf.org Wed Jun 9 13:19:33 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA00281 for ; Wed, 9 Jun 2004 13:19:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5rc-0001jj-1a; Wed, 09 Jun 2004 12:23:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5Sl-0000cK-VN for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:58:03 -0400 Received: from mgw-x1.nokia.com (mgw-x1.nokia.com [131.228.20.21]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA28683 for ; Wed, 9 Jun 2004 02:35:12 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from esdks004.ntc.nokia.com (esdks004.ntc.nokia.com [172.21.138.159]) by mgw-x1.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596ZCd10894 for ; Wed, 9 Jun 2004 09:35:12 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 09:35:04 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks004.ntc.nokia.com (8.12.9/8.12.9) id i596Z4IP014539 for ; Wed, 9 Jun 2004 09:35:04 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks004.ntc.nokia.com 00JlSvKo; Wed, 09 Jun 2004 09:34:57 EEST Received: from esebh003.NOE.Nokia.com (esebh003.ntc.nokia.com [172.21.138.82]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596YtH27493 for ; Wed, 9 Jun 2004 09:34:55 +0300 (EET DST) Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh003.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 09:34:53 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 09:34:53 +0300 Message-ID: Thread-Topic: [issue92] HMAC-SHA1 parameters Thread-Index: AcRN6kdMHVGpCSFPTFqwVkP0bwU2rwAAZFkQ To: X-OriginalArrivalTime: 09 Jun 2004 06:34:53.0339 (UTC) FILETIME=[DF5E9EB0:01C44DEB] Subject: [Pana] [issue92] HMAC-SHA1 parameters X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0874316085==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============0874316085== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQpGcm9tIFBhc2kgRXJvbmVuOg0KPiBTZWN0aW9uIDQuMjogSE1BQy1TSEExIHRha2VzIHR3 byBwYXJhbWV0ZXJzLCBub3Qgb25lLg0KDQotLS0tLS0tLS0tDQpjYXRlZ29yeTogVGVjaG5pY2Fs DQpkb2N1bWVudDogZHJhZnQtaWV0Zi1wYW5hLXBhbmEtMDQudHh0DQptZXNzYWdlczogMzE5DQpu b3N5OiBkZm9yc2Jlcg0KcHJpb3JpdHk6IE11c3QgRml4DQpzdGF0dXM6IFBlbmRpbmcNCnRpdGxl OiBITUFDLVNIQTEgcGFyYW1ldGVycw0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NClBBTkEgSXNzdWVzIDxwYW5hX2lzc3Vlc0BkYW5mb3JzYmVyZy5p bmZvPg0KPGh0dHA6Ly9kYW5mb3JzYmVyZy5pbmZvOjgwODAvcGFuYS1pc3N1ZXMvaXNzdWU5Mj4N Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo= --===============0874316085== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============0874316085==-- From pana-bounces@ietf.org Wed Jun 9 13:19:46 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA00322 for ; Wed, 9 Jun 2004 13:19:46 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5rc-0001kW-Ef; Wed, 09 Jun 2004 12:23:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5Sm-0000cK-3F for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:58:04 -0400 Received: from mgw-x1.nokia.com (mgw-x1.nokia.com [131.228.20.21]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA28747 for ; Wed, 9 Jun 2004 02:35:47 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from esdks004.ntc.nokia.com (esdks004.ntc.nokia.com [172.21.138.159]) by mgw-x1.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596Zkd11718 for ; Wed, 9 Jun 2004 09:35:47 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 09:35:45 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks004.ntc.nokia.com (8.12.9/8.12.9) id i596ZjlM016306 for ; Wed, 9 Jun 2004 09:35:45 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks004.ntc.nokia.com 00lY0UKR; Wed, 09 Jun 2004 09:35:43 EEST Received: from esebh001.NOE.Nokia.com (esebh001.ntc.nokia.com [172.21.138.28]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596ZgH28194 for ; Wed, 9 Jun 2004 09:35:42 +0300 (EET DST) Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh001.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 09:35:37 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 09:35:37 +0300 Message-ID: Thread-Topic: [issue96] Normative references Thread-Index: AcRN62tv1ADUwO29TiOupO4pJfTsWwAAIY8w To: X-OriginalArrivalTime: 09 Jun 2004 06:35:38.0006 (UTC) FILETIME=[F9FE4360:01C44DEB] Subject: [Pana] [issue96] Normative references X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0147746805==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============0147746805== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQpGcm9tIFBhc2kgRXJvbmVuOg0KPiBSZWZlcmVuY2VzOiBTb21lIG9mIHRoZSBub3JtYXRp dmUgcmVmZXJlbmNlcyBzaG91bGQgcHJvYmFibHkgYmUNCj4gaW5mb3JtYXRpdmUgKGUuZy4gRUFQ LVRMUykuDQoNCi0tLS0tLS0tLS0NCmNhdGVnb3J5OiBFZGl0b3JpYWwNCmRvY3VtZW50OiBkcmFm dC1pZXRmLXBhbmEtcGFuYS0wNC50eHQNCm1lc3NhZ2VzOiAzMjMNCm5vc3k6IGRmb3JzYmVyDQpw cmlvcml0eTogTXVzdCBGaXgNCnN0YXR1czogUGVuZGluZw0KdGl0bGU6IE5vcm1hdGl2ZSByZWZl cmVuY2VzDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KUEFOQSBJc3N1ZXMgPHBhbmFfaXNzdWVzQGRhbmZvcnNiZXJnLmluZm8+DQo8aHR0cDovL2Rh bmZvcnNiZXJnLmluZm86ODA4MC9wYW5hLWlzc3Vlcy9pc3N1ZTk2Pg0KX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg== --===============0147746805== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============0147746805==-- From pana-bounces@ietf.org Wed Jun 9 13:20:01 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA00357 for ; Wed, 9 Jun 2004 13:20:01 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5rd-0001lb-DK; Wed, 09 Jun 2004 12:23:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5Su-0000VD-2m for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:58:12 -0400 Received: from mgw-x2.nokia.com (mgw-x2.nokia.com [131.228.20.22]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA28661 for ; Wed, 9 Jun 2004 02:35:03 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from esdks004.ntc.nokia.com (esdks004.ntc.nokia.com [172.21.138.159]) by mgw-x2.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596Z2H00934 for ; Wed, 9 Jun 2004 09:35:02 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 09:34:58 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks004.ntc.nokia.com (8.12.9/8.12.9) id i596YwMD014101 for ; Wed, 9 Jun 2004 09:34:58 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks004.ntc.nokia.com 00jbg0e5; Wed, 09 Jun 2004 09:34:45 EEST Received: from esebh001.NOE.Nokia.com (esebh001.ntc.nokia.com [172.21.138.28]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596YhH27294 for ; Wed, 9 Jun 2004 09:34:43 +0300 (EET DST) Received: from esebh005.NOE.Nokia.com ([172.21.138.86]) by esebh001.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 09:34:40 +0300 Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh005.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 09:34:40 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 09:34:40 +0300 Message-ID: Thread-Topic: [issue91] Big picture Thread-Index: AcRN6d7H/7MjDn9BQNWn+XQ/EHztcQAAfGIw To: X-OriginalArrivalTime: 09 Jun 2004 06:34:40.0216 (UTC) FILETIME=[D78C3580:01C44DEB] Subject: [Pana] FW: [issue91] Big picture X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0878763789==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============0878763789== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQpGcm9tIFBhc2kgRXJvbmVuOg0KPiBUaGUgZG9jdW1lbnQgd291bGQgcHJvYmFibHkgYmVu ZWZpdCBmcm9tIGV4cGxhaW5pbmcgdGhlICJiaWcNCj4gcGljdHVyZSIgZmlyc3QsIGUuZy4gd2hh dCBQQU5BIG1lc3NhZ2VzIGFyZSBzZW50IGluIGEgdHlwaWNhbA0KPiBzaXR1YXRpb24gKHNvbWV0 aGluZyBsaWtlIFNlY3Rpb24gNC42KSwgYW5kIG9ubHkgdGhlbiBzcGVjaWZpYw0KPiBkZXRhaWxz IHN1Y2ggYXMgY29udGVudHMgb2YgUEFOQSBTQSwgY2FsY3VsYXRpb24gb2YgTUFDIEFWUCBhbmQN Cj4gcHJvY2Vzc2luZyBvZiB0aGUgUy1mbGFnLg0KDQotLS0tLS0tLS0tDQpjYXRlZ29yeTogRWRp dG9yaWFsDQpkb2N1bWVudDogZHJhZnQtaWV0Zi1wYW5hLXBhbmEtMDQudHh0DQptZXNzYWdlczog MzE4DQpub3N5OiBkZm9yc2Jlcg0KcHJpb3JpdHk6IFNob3VsZCBGaXgNCnN0YXR1czogUGVuZGlu Zw0KdGl0bGU6IEJpZyBwaWN0dXJlDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXw0KUEFOQSBJc3N1ZXMgPHBhbmFfaXNzdWVzQGRhbmZvcnNiZXJnLmlu Zm8+DQo8aHR0cDovL2RhbmZvcnNiZXJnLmluZm86ODA4MC9wYW5hLWlzc3Vlcy9pc3N1ZTkxPg0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg== --===============0878763789== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============0878763789==-- From pana-bounces@ietf.org Wed Jun 9 13:20:41 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA00385 for ; Wed, 9 Jun 2004 13:20:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5rj-0001oZ-Ao; Wed, 09 Jun 2004 12:23:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5Sw-0007uq-Ap for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:58:14 -0400 Received: from mgw-x3.nokia.com (mgw-x3.nokia.com [131.228.20.26]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA28742 for ; Wed, 9 Jun 2004 02:35:41 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from esdks003.ntc.nokia.com (esdks003.ntc.nokia.com [172.21.138.158]) by mgw-x3.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596ZfJ29436 for ; Wed, 9 Jun 2004 09:35:41 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 09:35:32 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks003.ntc.nokia.com (8.12.9/8.12.9) id i596ZWfL007067 for ; Wed, 9 Jun 2004 09:35:32 +0300 Received: from mgw-int2.ntc.nokia.com (172.21.143.97) by esdks003.ntc.nokia.com 00GZeMFk; Wed, 09 Jun 2004 09:35:31 EEST Received: from esebh004.NOE.Nokia.com (esebh004.ntc.nokia.com [172.21.138.84]) by mgw-int2.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596ZKH29703 for ; Wed, 9 Jun 2004 09:35:20 +0300 (EET DST) Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh004.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 09:35:21 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 09:35:20 +0300 Message-ID: Thread-Topic: [issue95] Meaning of "secure network" Thread-Index: AcRN6yQ2dXA7Ii9UQxmG8aHMSuLBDAAAMRDw To: X-OriginalArrivalTime: 09 Jun 2004 06:35:21.0110 (UTC) FILETIME=[EFEC2360:01C44DEB] Subject: [Pana] [issue95] Meaning of "secure network" X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0316193953==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============0316193953== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQo+IEZyb20gUGFzaSBFcm9uZW46DQo+IEl0IHNob3VsZCBiZSBjbGFyaWZpZWQgd2hhdCBl eGFjdGx5IGlzIG1lYW50IHdoZW4gaXQncyBzYWlkIHRoYXQNCj4gYSBuZXR3b3JrIGlzIGFscmVh ZHkgInNlY3VyZSIgYmVmb3JlIFBBTkEgaXMgcnVuLiBFLmcuIGl0IHNlZW1zDQo+IHRoYXQgc3Vj aCBuZXR3b3JrcyBzaG91bGQgaGF2ZSByZWFzb25hYmx5IHJlbGlhYmxlIGRpc2Nvbm5lY3QNCj4g aW5kaWNhdGlvbnM/IFdoYXQgYWJvdXQgcHByZXZlbnRpbmcgSVAgYWRkcmVzcyBzcG9vZmluZz8N Cg0KQWxwZXIgWWVnaW46DQpZZXMsIHdlIHNob3VsZCBicmllZmx5IGV4cGFuZCB0aGF0LiBTcG9v ZmluZyBhbmQgZWF2ZXNkcm9wcGluZyBzaG91bGQgYmUNCnByZXZlbnRlZC4gRGlzY29ubmVjdCBp bmRpY2F0aW9uIGlzIG5lZWRlZCB1bmxlc3MgdGhlIGxvd2VyLWxheWVyDQpzZWN1cml0eSBpcyBi YXNlZCBvbiBhIGNyeXB0byBzY2hlbWUuIElQIGFkZHJlc3Mgc3Bvb2ZpbmcgaXMgbm90IG5lZWRl ZC4NClthIG5ldyBpc3N1ZSBmb3IgdGhlIHRyYWNrZXJdLg0KDQotLS0tLS0tLS0tDQpjYXRlZ29y eTogRWRpdG9yaWFsDQpkb2N1bWVudDogZHJhZnQtaWV0Zi1wYW5hLXBhbmEtMDQudHh0DQptZXNz YWdlczogMzIyDQpub3N5OiBkZm9yc2Jlcg0KcHJpb3JpdHk6IE11c3QgRml4DQpzdGF0dXM6IFBl bmRpbmcNCnRpdGxlOiBNZWFuaW5nIG9mICJzZWN1cmUgbmV0d29yayINCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpQQU5BIElzc3VlcyA8cGFuYV9p c3N1ZXNAZGFuZm9yc2JlcmcuaW5mbz4NCjxodHRwOi8vZGFuZm9yc2JlcmcuaW5mbzo4MDgwL3Bh bmEtaXNzdWVzL2lzc3VlOTU+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXw0K --===============0316193953== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============0316193953==-- From pana-bounces@ietf.org Wed Jun 9 13:21:17 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA00413 for ; Wed, 9 Jun 2004 13:21:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5rn-0001pM-4K; Wed, 09 Jun 2004 12:23:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BY5Sy-0000cK-5w for pana@megatron.ietf.org; Wed, 09 Jun 2004 11:58:16 -0400 Received: from mgw-x1.nokia.com (mgw-x1.nokia.com [131.228.20.21]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA28643 for ; Wed, 9 Jun 2004 02:34:27 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from esdks004.ntc.nokia.com (esdks004.ntc.nokia.com [172.21.138.159]) by mgw-x1.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596YRd09777 for ; Wed, 9 Jun 2004 09:34:27 +0300 (EET DST) X-Scanned: Wed, 9 Jun 2004 09:34:23 +0300 Nokia Message Protector V1.3.30 2004040916 - RELEASE Received: (from root@localhost) by esdks004.ntc.nokia.com (8.12.9/8.12.9) id i596YNfA012708 for ; Wed, 9 Jun 2004 09:34:23 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks004.ntc.nokia.com 00bGAUTj; Wed, 09 Jun 2004 09:34:21 EEST Received: from esebh003.NOE.Nokia.com (esebh003.ntc.nokia.com [172.21.138.82]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i596YKH26742 for ; Wed, 9 Jun 2004 09:34:20 +0300 (EET DST) Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh003.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Jun 2004 09:34:12 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 9 Jun 2004 09:34:10 +0300 Message-ID: Thread-Topic: [issue94] Chapter 9 editorial work Thread-Index: AcRN65czuPAeVCjLSRyc/jQO6x5ozAAABPzA To: X-OriginalArrivalTime: 09 Jun 2004 06:34:12.0027 (UTC) FILETIME=[C6BEE8B0:01C44DEB] Subject: [Pana] FW: [issue94] Chapter 9 editorial work X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1479063165==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============1479063165== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQo+IEZyb20gUGFzaSBFcm9uZW46DQo+IFNlY3Rpb24gOTogT3ZlcmFsbCwgdGhpcyBzZWN0 aW9uIGlzIHF1aXRlIGhlYXZ5IHJlYWRpbmcsIGFuZA0KPiBpdCdzIG5vdCBjbGVhciB0aGF0IHNv bWVvbmUgbm90IHZlcnkgZmFtaWxpYXIgd2l0aCBQQU5BLCBFQVAsDQo+IGV0Yy4gY2FuIGFjdHVh bGx5IGdldCBhIHZlcnkgYWNjdXJhdGUgcGljdHVyZSBvZiB0aGUgcmVsZXZhbnQNCj4gc2VjdXJp dHkgcHJvcGVydGllcyBvZiBQQU5BLiBTbyB0aGlzIHNlY3Rpb24gd291bGQgY2VydGFpbmx5DQo+ IGJlbmVmaXQgZnJvbSBzb21lIGVkaXRvcmlhbCB3b3JrLg0KDQpBbHBlcjoNCkkgYWdyZWUgW2hl bmNlLCBhIG5ldyBpc3N1ZSBmb3IgdGhlIHRyYWNrZXJdLg0KDQo+IA0KPiBQYXJ0IGEgKGRpc2Nv dmVyeSBtZXNzYWdlIGV4Y2hhbmdlKSBzaG91bGQgcHJvYmFibHkgZXhwbGFpbiB0aGF0DQo+IGlm IGluY2x1ZGluZyBQcm90ZWN0aW9uLUNhcGFiaWxpdHkgYW5kIFBQQUMgQVZQcyBpbiBQU1IgaXMg bm90DQo+IHJlY29tbWVuZGVkLCB3aHkgYXJlIHRoZXkgYWxsb3dlZCBhdCBhbGwgKGVzcGVjaWFs bHkgc2luY2UgaXQNCj4gc2VlbXMgdGhlIGNsaWVudCB3b24ndCBhY3R1YWxseSBuZWVkIHRoZSBp bmZvcm1hdGlvbiB1bnRpbCBQQlINCj4gYW55d2F5KS4NCg0KVGhlIHJlY29tbWVuZGF0aW9uIGlz IGZvciBuZXR3b3JrcyB0aGF0IGFyZSBzdXNjZXB0aWJsZSB0byBzcG9vZmluZy4NCk90aGVyIHR5 cGVzIChlLmcuLCBwaHlzaWNhbGx5IHNlY3VyZWQgbmV0d29ya3MpIGNhbiB1c2UgdGhlbS4NCg0K PiBUaGlzIHNlY3Rpb24gc2hvdWxkIGFsc28gbWVudGlvbiB0aGF0IGFueSBpbmZvcm1hdGlvbiBp biBQQU5BDQo+IG1lc3NhZ2VzIGJlZm9yZSBQQlIvUEJBIChzdWNoIGFzIElTUC1JbmZvcm1hdGlv bikgY2FuIGJlDQo+IHNwb29mZWQsIGFuZCB0aGUgaW1wbGljYXRpb25zIG9mIHRoYXQuIA0KDQpP Sy4NCg0KLS0tLS0tLS0tLQ0KY2F0ZWdvcnk6IEVkaXRvcmlhbA0KZG9jdW1lbnQ6IGRyYWZ0LWll dGYtcGFuYS1wYW5hLTA0LnR4dA0KbWVzc2FnZXM6IDMyMQ0Kbm9zeTogZGZvcnNiZXINCnByaW9y aXR5OiBTaG91bGQgRml4DQpzdGF0dXM6IFBlbmRpbmcNCnRpdGxlOiBDaGFwdGVyIDkgZWRpdG9y aWFsIHdvcmsNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fDQpQQU5BIElzc3VlcyA8cGFuYV9pc3N1ZXNAZGFuZm9yc2JlcmcuaW5mbz4NCjxodHRwOi8v ZGFuZm9yc2JlcmcuaW5mbzo4MDgwL3BhbmEtaXNzdWVzL2lzc3VlOTQ+DQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K --===============1479063165== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============1479063165==-- From pana-bounces@ietf.org Wed Jun 9 19:14:27 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02990 for ; Wed, 9 Jun 2004 19:14:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYCEh-0008Jj-RI; Wed, 09 Jun 2004 19:11:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYCBf-0006z6-RI for pana@megatron.ietf.org; Wed, 09 Jun 2004 19:08:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02796 for ; Wed, 9 Jun 2004 19:08:48 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BYCBe-0006FJ-8F for pana@ietf.org; Wed, 09 Jun 2004 19:08:50 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BYCAc-0005M1-00 for pana@ietf.org; Wed, 09 Jun 2004 19:07:46 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1BYC9Z-0003xF-00 for pana@ietf.org; Wed, 09 Jun 2004 19:06:41 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i59N6TpD024513; Thu, 10 Jun 2004 08:06:29 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i59N6SS0027370; Thu, 10 Jun 2004 08:06:28 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id JAA27363 ; Thu, 10 Jun 2004 08:06:28 +0900 Received: from mx2.toshiba.co.jp by tis2.tis.toshiba.co.jp id IAA03337; Thu, 10 Jun 2004 08:06:28 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id IAA22917; Thu, 10 Jun 2004 08:06:27 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i59N6RCR007402; Thu, 10 Jun 2004 08:06:27 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZ2008PCDIL4Y@tsbpo1.po.toshiba.co.jp>; Thu, 10 Jun 2004 08:06:23 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BYC8w-0001tS-00; Wed, 09 Jun 2004 16:06:02 -0700 Date: Wed, 09 Jun 2004 16:06:02 -0700 From: Yoshihiro Ohba Subject: Re: [Pana] FW: AD Review comments on draft-ietf-pana-usage-scenarios-06.txt In-reply-to: <20040523230646.GA852@steelhead> To: Alper Yegin , "'James Carlson'" , pana@ietf.org, "'Thomas Narten'" Message-id: <20040609230602.GF2271@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: Alper Yegin , 'James Carlson' , pana@ietf.org, 'Thomas Narten' User-Agent: Mutt/1.5.6i References: <16558.30597.335081.536774@gargle.gargle.HOWL> <006a01c43f7f$cea96160$c64ca143@sisa.samsung.com> <20040523230646.GA852@steelhead> X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Correction to my comment. My comment was based on some old version of MACsec document. After checking the latest MACsec document, it appears that MACsec is not designed to work across IEEE 802 bridges. Yoshihiro Ohba On Sun, May 23, 2004 at 04:06:46PM -0700, Yoshihiro Ohba wrote: > On Fri, May 21, 2004 at 03:05:59PM -0700, Alper Yegin wrote: > > > > Aside from the IEEE 802 and PPPoE context, there is also PPP over ATM, > > and PPP over cdma2000 networks. > > > > Btw, even in IEEE 802-based DSL networks, using 802.1X would have issues > > if it has to go through bridges (e.g., CPE modem, DSLAM). > > Just to be fair, there is ongoing work, i.e., 802.1AE (MACsec) and > 802.1AF (KeySec), in IEEE 802.1 Working Group to develop an > architecture and protocols in order to provide link-layer security > that work across IEEE 802 bridges (i.e., MACsec). However, > considering maturity level of the work, I think PANA has more reality > in DSL environment (or PANA may be used even for bootstrapping MACsec > and KeySec in a future.) > > Yoshihiro Ohba > > > > > > Alper > > > > > > > > > > _______________________________________________ > > Pana mailing list > > Pana@ietf.org > > https://www1.ietf.org/mailman/listinfo/pana > > _______________________________________________ > Pana mailing list > Pana@ietf.org > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Wed Jun 9 20:53:52 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA07031 for ; Wed, 9 Jun 2004 20:53:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYDmm-0007Yz-Sg; Wed, 09 Jun 2004 20:51:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYDdz-00055Q-JH for pana@megatron.ietf.org; Wed, 09 Jun 2004 20:42:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA06508 for ; Wed, 9 Jun 2004 20:42:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BYDdy-0006W2-0H for pana@ietf.org; Wed, 09 Jun 2004 20:42:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BYDd8-0005bh-00 for pana@ietf.org; Wed, 09 Jun 2004 20:41:19 -0400 Received: from smtp804.mail.sc5.yahoo.com ([66.163.168.183]) by ietf-mx with smtp (Exim 4.12) id 1BYDcD-0004gC-00 for pana@ietf.org; Wed, 09 Jun 2004 20:40:21 -0400 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@64.172.56.171 with login) by smtp804.mail.sc5.yahoo.com with SMTP; 10 Jun 2004 00:40:20 -0000 Message-ID: <00c001c44e83$83080640$6501a8c0@adithya> From: "Mohan Parthasarathy" To: "Alper Yegin" , References: <006f01c448da$a7381f40$9d1d9069@sisa.samsung.com> <01c301c44cf9$b42f1a50$861167c0@adithya> Subject: Re: [Pana] PANA threats Issue 86 Date: Wed, 9 Jun 2004 17:40:21 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7bit > > > > > > Following is the resolution to Issue 86: > > > > > > Include a new threat in Section 6.4: > > > > > > T6.4.2: PaC can leave the network without notifying the PAA or EP > > > e.g., the Ethernet cable is unplugged, system crash. An > > > attacker can > > > pretend to be the PaC and start using the network. > > > > > > And change FROM: > > > > > > If the link is not shared, this threat is absent as > > ingress > > > filtering > > > can prevent one node from impersonating as another node. > > > > > > TO: > > > > > > If the link is not shared, T6.4.1 is absent as ingress > > > filtering can prevent > > > one node from impersonating as another node. > > > > It might not be obvious why ingress filtering is relevant here. I think > > what we mean is: > > > > "If the link is not shared, T6.4.1 is absent as there can only be one > > client on the link, and ingress filtering can prevent attacker's use of > > the authorized IP and MAC address on another link." > > > Ok. > After re-reading the section again, there seems to be some more distinction between shared and non-shared links. Following paragraph can safely be dropped: PANA MUST be able to prevent service theft. In some cases e.g. non- shared links, it is sufficient to provide access control information like IP address, MAC address, etc., to EP, which in turn can prevent unauthorized users from gaining access to the network by policing the packets for matching addresses. In the case of shared links, this information is not sufficient to prevent service theft. PANA MUST be able to bootstrap a shared secret between the PaC and PAA which can be further used to setup a security association (e.g., IPsec) between PaC and EP to prevent service theft on shared links. Final version of section 6.4: 6.4 Service theft An attacker can gain unauthorized access into the network by stealing the service from another client. Once the PaC is successfully authenticated, EP will have filters in place to prevent unauthorized access into the network. The filters will be based on something that will be carried on every packet. For example, the filter could be based on IP and MAC address where the packets will be dropped unless the packets coming with certain IP address match the MAC address also. Following are the possible threats. T6.4.1: Attacker can spoof both the IP and MAC address of an authorized client to gain unauthorized access. Attacker can launch this attack easily by just sniffing the wire for IP and MAC address. This lets the attacker use the network without any authorization, getting a free service. T6.4.2: PaC can leave the network without notifying the PAA or EP e.g., the Ethernet cable is unplugged, system crash. An attacker can pretend to be the PaC and start using the network. If the link is not shared, T6.4.1 is absent as there can only be one client on the link, and ingress filtering can prevent attacker's use of the authorized IP and MAC address on another link." If the link is shared, both the threats are present. If layer 2 provides per-packet protection using pair-wise keys, both the threats can be prevented. Requirement 7 PANA MUST securely bind the authenticated session to the device identifier of the client, to prevent service theft. PANA MUST be able to bootstrap a shared secret between the PaC and PAA which can be further used to setup a security association between PaC and EP to provide cryptographic protection against service theft. Comments ? -mohan > -thanks > mohan > > > Alper > > > > > > > Threat T6.4.2 is > > > still possible > > > as the disconnect may not be seen reliably by the network > > > always. > > > > > > And Change the Requirement to drop "on shared links". Also, update the > > > summary > > > at the end. > > > > > > Comments ? > > > > > > -mohan > > > > > > > > > > > > _______________________________________________ > > > Pana mailing list > > > Pana@ietf.org > > > https://www1.ietf.org/mailman/listinfo/pana > > _______________________________________________ > Pana mailing list > Pana@ietf.org > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Fri Jun 11 08:26:48 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA18006 for ; Fri, 11 Jun 2004 08:26:48 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYkT5-0000nI-TT; Fri, 11 Jun 2004 07:45:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYSq0-0006PI-2s for pana@megatron.ietf.org; Thu, 10 Jun 2004 12:55:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA19236 for ; Thu, 10 Jun 2004 12:55:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BYSpy-0006sS-RV for pana@ietf.org; Thu, 10 Jun 2004 12:55:34 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BYSou-0006Lt-00 for pana@ietf.org; Thu, 10 Jun 2004 12:54:28 -0400 Received: from mailout1.samsung.com ([203.254.224.24]) by ietf-mx with esmtp (Exim 4.12) id 1BYSnJ-0005PY-00 for pana@ietf.org; Thu, 10 Jun 2004 12:52:49 -0400 Received: from custom-daemon.mailout1.samsung.com by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) id <0HZ300401QUW8Q@mailout1.samsung.com> for pana@ietf.org; Fri, 11 Jun 2004 01:52:08 +0900 (KST) Received: from ep_mmp1 (mailout1.samsung.com [203.254.224.24]) by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTP id <0HZ300CS5QUVBK@mailout1.samsung.com> for pana@ietf.org; Fri, 11 Jun 2004 01:52:08 +0900 (KST) Received: from Alperyegin ([105.144.29.156]) by mmp1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTPA id <0HZ300CLLQUTIC@mmp1.samsung.com> for pana@ietf.org; Fri, 11 Jun 2004 01:52:07 +0900 (KST) Date: Thu, 10 Jun 2004 09:52:00 -0700 From: Alper Yegin Subject: RE: [Pana] PANA threats Issue 86 In-reply-to: <00c001c44e83$83080640$6501a8c0@adithya> To: "'Mohan Parthasarathy'" , pana@ietf.org Message-id: <010301c44f0b$40e090b0$9c1d9069@sisa.samsung.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-Mailer: Microsoft Outlook, Build 10.0.2627 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7BIT X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7BIT Looks good to me. > > If the link is not shared, T6.4.1 is absent as there can only be one > client on the link, and ingress filtering can prevent attacker's use of > the authorized IP and MAC address on another link." Editorial: there is an extra " at the end of the paragraph. Alper _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Fri Jun 11 09:09:40 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA22327 for ; Fri, 11 Jun 2004 09:09:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYkUX-00018r-23; Fri, 11 Jun 2004 07:46:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYXJl-0006Gw-5j for pana@megatron.ietf.org; Thu, 10 Jun 2004 17:42:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA01428 for ; Thu, 10 Jun 2004 17:42:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BYXJi-0003z9-Ud for pana@ietf.org; Thu, 10 Jun 2004 17:42:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BYXIp-0003Xh-00 for pana@ietf.org; Thu, 10 Jun 2004 17:41:40 -0400 Received: from mailout1.samsung.com ([203.254.224.24]) by ietf-mx with esmtp (Exim 4.12) id 1BYXIK-00035Z-00 for pana@ietf.org; Thu, 10 Jun 2004 17:41:08 -0400 Received: from custom-daemon.mailout1.samsung.com by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) id <0HZ400H0147PZB@mailout1.samsung.com> for pana@ietf.org; Fri, 11 Jun 2004 06:40:37 +0900 (KST) Received: from ep_mmp1 (mailout1.samsung.com [203.254.224.24]) by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTP id <0HZ400CER47OBK@mailout1.samsung.com> for pana@ietf.org; Fri, 11 Jun 2004 06:40:37 +0900 (KST) Received: from Alperyegin ([105.144.29.156]) by mmp1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTPA id <0HZ400CCH47NIC@mmp1.samsung.com> for pana@ietf.org; Fri, 11 Jun 2004 06:40:36 +0900 (KST) Date: Thu, 10 Jun 2004 14:40:28 -0700 From: Alper Yegin To: pana@ietf.org Message-id: <011b01c44f33$8ce3c400$9c1d9069@sisa.samsung.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-Mailer: Microsoft Outlook, Build 10.0.2627 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7BIT Subject: [Pana] Updated requirements draft X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7BIT Hello, http://yegin.org/ietf/draft-ietf-pana-requirements-08.txt This version reflects Thomas Narten's comments, and also has an updated Appendix that covers the problem statement and usage scenarios. This appendix is a replacement for the separate problem statement and usage scenarios draft. Comments on the appendix is welcome. The plan is to submit this to IETF editor on Monday in order to get in the next IESG call. Alper _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Fri Jun 11 19:25:19 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA14162 for ; Fri, 11 Jun 2004 19:25:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYvJO-0006BF-LM; Fri, 11 Jun 2004 19:19:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYvI3-0005Tz-1r for pana@megatron.ietf.org; Fri, 11 Jun 2004 19:18:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA13922 for ; Fri, 11 Jun 2004 19:18:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BYvI1-0002Gr-7Y for pana@ietf.org; Fri, 11 Jun 2004 19:18:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BYvH1-0001p5-00 for pana@ietf.org; Fri, 11 Jun 2004 19:17:24 -0400 Received: from smtp811.mail.sc5.yahoo.com ([66.163.170.81]) by ietf-mx with smtp (Exim 4.12) id 1BYvFz-0001CC-00 for pana@ietf.org; Fri, 11 Jun 2004 19:16:19 -0400 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@192.103.17.134 with login) by smtp811.mail.sc5.yahoo.com with SMTP; 11 Jun 2004 23:16:18 -0000 Message-ID: <013f01c4500a$17d05200$861167c0@adithya> From: "Mohan Parthasarathy" To: Date: Fri, 11 Jun 2004 16:16:15 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Subject: [Pana] PANA threats Issue 90 X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7bit Here is the resolution. Change T6.5.2: PaC acquires IP address before PANA authentication begins using methods like e.g., DHCP in IPv4 and auto-configuration in IPv6 [PANAREQ]. If IP addresses are assigned before authentication, it opens up the possibility of DoS attack where malicious nodes can deplete the IP addresses by assigning multiple IP addresses. If stateless auto-configuration [ADDRCONF] is used, the attacker can respond to duplicate address detection probes sent by any node on the network effectively not allowing the node to configure a link local address. If stateful mechanism is used in IPv6 e.g., DHCPv6, then this attack is still possible. Address depletion attack is not specific to PANA, but a known attack in DHCP [DHCP-AUTH]. If PANA assumes that the client has an IP address already, it opens up the network to the DoS attack. TO: T6.5.2: PaC acquires an IP address by using stateful or stateless mechanisms before PANA authentication begins [PANAREQ]. When the IP addresses are assigned before the client authentication, it opens up the possibility of DoS attacks where unauthenticated malicious nodes can deplete the IP address space by acquiring multiple IP addresses, or denying allocation to others by responding to every duplicate address detection (DAD) query. Depleting a /64 IPv6 link-local address space or a /8 RFC1918 private address space requires a brute-force attack. Such an attack is part of a DoS class that can equally target the link capacity or the CPU cycles on the target system by bombarding arbitrary packets. Therefore solely handling the IP address depletion attack is not going to improve the security as a more general solution is needed to tackle the whole class of brute-force attacks. The DAD attack can be prevented by deploying secure address resolution that does not depend on the client authentication, such as [SEND]. The attack may also be prevented if the EP is placed in between the PaCs to monitor the ND/ARP activity and detect DAD attacks (excessive NA/ARP replies). If none of these solutions are applicable to a deployment, the PaCs can send arbitrary packets to each other without going through the EP which enables a class of attacks that are based on interfering with the PANA messaging (See T6.1.1). Since there will always be an unhandled threat in this class (e.g., insecure discovery), addressing DAD attack is not going to improve the overall security. Comments ? -mohan _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Fri Jun 11 21:30:32 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA18834 for ; Fri, 11 Jun 2004 21:30:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYxGM-0001Cn-6f; Fri, 11 Jun 2004 21:24:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BYxE8-0000bu-FN for pana@megatron.ietf.org; Fri, 11 Jun 2004 21:22:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA18711 for ; Fri, 11 Jun 2004 21:22:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BYxE6-0007UM-8J for pana@ietf.org; Fri, 11 Jun 2004 21:22:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BYxDC-000768-00 for pana@ietf.org; Fri, 11 Jun 2004 21:21:34 -0400 Received: from mailout2.samsung.com ([203.254.224.25]) by ietf-mx with esmtp (Exim 4.12) id 1BYxCV-0006O9-00 for pana@ietf.org; Fri, 11 Jun 2004 21:20:51 -0400 Received: from custom-daemon.mailout2.samsung.com by mailout2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) id <0HZ600C0191WPB@mailout2.samsung.com> for pana@ietf.org; Sat, 12 Jun 2004 10:20:21 +0900 (KST) Received: from ep_mmp2 (mailout2.samsung.com [203.254.224.25]) by mailout2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTP id <0HZ6006FQ91W1R@mailout2.samsung.com> for pana@ietf.org; Sat, 12 Jun 2004 10:20:20 +0900 (KST) Received: from Alperyegin ([105.144.29.156]) by mmp2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTPA id <0HZ6004B691U1R@mmp2.samsung.com> for pana@ietf.org; Sat, 12 Jun 2004 10:20:20 +0900 (KST) Date: Fri, 11 Jun 2004 18:20:15 -0700 From: Alper Yegin Subject: RE: [Pana] PANA threats Issue 90 In-reply-to: <013f01c4500a$17d05200$861167c0@adithya> To: "'Mohan Parthasarathy'" , pana@ietf.org Message-id: <023b01c4501b$6b8342c0$9c1d9069@sisa.samsung.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-Mailer: Microsoft Outlook, Build 10.0.2627 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7BIT X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7BIT Looks good to me. Alper > -----Original Message----- > From: pana-bounces@ietf.org [mailto:pana-bounces@ietf.org] On Behalf Of > Mohan Parthasarathy > Sent: Friday, June 11, 2004 4:16 PM > To: pana@ietf.org > Subject: [Pana] PANA threats Issue 90 > > Here is the resolution. > > Change > > T6.5.2: PaC acquires IP address before PANA authentication begins > using methods like e.g., DHCP in IPv4 and auto-configuration in IPv6 > [PANAREQ]. If IP addresses are assigned before authentication, it > opens up the possibility of DoS attack where malicious nodes can > deplete the IP addresses by assigning multiple IP addresses. If > stateless auto-configuration [ADDRCONF] is used, the attacker can > respond to duplicate address detection probes sent by any node on the > network effectively not allowing the node to configure a link local > address. If stateful mechanism is used in IPv6 e.g., DHCPv6, then > this attack is still possible. Address depletion attack is not > specific to PANA, but a known attack in DHCP [DHCP-AUTH]. If PANA > assumes that the client has an IP address already, it opens up the > network to the DoS attack. > > TO: > > T6.5.2: PaC acquires an IP address by using stateful or stateless > mechanisms before PANA authentication begins [PANAREQ]. > When the IP addresses are assigned before the client authentication, it > opens up the possibility of DoS attacks where unauthenticated > malicious nodes can deplete the IP address space by acquiring multiple > IP > addresses, or denying allocation to others by responding to every > duplicate address detection (DAD) query. > > Depleting a /64 IPv6 link-local address space or a /8 RFC1918 private > address space requires a brute-force attack. Such an attack is part of > a > DoS class that can equally target the link capacity or the CPU cycles > on > the target system by bombarding arbitrary packets. Therefore solely > handling the IP address depletion attack is not going to improve the > security as a more general solution is needed to tackle > the whole class of brute-force attacks. > > The DAD attack can be prevented by deploying secure address resolution > that does not depend on the client authentication, such as [SEND]. The > attack > may also be prevented if the EP is placed in between the PaCs to > monitor > the ND/ARP activity and detect DAD attacks (excessive NA/ARP replies). > If none of these solutions are applicable to a deployment, the PaCs can > send > arbitrary packets to each other without going through the EP which > enables a > class of attacks that are based on interfering with the PANA messaging > (See T6.1.1). Since there will always be an unhandled threat in this > class > (e.g., insecure discovery), addressing DAD attack is not going to > improve the > overall security. > > Comments ? > > -mohan > > > _______________________________________________ > Pana mailing list > Pana@ietf.org > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Mon Jun 14 19:19:12 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11872 for ; Mon, 14 Jun 2004 19:19:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ba03h-00032h-R7; Mon, 14 Jun 2004 18:36:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BZyUM-00026S-IM for pana@megatron.ietf.org; Mon, 14 Jun 2004 16:55:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01139 for ; Mon, 14 Jun 2004 16:55:28 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BZyUL-0000M4-8j for pana@ietf.org; Mon, 14 Jun 2004 16:55:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BZySs-0007ZY-00 for pana@ietf.org; Mon, 14 Jun 2004 16:53:59 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1BZyRO-0006xc-00 for pana@ietf.org; Mon, 14 Jun 2004 16:52:26 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5EKqOpD017586 for ; Tue, 15 Jun 2004 05:52:24 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5EKqO3f007014 for ; Tue, 15 Jun 2004 05:52:24 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id FAA07013 ; Tue, 15 Jun 2004 05:52:24 +0900 Received: from mx2.toshiba.co.jp by tis2.tis.toshiba.co.jp id FAA19411; Tue, 15 Jun 2004 05:52:23 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id FAA20928; Tue, 15 Jun 2004 05:52:23 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5EKqNCR022615 for ; Tue, 15 Jun 2004 05:52:23 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZB00D3KGN82Y@tsbpo1.po.toshiba.co.jp> for pana@ietf.org; Tue, 15 Jun 2004 05:52:22 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BZyQt-00071e-00 for ; Mon, 14 Jun 2004 13:51:55 -0700 Date: Mon, 14 Jun 2004 13:51:55 -0700 From: Yoshihiro Ohba To: pana@ietf.org Message-id: <20040614205155.GC18915@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: pana@ietf.org User-Agent: Mutt/1.5.6i X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Subject: [Pana] pana specification snapshot (05a) X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org is available at http://www.toshiba.com/tari/pana/pana-spec.html. Changes: Added text for Issue 85. Regards, Yoshihiro Ohba _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Mon Jun 14 19:19:53 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11950 for ; Mon, 14 Jun 2004 19:19:53 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ba03o-0003LR-Az; Mon, 14 Jun 2004 18:36:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BZyXD-0002q1-KP for pana@megatron.ietf.org; Mon, 14 Jun 2004 16:58:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01477 for ; Mon, 14 Jun 2004 16:58:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BZyXC-0001aA-8E for pana@ietf.org; Mon, 14 Jun 2004 16:58:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BZyW8-0001Cq-00 for pana@ietf.org; Mon, 14 Jun 2004 16:57:21 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1BZyV6-0000dx-00 for pana@ietf.org; Mon, 14 Jun 2004 16:56:16 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5EKuFpD018380 for ; Tue, 15 Jun 2004 05:56:15 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5EKuFuC008026 for ; Tue, 15 Jun 2004 05:56:15 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id FAA08025 ; Tue, 15 Jun 2004 05:56:15 +0900 Received: from mx.toshiba.co.jp by tis2.tis.toshiba.co.jp id FAA19978; Tue, 15 Jun 2004 05:56:15 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id FAA11233; Tue, 15 Jun 2004 05:56:14 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5EKuECR023947 for ; Tue, 15 Jun 2004 05:56:14 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZB00D5TGTN2Y@tsbpo1.po.toshiba.co.jp> for pana@ietf.org; Tue, 15 Jun 2004 05:56:13 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BZyUO-000734-00 for ; Mon, 14 Jun 2004 13:55:32 -0700 Date: Mon, 14 Jun 2004 13:55:29 -0700 From: Yoshihiro Ohba To: pana@ietf.org Message-id: <20040614205529.GF10664@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: pana@ietf.org User-Agent: Mutt/1.5.6i X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Subject: [Pana] pana framework snapshot (01a) X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org is available at http://www.toshiba.com/tari/pana/pana-spec.html. Changes: updated IEEE 802.11i/WPA bootstrap section - a unified operation for both seperated and co-located PAA and AP cases. - updated description on 4-way handshake based on Pasi's comment. Regards, Yoshihiro Ohba _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Mon Jun 14 19:29:13 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA12430 for ; Mon, 14 Jun 2004 19:29:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ba04G-0004Se-6P; Mon, 14 Jun 2004 18:36:40 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BZyrb-0006de-6k for pana@megatron.ietf.org; Mon, 14 Jun 2004 17:19:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA03206 for ; Mon, 14 Jun 2004 17:19:28 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BZyrZ-00015q-NG for pana@ietf.org; Mon, 14 Jun 2004 17:19:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BZyqp-0000mW-00 for pana@ietf.org; Mon, 14 Jun 2004 17:18:44 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1BZyq7-0000SU-00 for pana@ietf.org; Mon, 14 Jun 2004 17:17:59 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5ELHwpD023670 for ; Tue, 15 Jun 2004 06:17:58 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5ELHwQL014239 for ; Tue, 15 Jun 2004 06:17:58 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id GAA14236 ; Tue, 15 Jun 2004 06:17:58 +0900 Received: from mx4.toshiba.co.jp by tis2.tis.toshiba.co.jp id GAA24567; Tue, 15 Jun 2004 06:17:58 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id GAA18225; Tue, 15 Jun 2004 06:17:57 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5ELHvCR002059 for ; Tue, 15 Jun 2004 06:17:57 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZB00DF3HTT2Y@tsbpo1.po.toshiba.co.jp> for pana@ietf.org; Tue, 15 Jun 2004 06:17:56 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BZypQ-00079O-00 for ; Mon, 14 Jun 2004 14:17:16 -0700 Date: Mon, 14 Jun 2004 14:17:16 -0700 From: Yoshihiro Ohba To: pana@ietf.org Message-id: <20040614211716.GG10664@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: pana@ietf.org User-Agent: Mutt/1.5.6i X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Subject: [Pana] issue97 (comment) X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org >From Pasi Eronen: > Section 7: The retransmission behavior seems quite complicated; > IMHO it would have been simpler to have one end (probably PaC) > to be responsible for all timer-based retransmissions. I think it is difficult to change the retransmission behavior as suggested for the following reasons: - PANA is designed that EAP-based (re-)authentication are initiated from either side, which means that a message used for initiating EAP-based (re-)authentication from PAA (i.e., PANA-Start-Request for initial EAP-based authentication and PANA-Auth-Request for EAP-based re-authentication) would need to be retransmitted from PAA anyway. - There are some other PANA messages that are allowed from either side (i.e., PANA-Terminate-Request and PANA-Reauth-Request). - Since rfc2284bis prohibits an EAP-Response to be retransmitted based on a timer, a PANA message that carries an EAP-Response is not allowed to be retrasmitted from PaC based on a timer. Yoshihiro Ohba _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 15 08:58:44 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA15252 for ; Tue, 15 Jun 2004 08:58:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BaDUu-0004V9-MY; Tue, 15 Jun 2004 08:57:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BaDT5-0004K2-EF for pana@megatron.ietf.org; Tue, 15 Jun 2004 08:55:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA15125 for ; Tue, 15 Jun 2004 08:55:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BaDT4-00044M-Ge for pana@ietf.org; Tue, 15 Jun 2004 08:55:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BaDSS-0003jG-00 for pana@ietf.org; Tue, 15 Jun 2004 08:54:32 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1BaDRe-0003O5-00 for pana@ietf.org; Tue, 15 Jun 2004 08:53:46 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5FCrdpD004183; Tue, 15 Jun 2004 21:53:39 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5FCrdqQ019637; Tue, 15 Jun 2004 21:53:39 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id XAA19636 ; Tue, 15 Jun 2004 21:53:39 +0900 Received: from mx2.toshiba.co.jp by tis2.tis.toshiba.co.jp id VAA18538; Tue, 15 Jun 2004 21:53:38 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id VAA14094; Tue, 15 Jun 2004 21:53:38 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5FCrbCR014729; Tue, 15 Jun 2004 21:53:37 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZC00GBNP5AJK@tsbpo1.po.toshiba.co.jp>; Tue, 15 Jun 2004 21:53:36 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BaDR4-0000KU-00; Tue, 15 Jun 2004 05:53:06 -0700 Date: Tue, 15 Jun 2004 05:53:06 -0700 From: Yoshihiro Ohba Subject: Re: [Pana] Some comments about PANA drafts In-reply-to: <00ac01c44811$3eca0f50$861167c0@adithya> To: Mohan Parthasarathy Message-id: <20040615125306.GF30440@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: Mohan Parthasarathy , Pasi.Eronen@nokia.com, pana@ietf.org User-Agent: Mutt/1.5.6i References: <052E0C61B69C3741AFA5FE88ACC775A6122422@esebe023.ntc.nokia.com> <00ac01c44811$3eca0f50$861167c0@adithya> X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Cc: Pasi.Eronen@nokia.com, pana@ietf.org X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org On Tue, Jun 01, 2004 at 12:47:17PM -0700, Mohan Parthasarathy wrote: > Pasi, > > Thanks for your comments. I will address the IPsec issue here : > > >Comments about draft-ietf-pana-ipsec-03: > > > >Section 5: What happens if there were two EAP authentications, > >resulting in two AAA-Keys? > > Do you know what happens in 802.11i for this case ? We can follow > the same here. In IEEE 802.11i there is no case that derives two AAA-Keys, so PANA has to define its own solution. It might be better to introduce some key derivation key (e.g., PANA_KD_KEY) in PANA specification draft so that each protocol that is bootstrapped from PANA (e.g., IPsec and IEEE 802.11i PSK mode) does not need to consider the double AAA-Key case. Instead, it should be the PANA_KD_KEY derivation algorithm that takes the double AAA-Key case into account. Yoshihiro Ohba _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 15 10:27:28 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA21281 for ; Tue, 15 Jun 2004 10:27:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BaEmZ-0006dE-EH; Tue, 15 Jun 2004 10:19:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BaEce-0002Ti-LO for pana@megatron.ietf.org; Tue, 15 Jun 2004 10:09:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19573 for ; Tue, 15 Jun 2004 10:09:06 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BaEcd-000669-OA for pana@ietf.org; Tue, 15 Jun 2004 10:09:07 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BaEbw-0005l8-00 for pana@ietf.org; Tue, 15 Jun 2004 10:08:25 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1BaEb3-0005PS-00 for pana@ietf.org; Tue, 15 Jun 2004 10:07:29 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5FE7QpD003024; Tue, 15 Jun 2004 23:07:26 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5FE7Qkn000246; Tue, 15 Jun 2004 23:07:26 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id ZAA00239 ; Tue, 15 Jun 2004 23:07:26 +0900 Received: from mx2.toshiba.co.jp by tis2.tis.toshiba.co.jp id XAA19171; Tue, 15 Jun 2004 23:07:25 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id XAA08257; Tue, 15 Jun 2004 23:07:25 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5FE7PCR020636; Tue, 15 Jun 2004 23:07:25 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZC00LFPSK94G@tsbpo1.po.toshiba.co.jp>; Tue, 15 Jun 2004 23:07:24 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BaEam-0000fr-00; Tue, 15 Jun 2004 07:07:12 -0700 Date: Tue, 15 Jun 2004 07:07:12 -0700 From: Yoshihiro Ohba Subject: Re: Pasi's pana-04 comments (was RE: [Pana] Some comments about PANA drafts) In-reply-to: <001c01c44da2$a5cfdb80$9c1d9069@sisa.samsung.com> To: Alper Yegin Message-id: <20040615140712.GG30440@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: Alper Yegin , Pasi.Eronen@nokia.com, pana@ietf.org User-Agent: Mutt/1.5.6i References: <052E0C61B69C3741AFA5FE88ACC775A6122422@esebe023.ntc.nokia.com> <001c01c44da2$a5cfdb80$9c1d9069@sisa.samsung.com> X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Cc: Pasi.Eronen@nokia.com, pana@ietf.org X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org On Tue, Jun 08, 2004 at 02:50:41PM -0700, Alper Yegin wrote: > Hi Pasi, > > Thank you for the review and the feedback. Let me walk through your > comments on the pana-pana-04 document. > > > Comments draft-ietf-pana-pana-04: > > > > The document would probably benefit from explaining the "big > > picture" first, e.g. what PANA messages are sent in a typical > > situation (something like Section 4.6), and only then specific > > details such as contents of PANA SA, calculation of MAC AVP and > > processing of the S-flag. > > Right. We should beef up Section 3. [we shall open an issue on this and > track it] > > > Section 4.1.5: Key derivation seems to assume that the integrity > > protection algorithm needs at most 160 bit key (so if some new > > algorithm later needs more, also the key derivation needs to be > > updated). > > N=160 is based on the selected integrity algorithm, HMAC-SHA1. If the > algorithm changes, we need to change N as well. Since an algorithm > change would require a spec change anyways, I think setting the N value > should be fine in this document. > > > Section 4.2: HMAC-SHA1 takes two parameters, not one > > OK, we shall fix that [another new issue]. > Fixed. (it will appear in -05b snapshot) > > > > Section 6.3: Diameter uses SMI enterprise numbers for Vendor-Id; > > does PANA use that also, or does it define its own number space? > > Yes. We shall spell this out in the document [a new issue]. I think PANA should use SMI enterprise numbers for Vendor-Id as Diameter does. How about changing: " Vendor-Id The Vendor-Id field is present if the 'V' bit is set in the AVP Flags field. The optional four-octet Vendor-Id field contains the uniquely assigned id value, encoded in network byte order. Any vendor wishing to implement a vendor-specific PANA AVP MUST use their own Vendor-Id along with their privately managed AVP address space, guaranteeing that they will not collide with any other vendor's vendor-specific AVP(s), nor with future IETF applications. " to: " Vendor-Id The Vendor-Id field is present if the 'V' bit is set in the AVP Flags field. The optional four-octet Vendor-Id field contains the IANA assigned "SMI Network Management Private Enterprise Codes" [ianaweb] value, encoded in network byte order. Any vendor wishing to implement a vendor-specific PANA AVP MUST use their own Vendor-Id along with their privately managed AVP address space, guaranteeing that they will not collide with any other vendor's vendor-specific AVP(s), nor with future IETF applications. " > > > Section 6.5.5 (Protection-Capability): Is it assumed that only a > > single L2 mechanism can exist? Or that if multiple L2 mechanisms > > are possible, the correct one can be determined from some L2 > > messages? > > The latter. It is assumed that a shared key is sufficient to bootstrap > L2 ciphering. Should a specific text be added to the PANA document on this? > > > Section 6.5.13 (Provider-Identifier): What the client is > > supposed to do with this information? > > This is used for ISP discovery and selection. And also separating ISP > authentication from NAP authentication, when needed. These are discussed > in Section 4.2 Discovery and Initial Handshake Phase > > > (And usually the > > enterprise numbers are used to identify vendors, not network > > operators--but of course a network operator could get an > > enterprise number as well...) > > Hmmmm, we should verify that..... > > > > > Section 7: The retransmission behavior seems quite complicated; > > IMHO it would have been simpler to have one end (probably PaC) > > to be responsible for all timer-based retransmissions. > > OK, let us look into this. Please see my other email on this. > > > > > Section 9: Overall, this section is quite heavy reading, and > > it's not clear that someone not very familiar with PANA, EAP, > > etc. can actually get a very accurate picture of the relevant > > security properties of PANA. So this section would certainly > > benefit from some editorial work. > > I agree [hence, a new issue for the tracker]. > > > > > Part a (discovery message exchange) should probably explain that > > if including Protection-Capability and PPAC AVPs in PSR is not > > recommended, why are they allowed at all (especially since it > > seems the client won't actually need the information until PBR > > anyway). > > The recommendation is for networks that are susceptible to spoofing. > Other types (e.g., physically secured networks) can use them. > > > This section should also mention that any information in PANA > > messages before PBR/PBA (such as ISP-Information) can be > > spoofed, and the implications of that. > > OK. > > >(BTW, perhaps it would > > have been a good idea to integrity protect all previous PANA > > messages in PBR/PBA.) > > Hmmm, sounds a little too heavy weight. Is this a generally recommended > behavior for EAP lower layers? No, not recommended. I think it would be difficult for any protocol that do not run on top of reliable transport to exactly maintain a consistent view of all previous messages (including sequence numbers) that were actually received by the peering entities. > > > > > It should be clarified what exactly is meant when it's said that > > a network is already "secure" before PANA is run. E.g. it seems > > that such networks should have reasonably reliable disconnect > > indications? What about ppreventing IP address spoofing? > > Yes, we should briefly expand that. Spoofing and eavesdropping should be > prevented. Disconnect indication is needed unless the lower-layer > security is based on a crypto scheme. IP address spoofing is not needed. > [a new issue for the tracker]. > > > > > References: Some of the normative references should probably be > > informative (e.g. EAP-TLS). > > OK. [issue tracker] Fixed. (it will appear in -05b snapshot) Any other references that should be marked as informative? Yoshihiro Ohba > > Thank you. > > Alper > > > > _______________________________________________ > Pana mailing list > Pana@ietf.org > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 15 14:23:31 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06428 for ; Tue, 15 Jun 2004 14:23:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BaIPu-0007cL-Fq; Tue, 15 Jun 2004 14:12:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BaINw-0007HP-G2 for pana@megatron.ietf.org; Tue, 15 Jun 2004 14:10:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA05965 for ; Tue, 15 Jun 2004 14:10:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BaINv-0002Xy-9m for pana@ietf.org; Tue, 15 Jun 2004 14:10:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BaIMy-0002DD-00 for pana@ietf.org; Tue, 15 Jun 2004 14:09:12 -0400 Received: from smtp813.mail.sc5.yahoo.com ([66.163.170.83]) by ietf-mx with smtp (Exim 4.12) id 1BaIMC-0001s4-00 for pana@ietf.org; Tue, 15 Jun 2004 14:08:25 -0400 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@192.103.17.134 with login) by smtp813.mail.sc5.yahoo.com with SMTP; 15 Jun 2004 18:08:23 -0000 Message-ID: <003701c45303$c1653820$861167c0@adithya> From: "Mohan Parthasarathy" To: "Yoshihiro Ohba" References: <052E0C61B69C3741AFA5FE88ACC775A6122422@esebe023.ntc.nokia.com><00ac01c44811$3eca0f50$861167c0@adithya> <20040615125306.GF30440@steelhead> Subject: Re: [Pana] Some comments about PANA drafts Date: Tue, 15 Jun 2004 11:08:26 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="ISO-2022-JP" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Cc: Pasi.Eronen@nokia.com, pana@ietf.org X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7bit > On Tue, Jun 01, 2004 at 12:47:17PM -0700, Mohan Parthasarathy wrote: > > Pasi, > > > > Thanks for your comments. I will address the IPsec issue here : > > > > >Comments about draft-ietf-pana-ipsec-03: > > > > > >Section 5: What happens if there were two EAP authentications, > > >resulting in two AAA-Keys? > > > > Do you know what happens in 802.11i for this case ? We can follow > > the same here. > > In IEEE 802.11i there is no case that derives two AAA-Keys, so PANA > has to define its own solution. > Oh! the question was about NAP and ISP authentication ? I mis-understood the question.. > It might be better to introduce some key derivation key (e.g., > PANA_KD_KEY) in PANA specification draft so that each protocol that is > bootstrapped from PANA (e.g., IPsec and IEEE 802.11i PSK mode) does > not need to consider the double AAA-Key case. Instead, it should be > the PANA_KD_KEY derivation algorithm that takes the double AAA-Key > case into account. > This makes sense. How is the key derived for PANA SA today when there are two authentications ? Something similar should work here. -mohan > Yoshihiro Ohba > > > > > _______________________________________________ > Pana mailing list > Pana@ietf.org > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 15 16:59:58 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16156 for ; Tue, 15 Jun 2004 16:59:58 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BaK9l-0006sz-VB; Tue, 15 Jun 2004 16:03:41 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BaJsp-0002Pk-Rz; Tue, 15 Jun 2004 15:46:11 -0400 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12418; Tue, 15 Jun 2004 15:46:10 -0400 (EDT) Message-Id: <200406151946.PAA12418@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Tue, 15 Jun 2004 15:46:10 -0400 Cc: pana@ietf.org Subject: [Pana] I-D ACTION:draft-ietf-pana-threats-eval-05.txt X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Protocol for carrying Authentication for Network Access Working Group of the IETF. Title : Protocol for Carrying Authentication and Network Access Threat Analysis and Security Requirements Author(s) : M. Parthasarathy Filename : draft-ietf-pana-threats-eval-05.txt Pages : 17 Date : 2004-6-15 The PANA (Protocol for carrying authentication for Network Access) working group is developing methods for authenticating clients to the access network using IP based protocols. This document discusses the threats to such protocols. The security requirements arising out of these threats will be used as additional input to the PANA WG for designing the IP based network access authentication protocol. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-pana-threats-eval-05.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-pana-threats-eval-05.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-pana-threats-eval-05.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-6-15154352.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-pana-threats-eval-05.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-pana-threats-eval-05.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-6-15154352.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --NextPart-- From pana-bounces@ietf.org Tue Jun 15 17:08:05 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA16593 for ; Tue, 15 Jun 2004 17:08:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BaKAI-00076P-By; Tue, 15 Jun 2004 16:04:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BaJvh-0003Gi-JE; Tue, 15 Jun 2004 15:49:09 -0400 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12579; Tue, 15 Jun 2004 15:49:07 -0400 (EDT) Message-Id: <200406151949.PAA12579@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Tue, 15 Jun 2004 15:49:07 -0400 Cc: pana@ietf.org Subject: [Pana] I-D ACTION:draft-ietf-pana-requirements-08.txt X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Protocol for carrying Authentication for Network Access Working Group of the IETF. Title : Protocol for Carrying Authentication for Network Access (PANA) Requirements Author(s) : A. Yegin, et al. Filename : draft-ietf-pana-requirements-08.txt Pages : 24 Date : 2004-6-15 It is expected that future IP devices will have a variety of access technologies to gain network connectivity. Currently there are access-specific mechanisms for providing client information to the network for authentication and authorization purposes. In addition to being limited to specific access media (e.g., 802.1X for IEEE 802 links), some of these protocols are limited to specific network topologies (e.g., PPP for point-to-point links). The goal of this document is to identify the requirements for a link-layer agnostic protocol that allows a host and a network to authenticate each other for network access. This protocol will run between a client's device and an agent in the network where the agent might be a client of the AAA infrastructure. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-pana-requirements-08.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-pana-requirements-08.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-pana-requirements-08.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-6-15161603.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-pana-requirements-08.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-pana-requirements-08.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-6-15161603.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --NextPart-- From pana-bounces@ietf.org Wed Jun 16 11:28:27 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA08584 for ; Wed, 16 Jun 2004 11:28:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Bac8Z-0007pR-AM; Wed, 16 Jun 2004 11:15:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Babx1-0003jh-06; Wed, 16 Jun 2004 11:03:43 -0400 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA03434; Wed, 16 Jun 2004 11:03:39 -0400 (EDT) Message-Id: <200406161503.LAA03434@ietf.org> From: The IESG To: IETF-Announce: ; Date: Wed, 16 Jun 2004 11:03:39 -0400 Cc: Alper Yegin , Basavaraj Patil , pana@ietf.org Subject: [Pana] WG Action: RECHARTER: Protocol for carrying Authentication for Network Access (pana) X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org The charter of the Protocol for carrying Authentication for Network Access (pana) working group in the Internet Area of the IETF has been updated. For additional information, please contact the Area Directors or the working group Chairs. Protocol for carrying Authentication for Network Access (pana) ============================================================== Current Status: Active Working Group Chair(s): Basavaraj Patil Alper Yegin Internet Area Director(s): Thomas Narten Margaret Wasserman Internet Area Advisor: Thomas Narten Mailing Lists: General Discussion: pana@ietf.org To Subscribe: https://www1.ietf.org/mailman/listinfo/pana In Body: (un)subscribe Archive: http://www.ietf.org/mail-archive/web/pana/index.html Description of Working Group: In some scenarios, an IP-based device is required to authenticate itself to the network prior to being authorized to use it. This authentication usually requires a protocol that can support various authentication methods, dynamic service provider selection, and roaming clients. In the absence of such an authentication protocol on most of the link-layers, architectures have resorted to filling the gap by using a number of inadequate methods. For example, inserting an additional layer between link-layer and network-layer mostly for client authentication purpose (e.g., PPPoE), overloading another network-layer protocol to achieve this goal (e.g., Mobile IPv4 with Registration- required flag), and even defining application-layer ad-hoc authentication mechanisms (e.g., http redirects with web-based login). In these and other cases, a network-layer authentication protocol may provide a cleaner solution to the authentication problem. The goal of PANA is to define a protocol that allows clients to authenticate themselves to the access network using IP protocols. Such a protocol would allow a client to interact with a site's back-end AAA infrastructure to gain access without needing to understand the particular AAA infrastructure protocols that are in use at the site. It would also allow such interactions to take place without a link-layer specific mechanism. PANA would be applicable to both multi-access and point-to-point links. It would provide support for various authentication methods, dynamic service provider selection, and roaming clients. Mobile IPv4 developed its own protocols for performing PANA-like functions (e.g., MN-FA interaction). Mobile IPv6 does not have the equivalent of a Foreign Agent (FA) that would allow the access/visited network to authenticate the MN before allowing access. The PANA authentication agent (PAA) can perform the authentication function attributed to the FA in Mobile IPv4, in Mobile IPv6 networks. The WG will work with the assumption that a PANA client (PaC) is already configured with an IP address before using PANA. This IP address will provide limited reachability to the PaC until it is authenticated with the PAA. Upon successful authentication, PaC is granted broader network access possibly by either a new IP address assignment, or by enforcement points changing filtering rules for the same IP address. PANA will neither define any new authentication protocol nor define key distribution, key agreement or key derivation protocols. It is believed that PANA will be able to meet its goals if it is able to carry EAP payloads. Note, however, that EAP may need to be extended in order for PANA to meet the need for all of its intended usages. Such extensions are outside the scope of the PANA WG. PANA will develop an IP-based protocol that allows a device to authenticate itself with the network (and to a PAA in particular) in order to be granted network access. For simplicity, it is assumed that the PAA is attached to the same link as the device (i.e., no intermediary IP routers). The PAA itself may interface with other AAA backend infrastructures for authenticating and authorizing the service being requested by the host, but such interactions are transparent to the PaC. Network access authentication enables the client to be authorized for packet data service. However it is possible that the underlying link itself is insecure, i.e the packets being sent to and received on the link between the client (PaC) and the 1st hop access router (EP) in the network are not protected by any physical or cryptographic means. In such cases, PANA will enable the establishment of an IPsec SA between the client and the 1st hop access router to secure the packets on the link. In networks that have physical security or ciphering as a link-layer feature, no such SA is required. Hence the establishment of the IPsec SA is optional. The WG will deliver a document that explains how such an IPsec SA is established by using IKE after successful PANA authentication. No enhancements to either IKE or IPsec are expected. The PAA does not necessarily act as an enforcement point (EP) to prevent unauthorized access or usage of the network. When a PaC succesfully authenticates itself to the PAA, EP(s) (e.g., access routers) will need to be suitably notified. SNMP will be used by the PAA to deliver the authorization information to one or more EPs when the PAA is separated from EPs. The WG will document the solution based on SNMP for carrying the authorization information between the PAA and the EP. The WG will also propose a solution of how the PaC discovers the IP address of PAA for sending the authentication request. The PANA WG will deliver - A mechanism for the PAC to discover the PAA on the link. - The PANA protocol itself, capable of carrying multiple authentication methods (e.g. using EAP) - A document that describes how SNMP is used to deliver authorization information from the PAA to the EP in the scenarios where the PAA and EP are separated. - A document that explains the establishment of an IPsec SA between the client and the 1st hop access router subsequent to authentication for securing the data packets on the link. Goals and Milestones: Done Submit usage scenarios and applicability statement to the IESG Done Submit security threat analysis to the IESG Done Submit protocol requirements to the IESG Aug 04 Submit PANA framework to the IESG Aug 04 Submit PANA protocol specification to the IESG Aug 04 Submit IPsec-based access control to the IESG Aug 04 Submit SNMP-based PAA-to-EP protocol specification to the IESG Dec 04 Submit MIB for PANA to the IESG _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Wed Jun 16 17:52:54 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19764 for ; Wed, 16 Jun 2004 17:52:54 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Bahhh-00080J-Ej; Wed, 16 Jun 2004 17:12:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Bag9g-0006lo-5u for pana@megatron.ietf.org; Wed, 16 Jun 2004 15:33:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA07786 for ; Wed, 16 Jun 2004 15:33:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1Bag9b-0006St-S4 for pana@ietf.org; Wed, 16 Jun 2004 15:32:59 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BafgY-0000wi-00 for pana@ietf.org; Wed, 16 Jun 2004 15:02:59 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1Baeg6-0001b8-00 for pana@ietf.org; Wed, 16 Jun 2004 13:58:26 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5GHwRpD027282; Thu, 17 Jun 2004 02:58:27 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5GHwQ2N023426; Thu, 17 Jun 2004 02:58:26 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id CAA23425 ; Thu, 17 Jun 2004 02:58:26 +0900 Received: from mx4.toshiba.co.jp by tis2.tis.toshiba.co.jp id CAA01241; Thu, 17 Jun 2004 02:58:26 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id CAA11829; Thu, 17 Jun 2004 02:58:26 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5GHwPCR017184; Thu, 17 Jun 2004 02:58:25 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZE006BBXXAIC@tsbpo1.po.toshiba.co.jp>; Thu, 17 Jun 2004 02:58:24 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BaefG-0002ZO-00; Wed, 16 Jun 2004 10:57:34 -0700 Date: Wed, 16 Jun 2004 10:57:34 -0700 From: Yoshihiro Ohba Subject: Re: [Pana] Some comments about PANA drafts In-reply-to: <003701c45303$c1653820$861167c0@adithya> To: Mohan Parthasarathy Message-id: <20040616175734.GE967@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: Mohan Parthasarathy , Yoshihiro Ohba , Pasi.Eronen@nokia.com, pana@ietf.org User-Agent: Mutt/1.5.6i References: <052E0C61B69C3741AFA5FE88ACC775A6122422@esebe023.ntc.nokia.com> <00ac01c44811$3eca0f50$861167c0@adithya> <20040615125306.GF30440@steelhead> <003701c45303$c1653820$861167c0@adithya> X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Cc: Yoshihiro Ohba , Pasi.Eronen@nokia.com, pana@ietf.org X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org On Tue, Jun 15, 2004 at 11:08:26AM -0700, Mohan Parthasarathy wrote: > > It might be better to introduce some key derivation key (e.g., > > PANA_KD_KEY) in PANA specification draft so that each protocol that is > > bootstrapped from PANA (e.g., IPsec and IEEE 802.11i PSK mode) does > > not need to consider the double AAA-Key case. Instead, it should be > > the PANA_KD_KEY derivation algorithm that takes the double AAA-Key > > case into account. > > > This makes sense. How is the key derived for PANA SA today when there > are two authentications ? Something similar should work here. PANA_MAC_KEY, which is used for PANA SA, is derived in the following way: In case of single AAA-Key: PANA_MAC_KEY = The first N bits of HMAC_SHA1(AAA-Key, ISN_pac | ISN_paa | Session-ID) In case of double AAA-Key: PANA_MAC_KEY = The first N bits of HMAC_SHA1(AAA-Key1 | AAA-Key2, ISN_pac | ISN_paa | Session-ID) We could modify the algorithm to derive both PANA_MAC_KEY and PANA_KD_KEY as follows: In case of single AAA-Key: {PANA_MAC_KEY | PANA_KD_KEY} = The first N+M bits of HMAC_SHA1(AAA-Key, ISN_pac | ISN_paa | Session-ID) In case of double AAA-Key: {PANA_MAC_KEY | PANA_KD_KEY} = The first N+M bits of HMAC_SHA1(AAA-Key1 | AAA-Key2, ISN_pac | ISN_paa | Session-ID) PANA_MAC_KEY have a length of N bits. PANA_KD_KEY have a length of M bits. N depends on the integrity protection algorithm in use for PANA MAC AVP. M is 512 (equal to the typical length of AAA-KEY or EAP MSK). Yoshihiro Ohba _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Thu Jun 17 07:01:38 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA18426 for ; Thu, 17 Jun 2004 07:01:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BauNv-0003VD-Jy; Thu, 17 Jun 2004 06:44:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BauJj-0001bd-RX for pana@megatron.ietf.org; Thu, 17 Jun 2004 06:40:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA17076 for ; Thu, 17 Jun 2004 06:40:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BauJe-0004js-BU for pana@ietf.org; Thu, 17 Jun 2004 06:40:18 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BauIe-0004N6-00 for pana@ietf.org; Thu, 17 Jun 2004 06:39:17 -0400 Received: from smtp2.int-evry.fr ([157.159.10.45]) by ietf-mx with esmtp (Exim 4.12) id 1BauHh-0003fi-00 for pana@ietf.org; Thu, 17 Jun 2004 06:38:17 -0400 Received: from ipv6-5.int-evry.fr (ipv6-5.int-evry.fr [157.159.100.78]) by smtp2.int-evry.fr (Postfix) with ESMTP id 117B72FD96 for ; Thu, 17 Jun 2004 12:37:35 +0200 (CEST) Received: from jb by ipv6-5.int-evry.fr with local (Exim id 1BauFR-0002yJ-BR for ; Thu, 17 Jun 2004 12:35:57 +0200 Date: Thu, 17 Jun 2004 12:35:57 +0200 From: Julien Bournelle To: pana@ietf.org Message-ID: <20040617103557.GF11151@ipv6-5.int-evry.fr> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-INT-MailScanner-Information: Please contact the ISP for more information X-INT-MailScanner: Found to be clean X-INT-MailScanner-SpamCheck: n'est pas un polluriel, SpamAssassin (score=-4.9, requis 4.5, autolearn=not spam, BAYES_00 -4.90) X-MailScanner-From: jb@ipv6-5.int-evry.fr X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Subject: [Pana] problem in the Mobility Handling section X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Hi all, in the Mobility Handling section, it is written than the MAC AVP in the PBR/PBA exchange uses the new PANA_MAC_Key. This new PANA_MAC_Key is computed using the AAA-Key new. The AAA-KEy-new is computed using PAA_Nonce and PaC_nonce (and others). The problem is that PAA_nonce and PaC_nonce are carried in the PBR/PBA exchange. To solve it, we could introduce an intermediary PANA Key just used to sign the PBR/PBA exchange. regards, -- julien.bournelle@int-evry.fr _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Thu Jun 17 12:40:12 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA18103 for ; Thu, 17 Jun 2004 12:40:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Baz49-0004kC-N1; Thu, 17 Jun 2004 11:44:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BayhM-00042v-7e; Thu, 17 Jun 2004 11:21:04 -0400 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA09506; Thu, 17 Jun 2004 11:21:01 -0400 (EDT) Message-Id: <200406171521.LAA09506@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Thu, 17 Jun 2004 11:21:01 -0400 Cc: pana@ietf.org Subject: [Pana] I-D ACTION:draft-ietf-pana-threats-eval-06.txt X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Protocol for carrying Authentication for Network Access Working Group of the IETF. Title : Protocol for Carrying Authentication and Network Access Threat Analysis and Security Requirements Author(s) : M. Parthasarathy Filename : draft-ietf-pana-threats-eval-06.txt Pages : 17 Date : 2004-6-17 The PANA (Protocol for carrying authentication for Network Access) working group is developing methods for authenticating clients to the access network using IP based protocols. This document discusses the threats to such protocols. The security requirements arising out of these threats will be used as additional input to the PANA WG for designing the IP based network access authentication protocol. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-pana-threats-eval-06.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-pana-threats-eval-06.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-pana-threats-eval-06.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-6-17113718.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-pana-threats-eval-06.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-pana-threats-eval-06.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-6-17113718.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --NextPart-- From pana-bounces@ietf.org Tue Jun 22 09:34:47 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA07945 for ; Tue, 22 Jun 2004 09:34:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BckpB-0002et-Jr; Tue, 22 Jun 2004 08:56:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BchWK-0006yU-A2 for pana@megatron.ietf.org; Tue, 22 Jun 2004 05:24:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA21211 for ; Tue, 22 Jun 2004 05:24:45 -0400 (EDT) From: Pasi.Eronen@nokia.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BchWH-0006I5-Ul for pana@ietf.org; Tue, 22 Jun 2004 05:24:46 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BchUu-0005jQ-00 for pana@ietf.org; Tue, 22 Jun 2004 05:23:21 -0400 Received: from mgw-x2.nokia.com ([131.228.20.22]) by ietf-mx with esmtp (Exim 4.12) id 1BchTO-0004uX-00 for pana@ietf.org; Tue, 22 Jun 2004 05:21:46 -0400 Received: from esdks003.ntc.nokia.com (esdks003.ntc.nokia.com [172.21.138.158]) by mgw-x2.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i5M9Lk600066; Tue, 22 Jun 2004 12:21:46 +0300 (EET DST) X-Scanned: Tue, 22 Jun 2004 12:21:17 +0300 Nokia Message Protector V1.3.31 2004060815 - RELEASE Received: (from root@localhost) by esdks003.ntc.nokia.com (8.12.9/8.12.9) id i5M9LHh9025960; Tue, 22 Jun 2004 12:21:17 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks003.ntc.nokia.com 00yp1QIV; Tue, 22 Jun 2004 12:21:14 EEST Received: from esebh002.NOE.Nokia.com (esebh002.ntc.nokia.com [172.21.138.77]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i5M9LCH02909; Tue, 22 Jun 2004 12:21:12 +0300 (EET DST) Received: from esebe023.NOE.Nokia.com ([172.21.138.115]) by esebh002.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Tue, 22 Jun 2004 12:21:11 +0300 x-mimeole: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Subject: RE: [Pana] Some comments about PANA drafts Date: Tue, 22 Jun 2004 12:21:10 +0300 Message-ID: <052E0C61B69C3741AFA5FE88ACC775A60227C109@esebe023.ntc.nokia.com> Thread-Topic: [Pana] Some comments about PANA drafts Thread-Index: AcRT7FqU7tZRexqiTRe3A1TEJFtrRQETNuxw To: , X-OriginalArrivalTime: 22 Jun 2004 09:21:11.0583 (UTC) FILETIME=[423C92F0:01C4583A] X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.5 required=5.0 tests=AWL,NO_REAL_NAME, UPPERCASE_25_50 autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: quoted-printable Yoshihiro Ohba wrote: > > We could modify the algorithm to derive both PANA_MAC_KEY and=20 > PANA_KD_KEY as follows: >=20 > In case of single AAA-Key: >=20 > {PANA_MAC_KEY | PANA_KD_KEY} =3D=20 > The first N+M bits of > HMAC_SHA1(AAA-Key, ISN_pac | ISN_paa |=20 > Session-ID) >=20 > In case of double AAA-Key: >=20 > {PANA_MAC_KEY | PANA_KD_KEY} =3D=20 > The first N+M bits of > HMAC_SHA1(AAA-Key1 | AAA-Key2, ISN_pac | > ISN_paa | Session-ID) >=20 > PANA_MAC_KEY have a length of N bits. > PANA_KD_KEY have a length of M bits. >=20 > N depends on the integrity protection algorithm in use for=20 > PANA MAC AVP. M is 512 (equal to the typical length of=20 > AAA-KEY or EAP MSK). Looks like a reasonable approach to me. But note that HMAC-SHA1=20 output is only 160 bits, so something more is needed to generate enough bits (maybe PANA could borrow e.g. the "prf+"=20 construct from IKEv2). Best regards, Pasi _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 22 19:00:30 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA06900 for ; Tue, 22 Jun 2004 19:00:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Bctm9-0007Ro-Gx; Tue, 22 Jun 2004 18:29:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BcpbV-00040I-FQ for pana@megatron.ietf.org; Tue, 22 Jun 2004 14:02:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09064 for ; Tue, 22 Jun 2004 14:02:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BcpbU-00050x-CB for pana@ietf.org; Tue, 22 Jun 2004 14:02:40 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BcodE-0001vo-00 for pana@ietf.org; Tue, 22 Jun 2004 13:00:25 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1Bcmd6-0001pj-00 for pana@ietf.org; Tue, 22 Jun 2004 10:52:08 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5MEq5pD012434; Tue, 22 Jun 2004 23:52:05 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5MEq5E2027455; Tue, 22 Jun 2004 23:52:05 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id ZAA27454 ; Tue, 22 Jun 2004 23:52:05 +0900 Received: from mx.toshiba.co.jp by tis2.tis.toshiba.co.jp id XAA09383; Tue, 22 Jun 2004 23:52:05 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id XAA25537; Tue, 22 Jun 2004 23:52:04 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5MEq4nE018020; Tue, 22 Jun 2004 23:52:04 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZP009YHTAPMF@tsbpo1.po.toshiba.co.jp>; Tue, 22 Jun 2004 23:52:03 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BcmcI-0000hn-00; Tue, 22 Jun 2004 07:51:18 -0700 Date: Tue, 22 Jun 2004 07:51:18 -0700 From: Yoshihiro Ohba Subject: Re: [Pana] Some comments about PANA drafts In-reply-to: <052E0C61B69C3741AFA5FE88ACC775A60227C109@esebe023.ntc.nokia.com> To: Pasi.Eronen@nokia.com Message-id: <20040622145118.GH9426@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: Pasi.Eronen@nokia.com, yohba@tari.toshiba.com, pana@ietf.org User-Agent: Mutt/1.5.6i References: <052E0C61B69C3741AFA5FE88ACC775A60227C109@esebe023.ntc.nokia.com> X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Cc: yohba@tari.toshiba.com, pana@ietf.org X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Hi Pasi, On Tue, Jun 22, 2004 at 12:21:10PM +0300, Pasi.Eronen@nokia.com wrote: > > Yoshihiro Ohba wrote: > > > > We could modify the algorithm to derive both PANA_MAC_KEY and > > PANA_KD_KEY as follows: > > > > In case of single AAA-Key: > > > > {PANA_MAC_KEY | PANA_KD_KEY} = > > The first N+M bits of > > HMAC_SHA1(AAA-Key, ISN_pac | ISN_paa | > > Session-ID) > > > > In case of double AAA-Key: > > > > {PANA_MAC_KEY | PANA_KD_KEY} = > > The first N+M bits of > > HMAC_SHA1(AAA-Key1 | AAA-Key2, ISN_pac | > > ISN_paa | Session-ID) > > > > PANA_MAC_KEY have a length of N bits. > > PANA_KD_KEY have a length of M bits. > > > > N depends on the integrity protection algorithm in use for > > PANA MAC AVP. M is 512 (equal to the typical length of > > AAA-KEY or EAP MSK). > > Looks like a reasonable approach to me. But note that HMAC-SHA1 > output is only 160 bits, so something more is needed to > generate enough bits (maybe PANA could borrow e.g. the "prf+" > construct from IKEv2). Yes, I received the same comment personally from Mohan, and borrowing prf+ from IKEv2 seems to be a good solution. I will post updated text in a separate email. Thanks! Yoshihiro Ohba > > Best regards, > Pasi > > _______________________________________________ > Pana mailing list > Pana@ietf.org > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 22 19:03:23 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07260 for ; Tue, 22 Jun 2004 19:03:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BctmH-0007YM-St; Tue, 22 Jun 2004 18:30:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Bcpkh-0005Ng-DK for pana@megatron.ietf.org; Tue, 22 Jun 2004 14:12:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA10473 for ; Tue, 22 Jun 2004 14:12:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1Bcpkg-0006WB-78 for pana@ietf.org; Tue, 22 Jun 2004 14:12:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1Bcoz5-0005nP-00 for pana@ietf.org; Tue, 22 Jun 2004 13:23:00 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1BcnOQ-0007HB-00 for pana@ietf.org; Tue, 22 Jun 2004 11:41:02 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5MFf0pD029350; Wed, 23 Jun 2004 00:41:00 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5MFf0Bc020398; Wed, 23 Jun 2004 00:41:00 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id AAA20396 ; Wed, 23 Jun 2004 00:41:00 +0900 Received: from mx4.toshiba.co.jp by tis2.tis.toshiba.co.jp id AAA25225; Wed, 23 Jun 2004 00:40:59 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id AAA00862; Wed, 23 Jun 2004 00:40:59 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5MFewnE012344; Wed, 23 Jun 2004 00:40:58 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZP00CY5VK7QD@tsbpo1.po.toshiba.co.jp>; Wed, 23 Jun 2004 00:40:58 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BcnNJ-0000tm-00; Tue, 22 Jun 2004 08:39:53 -0700 Date: Tue, 22 Jun 2004 08:39:53 -0700 From: Yoshihiro Ohba To: pana@ietf.org Message-id: <20040622153953.GA2625@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: pana@ietf.org User-Agent: Mutt/1.5.6+20040523i X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Subject: [Pana] PANA key derivation key X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org To reflect Pasi's comment on how to deal with two AAA-Keys in pana-ipsec draft and resulting discussions, here is a proposed text for PANA specification draft to define PANA_KD_Key. In section 4.1.5 of draft-ietf-pana-pana-04.txt, change: " * PANA SA attributes: + AAA-Key + AAA-Key Identifier + PANA_MAC_Key The PANA_MAC_Key is used to integrity protect PANA messages. When the PANA_MAC_Key is derived from a single AAA-Key, it is computed in the following way: PANA_MAC_KEY = The first N bits of HMAC_SHA1(AAA-Key, ISN_pac | ISN_paa | Session-ID) where the value of N depends on the integrity protection algorithm in use, i.e., N=160 for HMAC-SHA1. When the PANA_MAC_Key is derived from two AAA-Keys, it is computed in the following way: PANA_MAC_KEY = The first N bits of HMAC_SHA1(AAA-Key1 | AAA-Key2, ISN_pac | ISN_paa | Session-ID) where AAA-Key1 and AAA-Key2 are AAA-Keys for the first and second EAP authentication in a single PANA authentication phase, respectively. The length of AAA-Key, AAA-Key1 and AAA-Key2 MUST be N bits or longer. See Section 4.1.6 for the detailed usage of the PANA_MAC_Key. " to: * PANA SA attributes: + AAA-Key + AAA-Key Identifier + PANA_MAC_Key + PANA_KD_Key The PANA_MAC_Key is used to integrity protect PANA messages. The PANA_KD_Key is used to derive keys used for bootstrapping per-packet ciphering between PaC and EP. The PANA_MAC_Key has a length of N bits, where the value of N depends on the integrity protection algorithm in use, which is HMAC-SHA1 in this document and N would be 160 bits for this case. The PANA_KD_Key has a length of 512 bits, which is equal to the typical length of a AAA-Key or an EAP Master Session Key [I-D.ietf-eap-keying]. When the PANA_MAC_Key and PANA_PD_Key are derived from a single AAA-Key, it is computed in the following way: {PANA_MAC_Key | PANA_KD_Key} = HMAC_SHA1+(AAA-Key, ISN_pac | ISN_paa | Session-ID) When PANA_MAC_Key and PANA_PD_Key are derived from two AAA-Keys, it is computed in the following way: {PANA_MAC_Key | PANA_KD_Key} = HMAC_SHA1+(AAA-Key1 | AAA-Key2, ISN_pac | ISN_paa | Session-ID) In the above key derivation algorithms, HMAC_SHA1+ is the iteratively calculated version of HMAC_SHA1 algorithm by applying HMAC_SHA1 in the prf+ function defined in IKEv2 [I-D:ietf-ipsec-ikev2]. AAA-Key1 and AAA-Key2 are AAA-Keys for the first and second EAP authentication in a single PANA authentication phase, respectively. The length of AAA-Key, AAA-Key1 and AAA-Key2 MUST be 160 bits or longer. See Section 4.1.6 for the detailed usage of the PANA_MAC_Key. See [I-D:ietf-pana-ipsec] for the usage of the PANA_KD_Key for bootstrapping IPsec between PaC and EP. " Regards, Yoshihiro Ohba _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 22 19:05:02 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07482 for ; Tue, 22 Jun 2004 19:05:02 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BctmM-0007f4-Sc; Tue, 22 Jun 2004 18:30:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Bcpon-00063m-74 for pana@megatron.ietf.org; Tue, 22 Jun 2004 14:16:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA11193 for ; Tue, 22 Jun 2004 14:16:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1Bcpom-0007BP-0C for pana@ietf.org; Tue, 22 Jun 2004 14:16:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BcpA3-00002n-00 for pana@ietf.org; Tue, 22 Jun 2004 13:34:20 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1Bcnml-0001oo-00 for pana@ietf.org; Tue, 22 Jun 2004 12:06:11 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5MG69pD006921; Wed, 23 Jun 2004 01:06:09 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5MG697Q028831; Wed, 23 Jun 2004 01:06:09 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id BAA28830 ; Wed, 23 Jun 2004 01:06:09 +0900 Received: from mx2.toshiba.co.jp by tis2.tis.toshiba.co.jp id BAA01770; Wed, 23 Jun 2004 01:06:08 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id BAA04498; Wed, 23 Jun 2004 01:06:08 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5MG67nE022237; Wed, 23 Jun 2004 01:06:07 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZP00IE0WQ458@tsbpo1.po.toshiba.co.jp>; Wed, 23 Jun 2004 01:06:07 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1Bcnly-00010B-00; Tue, 22 Jun 2004 09:05:22 -0700 Date: Tue, 22 Jun 2004 09:05:22 -0700 From: Yoshihiro Ohba Subject: Re: [Pana] problem in the Mobility Handling section In-reply-to: <20040617103557.GF11151@ipv6-5.int-evry.fr> To: Julien Bournelle Message-id: <20040622160522.GC2625@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: Julien Bournelle , pana@ietf.org User-Agent: Mutt/1.5.6+20040523i References: <20040617103557.GF11151@ipv6-5.int-evry.fr> X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Cc: pana@ietf.org X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Hi Julien, On Thu, Jun 17, 2004 at 12:35:57PM +0200, Julien Bournelle wrote: > Hi all, > > in the Mobility Handling section, it is written than the MAC AVP in the > PBR/PBA exchange uses the new PANA_MAC_Key. > > This new PANA_MAC_Key is computed using the AAA-Key new. > The AAA-KEy-new is computed using PAA_Nonce and PaC_nonce (and others). > > The problem is that PAA_nonce and PaC_nonce are carried in the PBR/PBA > exchange. You are right that PAA_nonce is carried in PBR, however, PaC_nonce is carried in PSA, not PBA. So I don't see a need to introduce another key to just sign PBR/PBA exchange. Am I missing something? Yoshihiro Ohba > > To solve it, we could introduce an intermediary PANA Key just used to > sign the PBR/PBA exchange. > > regards, > > -- > julien.bournelle@int-evry.fr > > _______________________________________________ > Pana mailing list > Pana@ietf.org > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 22 19:13:17 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA08560 for ; Tue, 22 Jun 2004 19:13:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BctnR-00083n-KO; Tue, 22 Jun 2004 18:31:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BcqLn-0003M2-An for pana@megatron.ietf.org; Tue, 22 Jun 2004 14:50:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17452 for ; Tue, 22 Jun 2004 14:50:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BcqLm-0005mt-4K for pana@ietf.org; Tue, 22 Jun 2004 14:50:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1Bcq9d-000382-00 for pana@ietf.org; Tue, 22 Jun 2004 14:37:58 -0400 Received: from smtp2.int-evry.fr ([157.159.10.45]) by ietf-mx with esmtp (Exim 4.12) id 1BcpmE-0006fw-00 for pana@ietf.org; Tue, 22 Jun 2004 14:13:46 -0400 Received: from ipv6-5.int-evry.fr (ipv6-5.int-evry.fr [157.159.100.78]) by smtp2.int-evry.fr (Postfix) with ESMTP id E2FC82FE76 for ; Tue, 22 Jun 2004 20:12:57 +0200 (CEST) Received: from jb by ipv6-5.int-evry.fr with local (Exim id 1Bcpjl-0006v9-C0 for ; Tue, 22 Jun 2004 20:11:13 +0200 Date: Tue, 22 Jun 2004 20:11:13 +0200 From: Julien Bournelle To: pana@ietf.org Subject: Re: [Pana] problem in the Mobility Handling section Message-ID: <20040622181113.GA26596@ipv6-5.int-evry.fr> References: <20040617103557.GF11151@ipv6-5.int-evry.fr> <20040622160522.GC2625@steelhead> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040622160522.GC2625@steelhead> X-INT-MailScanner-Information: Please contact the ISP for more information X-INT-MailScanner: Found to be clean X-INT-MailScanner-SpamCheck: n'est pas un polluriel, SpamAssassin (score=-4.9, requis 4.5, autolearn=not spam, BAYES_00 -4.90) X-MailScanner-From: jb@ipv6-5.int-evry.fr X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Hi yoshi, > You are right that PAA_nonce is carried in PBR, however, PaC_nonce is > carried in PSA, not PBA. So I don't see a need to introduce another > key to just sign PBR/PBA exchange. Am I missing something? you are right and I am wrong. I miss something, sorry > > Yoshihiro Ohba > > > > > > To solve it, we could introduce an intermediary PANA Key just used to > > sign the PBR/PBA exchange. > > > > regards, > > > > -- > > julien.bournelle@int-evry.fr > > > > _______________________________________________ > > Pana mailing list > > Pana@ietf.org > > https://www1.ietf.org/mailman/listinfo/pana > -- julien.bournelle@int-evry.fr _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Thu Jun 24 16:24:04 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA26028 for ; Thu, 24 Jun 2004 16:24:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BdXUU-00056P-6t; Thu, 24 Jun 2004 12:54:22 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BdUsC-0004ZE-HK for pana@megatron.ietf.org; Thu, 24 Jun 2004 10:06:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14658 for ; Thu, 24 Jun 2004 10:06:37 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BdUsB-0000VX-9x for pana@ietf.org; Thu, 24 Jun 2004 10:06:39 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BdUr3-0007bL-00 for pana@ietf.org; Thu, 24 Jun 2004 10:05:30 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1BdUpp-000744-00 for pana@ietf.org; Thu, 24 Jun 2004 10:04:13 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5OE48pD015187; Thu, 24 Jun 2004 23:04:08 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5OE48p1003641; Thu, 24 Jun 2004 23:04:08 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id ZAA03635 ; Thu, 24 Jun 2004 23:04:08 +0900 Received: from mx4.toshiba.co.jp by tis2.tis.toshiba.co.jp id XAA29632; Thu, 24 Jun 2004 23:04:07 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id XAA13594; Thu, 24 Jun 2004 23:04:06 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5OE46nE014014; Thu, 24 Jun 2004 23:04:06 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZT00KIUGERJE@tsbpo1.po.toshiba.co.jp>; Thu, 24 Jun 2004 23:04:05 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BdUou-0005cv-00; Thu, 24 Jun 2004 07:03:16 -0700 Date: Thu, 24 Jun 2004 07:03:15 -0700 From: Yoshihiro Ohba In-reply-to: <40DA317B.10408@dif.um.es> To: Rafael Marin Lopez , pana@ietf.org Message-id: <20040624140315.GI5538@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: Rafael Marin Lopez , pana@ietf.org, Yoshihiro Ohba User-Agent: Mutt/1.5.6+20040523i References: <40DA317B.10408@dif.um.es> X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Cc: Yoshihiro Ohba Subject: [Pana] Re: PANA NAP and ISP authentication X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Hi Rafa, Let me send this email to the PANA mailing list. On Thu, Jun 24, 2004 at 03:42:19AM +0200, Rafael Marin Lopez wrote: > Hi Yoshihiro > > I was reading section about PANA NAP and ISP authentication (section 4.6) : > > > " PAA offers NAP and ISP separate authentication, as well as a > > choice of ISP from "ISP1" and "ISP2". PaC accepts the offer from > PAA, with choosing "ISP1" as the ISP. > > o An EAP sequence for NAP authentication and an EAP sequence for ISP > authentication is performed in this order in authentication phase. > > o An EAP authentication method with a single round trip is used in > the EAP sequence. > > o The EAP authentication methods derive keys. Once the two EAP > authenticatioins are successful, the PANA_MAC_KEY is derived from > the two AAA-Keys. > > " > > That is, PANA_MAC_KEY is derived after we have two AAA-Keys.... The answer is no. I think the explanation of this example is ambiguous. The PANA_MAC_Key is first derived from the AAA-Key1 upon the completion of the first EAP, and then the PANA_MAC_Key is updated so that the key is derived from both AAA-Key1 and AAA-Key2 upon the completion of the second EAP. > > o After PANA SA is established, all messages are integrity and > replay protected with the MAC AVP. > > > ... and with PANA_MAC_KEY we can calculate MAC AVP . > > However ... this MAC AVP appears before these two authentications are > carried out, for example: > > <----- PANA-Auth-Request(x+3,y+4)[EAP, MAC]// ISP > > > I guess , here MAC is calculated by using AAA-Key 1 (we have only this > so far) but in : > > PANA-Bind-Request(x+5,y+6) //S-flag set > [EAP{Success}, Device-Id, Key-Id, > Lifetime, Protection-Cap., PPAC, MAC] > > > > MAC is calculated by using both AAA_Key1 and AAA_Key2... am I wrong? You are right. How about changing as follows? change: " o An EAP authentication method with a single round trip is used in the EAP sequence. o The EAP authentication methods derive keys. Once the two EAP authenticatioins are successful, the PANA_MAC_KEY is derived from the two AAA-Keys. " to: " o An EAP authentication method with a single round trip is used in each EAP sequence. o Two AAA-Keys are derived from the EAP authentication methods, i.e., AAA-Key1 and AAA-Key2. The PANA_MAC_Key is first derived from the AAA-Key1 upon the completion of the first EAP, and then it is updated so that it is derived from both AAA-Key1 and AAA-Key2 upon the completion of the second EAP. " Regards, Yoshihiro Ohba > > > -- > > ------------------------------------------------------ > Rafael Marin Lopez > Faculty of Computer Science-University of Murcia > 30071 Murcia - Spain > Telf: +34968367645 e-mail: rafa@dif.um.es > ------------------------------------------------------ > _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Thu Jun 24 16:26:31 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA26144 for ; Thu, 24 Jun 2004 16:26:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BdXUZ-00059e-99; Thu, 24 Jun 2004 12:54:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BdVPM-0002Gz-Ec for pana@megatron.ietf.org; Thu, 24 Jun 2004 10:40:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18458 for ; Thu, 24 Jun 2004 10:40:53 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BdVPL-0006Be-JP for pana@ietf.org; Thu, 24 Jun 2004 10:40:55 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BdVOC-0005ov-00 for pana@ietf.org; Thu, 24 Jun 2004 10:39:45 -0400 Received: from xenon2.um.es ([155.54.212.101] helo=smtp.um.es) by ietf-mx with esmtp (Exim 4.12) id 1BdVNZ-0005Ko-00 for pana@ietf.org; Thu, 24 Jun 2004 10:39:05 -0400 Received: from smtp.um.es (localhost [127.0.0.1]) by localhost (Postfix) with ESMTP id 3855C30FB6; Thu, 24 Jun 2004 16:38:34 +0200 (CEST) Received: from aries.dif.um.es (aries.dif.um.es [155.54.210.253]) by smtp.um.es (Postfix) with ESMTP id 05FA130FAF; Thu, 24 Jun 2004 16:38:34 +0200 (CEST) Received: from dif.um.es (bravecard.dif.um.es [155.54.210.47]) by aries.dif.um.es (Postfix) with ESMTP id D529014426; Thu, 24 Jun 2004 16:37:02 +0200 (MET DST) Message-ID: <40DAE642.1020100@dif.um.es> Date: Thu, 24 Jun 2004 16:33:38 +0200 From: Rafael Marin Lopez User-Agent: Mozilla Thunderbird 0.5 (X11/20040306) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Yoshihiro Ohba References: <40DA317B.10408@dif.um.es> <20040624140315.GI5538@steelhead> In-Reply-To: <20040624140315.GI5538@steelhead> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Cc: rafa , pana@ietf.org Subject: [Pana] Re: PANA NAP and ISP authentication X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7bit Hi Yoshi... Yoshihiro Ohba wrote: >Hi Rafa, > >Let me send this email to the PANA mailing list. > >On Thu, Jun 24, 2004 at 03:42:19AM +0200, Rafael Marin Lopez wrote: > > >>Hi Yoshihiro >> >>I was reading section about PANA NAP and ISP authentication (section 4.6) : >> >> >>" PAA offers NAP and ISP separate authentication, as well as a >> >> choice of ISP from "ISP1" and "ISP2". PaC accepts the offer from >> PAA, with choosing "ISP1" as the ISP. >> >> o An EAP sequence for NAP authentication and an EAP sequence for ISP >> authentication is performed in this order in authentication phase. >> >> o An EAP authentication method with a single round trip is used in >> the EAP sequence. >> >> o The EAP authentication methods derive keys. Once the two EAP >> authenticatioins are successful, the PANA_MAC_KEY is derived from >> the two AAA-Keys. >> >>" >> >>That is, PANA_MAC_KEY is derived after we have two AAA-Keys.... >> >> > >The answer is no. I think the explanation of this example is >ambiguous. The PANA_MAC_Key is first derived from the AAA-Key1 upon >the completion of the first EAP, and then the PANA_MAC_Key is updated >so that the key is derived from both AAA-Key1 and AAA-Key2 upon the >completion of the second EAP. > > Now it's clear. >>o After PANA SA is established, all messages are integrity and >> replay protected with the MAC AVP. >> >> >>... and with PANA_MAC_KEY we can calculate MAC AVP . >> >>However ... this MAC AVP appears before these two authentications are >>carried out, for example: >> >><----- PANA-Auth-Request(x+3,y+4)[EAP, MAC]// ISP >> >> >>I guess , here MAC is calculated by using AAA-Key 1 (we have only this >>so far) but in : >> >> PANA-Bind-Request(x+5,y+6) //S-flag set >> [EAP{Success}, Device-Id, Key-Id, >> Lifetime, Protection-Cap., PPAC, MAC] >> >> >> >>MAC is calculated by using both AAA_Key1 and AAA_Key2... am I wrong? >> >> > >You are right. > >How about changing as follows? > >change: > >" > o An EAP authentication method with a single round trip is used in > the EAP sequence. > > o The EAP authentication methods derive keys. Once the two EAP > authenticatioins are successful, the PANA_MAC_KEY is derived from > the two AAA-Keys. >" > >to: > >" > o An EAP authentication method with a single round trip is used in > each EAP sequence. > > o Two AAA-Keys are derived from the EAP authentication methods, > i.e., AAA-Key1 and AAA-Key2. The PANA_MAC_Key is first derived > from the AAA-Key1 upon the completion of the first EAP, and then > it is updated so that it is derived from both AAA-Key1 and > AAA-Key2 upon the completion of the second EAP. >" > > Sounds good for me. Thanks. >Regards, > >Yoshihiro Ohba > > > > >>-- >> >>------------------------------------------------------ >>Rafael Marin Lopez >>Faculty of Computer Science-University of Murcia >>30071 Murcia - Spain >>Telf: +34968367645 e-mail: rafa@dif.um.es >>------------------------------------------------------ >> >> >> > > > > -- ------------------------------------------------------ Rafael Marin Lopez Faculty of Computer Science-University of Murcia 30071 Murcia - Spain Telf: +34968367645 e-mail: rafa@dif.um.es ------------------------------------------------------ _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Thu Jun 24 19:52:45 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03703 for ; Thu, 24 Jun 2004 19:52:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Bddmq-00068k-OK; Thu, 24 Jun 2004 19:37:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BddRD-00007K-Ji for pana@megatron.ietf.org; Thu, 24 Jun 2004 19:15:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA28344 for ; Thu, 24 Jun 2004 19:15:18 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BddK2-0001Gg-CQ for pana@ietf.org; Thu, 24 Jun 2004 19:07:58 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1Bdcnn-0000lB-00 for pana@ietf.org; Thu, 24 Jun 2004 18:34:41 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1Bdc9Y-0000Sc-00 for pana@ietf.org; Thu, 24 Jun 2004 17:53:04 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5OLr2pD019959; Fri, 25 Jun 2004 06:53:02 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5OLr2WJ011078; Fri, 25 Jun 2004 06:53:02 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id GAA11077 ; Fri, 25 Jun 2004 06:53:02 +0900 Received: from mx.toshiba.co.jp by tis2.tis.toshiba.co.jp id GAA26958; Fri, 25 Jun 2004 06:53:01 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id GAA24263; Fri, 25 Jun 2004 06:53:01 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5OLr0nE001499; Fri, 25 Jun 2004 06:53:00 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0HZU00LA024840@tsbpo1.po.toshiba.co.jp>; Fri, 25 Jun 2004 06:52:59 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1Bdc97-0007TD-00; Thu, 24 Jun 2004 14:52:37 -0700 Date: Thu, 24 Jun 2004 14:52:36 -0700 From: Yoshihiro Ohba To: pana@ietf.org Message-id: <20040624215236.GN5538@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: pana@ietf.org User-Agent: Mutt/1.5.6+20040523i X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Subject: [Pana] issue 91 (proposed text) X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org This is a proposed text for PANA issue 91 (http://danforsberg.info:8080/pana-issues/issue91): [1] Add the following paragraph in section 3: " In addition, PANA defines the following two types of re-authentication procedures that are performed while an established PANA session exists. 1. Re-authentication based on EAP 2. Re-authentication based on PANA-Reauth exchange The former type of re-authentication is used mainly for extending authorization lifetime or for updating the cryptographic keying material of a PANA SA. The latter type of re-authentication is used mainly for maintaining the presence of the communicating peers each other so that the established PANA session can be terminated as soon as the presence of the peer is lost. " [2] Add the following section: " 3.1 Illustration of a Complete Message Sequence A complete PANA message sequence is illustrated in Figure 2. The example assumes the following scenario: o The PaC initiates the discovery and initial handshake phase by multicasting a PANA-PAA-Discover message. The PAA responds with a PANA-Start-Request message with a cookie to be stateless in the discovery and initial handshake phase. At the end of the the discovery and initial handshake phase, the PaC sends a PANA-Start-Answer message with a cookie in response to the PANA-Start-Request. o An EAP authentication method with a single round trip is used in the authentication phase. A AAA-Key is derived from the EAP method and used for establishing a PANA SA. o At the end of the authentication phase, the PAA sends a PANA-Bind-Request message and the PaC responds with a PANA-Bind-Answer message. These messages contains a MAC AVP and a Key-Id AVP, as well as other AVPs for which usages are explained in Section 4, to securely establish a PANA session with a PANA SA. o After the PANA SA is established, all messages are integrity and replay protected with MAC AVPs. o After the PANA SA is established, Re-authentication based on PANA-Reauth exchange is performed. o The PaC initiates termination of the PANA session by sending a PANA-Termination-Request message. o Sequence numbers in PANA headers are not shown. PaC PAA Message(tseq,rseq)[AVPs] ----------------------------------------------------- // Discovery and initial handshake phase -----> PANA-PAA-Discover <----- PANA-Start-Request[Cookie] -----> PANA-Start-Request-Answer[Cookie] // Authentication phase <----- PANA-Auth-Request[EAP] -----> PANA-Auth-Answer[EAP] <----- PANA-Auth-Request[EAP] -----> PANA-Auth-Answer[EAP] <----- PANA-Bind-Request[EAP{Success}, Device-Id, Key-Id, Lifetime, Protection-Cap., PPAC, MAC] -----> PANA-Bind-Answer[Device-Id, Key-Id, PPAC, MAC] // Re-authentication <----- PANA-Reauth-Request[MAC] -----> PANA-Reauth-Answer[MAC] // Termination phase -----> PANA-Termination-Request[MAC] <----- PANA-Termination-Answer[MAC] Figure 2: A Complete Message Sequence " [3] Change Section 4.6 to: " 4.6. Example for NAP and ISP Separate Authentication A PANA message sequence where NAP and ISP separate authentication occurs is illustrated in Figure 9. The example assumes the following scenario: o The PaC multicasts PANA-PAA-Discover message o The ISNs used by the PAA and the PaC are x and y, respectively. o The PAA offers NAP and ISP separate authentication, as well as a choice of ISP from "ISP1" and "ISP2". The PaC accepts the offer from the PAA, with choosing "ISP1" as the ISP. o An EAP sequence for NAP authentication and an EAP sequence for ISP authentication is performed in this order in authentication phase. o An EAP authentication method with a single round trip is used in each EAP sequence. o Two AAA-Keys are derived from the EAP authentication methods, i.e., AAA-Key1 and AAA-Key2. The PANA_MAC_Key is first derived from the AAA-Key1 upon the completion of the first EAP, and then it is updated so that it is derived from both AAA-Key1 and AAA-Key2 upon the completion of the second EAP. o After a PANA SA is established, all messages are integrity and replay protected with MAC AVPs. o Re-authentication based on the PANA-Reauth exchange is performed. o Re-authentication and termination phase are not shown. PaC PAA Message(tseq,rseq)[AVPs] ----------------------------------------------------- // Discovery and initial handshake phase -----> PANA-PAA-Discover (0,0) <----- PANA-Start-Request (x,0) // S-flag set [Cookie, ISP-Information("ISP1"), ISP-Information("ISP2"), NAP-Information("MyNAP")] -----> PANA-Start-Request-Answer (y,x) // S-flag set [Cookie, ISP-Information("ISP1")] // PaC chooses "ISP1" // Authentication phase <----- PANA-Auth-Request(x+1,y)[EAP] // NAP authentication // S- and N-flags set -----> PANA-Auth-Answer(y+1,x+1)[EAP] // S- and N-flags set <----- PANA-Auth-Request(x+2,y+1)[EAP] // S- and N-flags set -----> PANA-Auth-Answer(y+2,x+2)[EAP] // S- and N-flags set <----- PANA-FirstAuth-End-Request(x+3,y+2) // S- and N-flags set [EAP{Success}, Key-Id, MAC] -----> PANA-FirstAuth-End-Answer(y+3,x+3) // S- and N-flags set [Key-Id, MAC] <----- PANA-Auth-Request(x+3,y+4)[EAP, MAC]// ISP authentication // S-flag set -----> PANA-Auth-Answer(y+4,x+4)[EAP, MAC] // S-flag set <----- PANA-Auth-Request(x+4,y+5)[EAP, MAC]// S-flag set -----> PANA-Auth-Answer(y+5,x+5)[EAP, MAC] // S-flag set <----- PANA-Bind-Request(x+5,y+6) // S-flag set [EAP{Success}, Device-Id, Key-Id, Lifetime, Protection-Cap., PPAC, MAC] -----> PANA-Bind-Answer(y+6,x+5) // S-flag set [Device-Id, Key-Id, PPAC, MAC] Figure 9: A Complete Message Sequence for NAP and ISP Separate Authentications " Comments are appreciated. Yoshihiro Ohba _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Mon Jun 28 20:48:13 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA27597 for ; Mon, 28 Jun 2004 20:48:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Bf6jH-0005qn-Hh; Mon, 28 Jun 2004 20:44:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Bf6fr-000599-A8 for pana@megatron.ietf.org; Mon, 28 Jun 2004 20:40:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA27298 for ; Mon, 28 Jun 2004 20:40:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1Bf6fp-0001zR-HC for pana@ietf.org; Mon, 28 Jun 2004 20:40:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1Bf6eq-0001kI-00 for pana@ietf.org; Mon, 28 Jun 2004 20:39:32 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1Bf6dp-0001Mm-00 for pana@ietf.org; Mon, 28 Jun 2004 20:38:29 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5T0cSpD012876; Tue, 29 Jun 2004 09:38:28 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5T0cSNO020409; Tue, 29 Jun 2004 09:38:28 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id KAA20405 ; Tue, 29 Jun 2004 09:38:27 +0900 Received: from mx4.toshiba.co.jp by tis2.tis.toshiba.co.jp id JAA24574; Tue, 29 Jun 2004 09:38:27 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id JAA11041; Tue, 29 Jun 2004 09:38:26 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5T0cPnE016389; Tue, 29 Jun 2004 09:38:25 +0900 (JST) Received: from steelhead ([172.30.24.114]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0I0100J92OFYCS@tsbpo1.po.toshiba.co.jp>; Tue, 29 Jun 2004 09:38:25 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1Bf6cz-0008W3-00; Mon, 28 Jun 2004 17:37:37 -0700 Date: Mon, 28 Jun 2004 20:37:37 -0400 From: Yoshihiro Ohba To: pana@ietf.org Message-id: <20040629003737.GA25808@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: pana@ietf.org User-Agent: Mutt/1.5.6+20040523i X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Subject: [Pana] Lost answer problem (a new issue) X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org There might be some cases in which a PaC or a PAA might need to send a duplicate answer to a retransmitted old request (as well as a fresh answer to a new request if any) considering that an answer message for an old request can be lost. Without this, a PANA session may stall in a way that the requester keeps retransmitting the old request while the responder may keep discarding them with waiting for a new request. The cases are described below. - When a PaC sends a PANA-Start-Answer message in response to a valid PANA-Start-Request message without a Cookie AVP, the answer message can be lost. The PANA-Start-Request would be retransmitted. To deal with the case, it might be better for the PaC to return a duplicate PANA-Start-Answer message after the PaC has been sent the first PANA-Start-Answer message until the PaC receives a valid PANA-Auth-Request message. - When a PaC sends a PANA-FirstAuth-End-Answer message in response to a valid PANA-FirstAuth-End-Request message (remember that a PANA-FirstAuth-End exchange is used for delimiting the first and second EAP authentications), the answer message may be lost. The PANA-FirstAuth-End-Request would be retransmitted (with updating transmission sequence number). To deal with the case, it might be better for the PaC to return a duplicate PANA-FirstAuth-End-Answer message (with updating transmission and received sequence numbers) after the PaC has been sent the first PANA-FirstAuth-End-Answer message until the PaC receives a valid PANA-Auth-Request message for the second EAP authentication. - When a PaC sends a PANA-Bind-Answer message in response to a valid PANA-Bind-Request message, the answer message can be lost. As as result, the PAA will retransmit the PANA-Bind-Request (but with using a different transmission sequence number). To deal with the case, it might be better for the PaC to return a duplicate PANA-Bind-Answer message (but with using different transmission and received sequence numbers) for a while after the first PANA-Bind-Request was received. The same thing can also apply to a PANA-Address-Update-Answer message that is sent by a PaC. - When a PaC or a PAA sends a PANA-Termination-Answer message in response to a valid PANA-Termination-Request message, the answer message can be lost. As as result, the requester will retransmit the request (but with using a different transmission sequence number). To deal with the case, it might be better for the sender of the answer to return a duplicate answer (with using different transmission and received sequence numbers) for a while after the first PANA-Termination-Request was received. The same thing can also apply to a PANA-Reauth-Answer message that is sent by a PaC or a PAA. Those could improve robustness of the PANA protocol against loss of answer message. Comments? Yoshihiro Ohba _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 29 05:29:26 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA05632 for ; Tue, 29 Jun 2004 05:29:26 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfEfl-0004ah-80; Tue, 29 Jun 2004 05:13:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfEcq-0003vl-CW for pana@megatron.ietf.org; Tue, 29 Jun 2004 05:10:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA04681 for ; Tue, 29 Jun 2004 05:09:58 -0400 (EDT) From: Dan.Forsberg@nokia.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BfEco-0004Tr-2z for pana@ietf.org; Tue, 29 Jun 2004 05:09:58 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BfEbK-0003wh-00 for pana@ietf.org; Tue, 29 Jun 2004 05:08:27 -0400 Received: from mgw-x1.nokia.com ([131.228.20.21]) by ietf-mx with esmtp (Exim 4.12) id 1BfEYs-00037U-00 for pana@ietf.org; Tue, 29 Jun 2004 05:05:55 -0400 Received: from esdks004.ntc.nokia.com (esdks004.ntc.nokia.com [172.21.138.159]) by mgw-x1.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i5T95tJ11950 for ; Tue, 29 Jun 2004 12:05:55 +0300 (EET DST) X-Scanned: Tue, 29 Jun 2004 12:05:36 +0300 Nokia Message Protector V1.3.31 2004060815 - RELEASE Received: (from root@localhost) by esdks004.ntc.nokia.com (8.12.9/8.12.9) id i5T95aw3013087 for ; Tue, 29 Jun 2004 12:05:36 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks004.ntc.nokia.com 00ErFyZS; Tue, 29 Jun 2004 12:05:20 EEST Received: from esebh004.NOE.Nokia.com (esebh004.ntc.nokia.com [172.21.138.84]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id i5T95KH06689 for ; Tue, 29 Jun 2004 12:05:20 +0300 (EET DST) Received: from esebh005.NOE.Nokia.com ([172.21.138.86]) by esebh004.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Tue, 29 Jun 2004 12:05:20 +0300 Received: from esebe008.NOE.Nokia.com ([172.21.138.48]) by esebh005.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Tue, 29 Jun 2004 12:05:19 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Tue, 29 Jun 2004 12:05:19 +0300 Message-ID: Thread-Topic: [issue98] Lost answer problem Thread-Index: AcRdswHbBvHLlWAmR26F84jmb7B/wAABShFg To: X-OriginalArrivalTime: 29 Jun 2004 09:05:19.0379 (UTC) FILETIME=[33920630:01C45DB8] X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL, NO_REAL_NAME autolearn=no version=2.60 Subject: [Pana] New: [issue98] Lost answer problem X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1879972109==" Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org --===============1879972109== content-class: urn:content-classes:message Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+ Og0KDQpGcm9tIFlvc2hpaGlybyBPaGJhOg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0NClRoZXJlIG1p Z2h0IGJlIHNvbWUgY2FzZXMgaW4gd2hpY2ggYSBQYUMgb3IgYSBQQUEgbWlnaHQgbmVlZCB0byBz ZW5kIGENCmR1cGxpY2F0ZSBhbnN3ZXIgdG8gYSByZXRyYW5zbWl0dGVkIG9sZCByZXF1ZXN0IChh cyB3ZWxsIGFzIGEgZnJlc2gNCmFuc3dlciB0byBhIG5ldyByZXF1ZXN0IGlmIGFueSkgY29uc2lk ZXJpbmcgdGhhdCBhbiBhbnN3ZXIgbWVzc2FnZSBmb3INCmFuIG9sZCByZXF1ZXN0IGNhbiBiZSBs b3N0LiAgV2l0aG91dCB0aGlzLCBhIFBBTkEgc2Vzc2lvbiBtYXkgc3RhbGwgaW4NCmEgd2F5IHRo YXQgdGhlIHJlcXVlc3RlciBrZWVwcyByZXRyYW5zbWl0dGluZyB0aGUgb2xkIHJlcXVlc3Qgd2hp bGUNCnRoZSByZXNwb25kZXIgbWF5IGtlZXAgZGlzY2FyZGluZyB0aGVtIHdpdGggd2FpdGluZyBm b3IgYSBuZXcgcmVxdWVzdC4NClRoZSBjYXNlcyBhcmUgZGVzY3JpYmVkIGJlbG93Lg0KDQotIFdo ZW4gYSBQYUMgc2VuZHMgYSBQQU5BLVN0YXJ0LUFuc3dlciBtZXNzYWdlIGluIHJlc3BvbnNlIHRv IGEgdmFsaWQNClBBTkEtU3RhcnQtUmVxdWVzdCBtZXNzYWdlIHdpdGhvdXQgYSBDb29raWUgQVZQ LCB0aGUgYW5zd2VyIG1lc3NhZ2UNCmNhbiBiZSBsb3N0LiAgVGhlIFBBTkEtU3RhcnQtUmVxdWVz dCB3b3VsZCBiZSByZXRyYW5zbWl0dGVkLiAgVG8gZGVhbA0Kd2l0aCB0aGUgY2FzZSwgaXQgbWln aHQgYmUgYmV0dGVyIGZvciB0aGUgUGFDIHRvIHJldHVybiBhIGR1cGxpY2F0ZQ0KUEFOQS1TdGFy dC1BbnN3ZXIgbWVzc2FnZSBhZnRlciB0aGUgUGFDIGhhcyBiZWVuIHNlbnQgdGhlIGZpcnN0DQpQ QU5BLVN0YXJ0LUFuc3dlciBtZXNzYWdlIHVudGlsIHRoZSBQYUMgcmVjZWl2ZXMgYSB2YWxpZA0K UEFOQS1BdXRoLVJlcXVlc3QgbWVzc2FnZS4NCg0KLSBXaGVuIGEgUGFDIHNlbmRzIGEgUEFOQS1G aXJzdEF1dGgtRW5kLUFuc3dlciBtZXNzYWdlIGluIHJlc3BvbnNlIHRvIGENCnZhbGlkIFBBTkEt Rmlyc3RBdXRoLUVuZC1SZXF1ZXN0IG1lc3NhZ2UgKHJlbWVtYmVyIHRoYXQgYQ0KUEFOQS1GaXJz dEF1dGgtRW5kIGV4Y2hhbmdlIGlzIHVzZWQgZm9yIGRlbGltaXRpbmcgdGhlIGZpcnN0IGFuZA0K c2Vjb25kIEVBUCBhdXRoZW50aWNhdGlvbnMpLCB0aGUgYW5zd2VyIG1lc3NhZ2UgbWF5IGJlIGxv c3QuICBUaGUNClBBTkEtRmlyc3RBdXRoLUVuZC1SZXF1ZXN0IHdvdWxkIGJlIHJldHJhbnNtaXR0 ZWQgKHdpdGggdXBkYXRpbmcNCnRyYW5zbWlzc2lvbiBzZXF1ZW5jZSBudW1iZXIpLiAgVG8gZGVh bCB3aXRoIHRoZSBjYXNlLCBpdCBtaWdodCBiZQ0KYmV0dGVyIGZvciB0aGUgUGFDIHRvIHJldHVy biBhIGR1cGxpY2F0ZSBQQU5BLUZpcnN0QXV0aC1FbmQtQW5zd2VyDQptZXNzYWdlICh3aXRoIHVw ZGF0aW5nIHRyYW5zbWlzc2lvbiBhbmQgcmVjZWl2ZWQgc2VxdWVuY2UgbnVtYmVycykNCmFmdGVy IHRoZSBQYUMgaGFzIGJlZW4gc2VudCB0aGUgZmlyc3QgUEFOQS1GaXJzdEF1dGgtRW5kLUFuc3dl cg0KbWVzc2FnZSB1bnRpbCB0aGUgUGFDIHJlY2VpdmVzIGEgdmFsaWQgUEFOQS1BdXRoLVJlcXVl c3QgbWVzc2FnZSBmb3INCnRoZSBzZWNvbmQgRUFQIGF1dGhlbnRpY2F0aW9uLg0KDQotIFdoZW4g YSBQYUMgc2VuZHMgYSBQQU5BLUJpbmQtQW5zd2VyIG1lc3NhZ2UgaW4gcmVzcG9uc2UgdG8gYSB2 YWxpZA0KUEFOQS1CaW5kLVJlcXVlc3QgbWVzc2FnZSwgdGhlIGFuc3dlciBtZXNzYWdlIGNhbiBi ZSBsb3N0LiAgQXMgYXMNCnJlc3VsdCwgdGhlIFBBQSB3aWxsIHJldHJhbnNtaXQgdGhlIFBBTkEt QmluZC1SZXF1ZXN0IChidXQgd2l0aCB1c2luZw0KYSBkaWZmZXJlbnQgdHJhbnNtaXNzaW9uIHNl cXVlbmNlIG51bWJlcikuICBUbyBkZWFsIHdpdGggdGhlIGNhc2UsIGl0DQptaWdodCBiZSBiZXR0 ZXIgZm9yIHRoZSBQYUMgdG8gcmV0dXJuIGEgZHVwbGljYXRlIFBBTkEtQmluZC1BbnN3ZXINCm1l c3NhZ2UgKGJ1dCB3aXRoIHVzaW5nIGRpZmZlcmVudCB0cmFuc21pc3Npb24gYW5kIHJlY2VpdmVk IHNlcXVlbmNlDQpudW1iZXJzKSBmb3IgYSB3aGlsZSBhZnRlciB0aGUgZmlyc3QgUEFOQS1CaW5k LVJlcXVlc3Qgd2FzIHJlY2VpdmVkLg0KVGhlIHNhbWUgdGhpbmcgY2FuIGFsc28gYXBwbHkgdG8g YSBQQU5BLUFkZHJlc3MtVXBkYXRlLUFuc3dlciBtZXNzYWdlDQp0aGF0IGlzIHNlbnQgYnkgYSBQ YUMuDQoNCi0gV2hlbiBhIFBhQyBvciBhIFBBQSBzZW5kcyBhIFBBTkEtVGVybWluYXRpb24tQW5z d2VyIG1lc3NhZ2UgaW4NCnJlc3BvbnNlIHRvIGEgdmFsaWQgUEFOQS1UZXJtaW5hdGlvbi1SZXF1 ZXN0IG1lc3NhZ2UsIHRoZSBhbnN3ZXINCm1lc3NhZ2UgY2FuIGJlIGxvc3QuICBBcyBhcyByZXN1 bHQsIHRoZSByZXF1ZXN0ZXIgd2lsbCByZXRyYW5zbWl0IHRoZQ0KcmVxdWVzdCAoYnV0IHdpdGgg dXNpbmcgYSBkaWZmZXJlbnQgdHJhbnNtaXNzaW9uIHNlcXVlbmNlIG51bWJlcikuICBUbw0KZGVh bCB3aXRoIHRoZSBjYXNlLCBpdCBtaWdodCBiZSBiZXR0ZXIgZm9yIHRoZSBzZW5kZXIgb2YgdGhl IGFuc3dlciB0bw0KcmV0dXJuIGEgZHVwbGljYXRlIGFuc3dlciAod2l0aCB1c2luZyBkaWZmZXJl bnQgdHJhbnNtaXNzaW9uIGFuZA0KcmVjZWl2ZWQgc2VxdWVuY2UgbnVtYmVycykgZm9yIGEgd2hp bGUgYWZ0ZXIgdGhlIGZpcnN0DQpQQU5BLVRlcm1pbmF0aW9uLVJlcXVlc3Qgd2FzIHJlY2VpdmVk LiAgVGhlIHNhbWUgdGhpbmcgY2FuIGFsc28gYXBwbHkNCnRvIGEgUEFOQS1SZWF1dGgtQW5zd2Vy IG1lc3NhZ2UgdGhhdCBpcyBzZW50IGJ5IGEgUGFDIG9yIGEgUEFBLg0KDQpUaG9zZSBjb3VsZCBp bXByb3ZlIHJvYnVzdG5lc3Mgb2YgdGhlIFBBTkEgcHJvdG9jb2wgYWdhaW5zdCBsb3NzIG9mDQph bnN3ZXIgbWVzc2FnZS4NCg0KQ29tbWVudHM/DQoNCllvc2hpaGlybyBPaGJhDQoNCi0tLS0tLS0t LS0NCmNhdGVnb3J5OiBUZWNobmljYWwNCmRvY3VtZW50OiBkcmFmdC1pZXRmLXBhbmEtcGFuYS14 eC50eHQNCm1lc3NhZ2VzOiAzMzUNCm5vc3k6IGRmb3JzYmVyDQpwcmlvcml0eTogTXVzdCBGaXgN CnN0YXR1czogUGVuZGluZw0KdGl0bGU6IExvc3QgYW5zd2VyIHByb2JsZW0NCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpQQU5BIElzc3VlcyA8cGFu YV9pc3N1ZXNAZGFuZm9yc2JlcmcuaW5mbz4NCjxodHRwOi8vZGFuZm9yc2JlcmcuaW5mbzo4MDgw L3BhbmEtaXNzdWVzL2lzc3VlOTg+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXw0K --===============1879972109== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana --===============1879972109==-- From pana-bounces@ietf.org Tue Jun 29 19:22:34 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA06726 for ; Tue, 29 Jun 2004 19:22:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfRgU-0000I0-Oz; Tue, 29 Jun 2004 19:06:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfRYj-0006At-Dr for pana@megatron.ietf.org; Tue, 29 Jun 2004 18:58:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA05665 for ; Tue, 29 Jun 2004 18:58:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BfRYh-0000Hb-Pk for pana@ietf.org; Tue, 29 Jun 2004 18:58:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BfRXu-0007ir-00 for pana@ietf.org; Tue, 29 Jun 2004 18:57:47 -0400 Received: from mailout2.samsung.com ([203.254.224.25]) by ietf-mx with esmtp (Exim 4.12) id 1BfRXC-00079G-00 for pana@ietf.org; Tue, 29 Jun 2004 18:57:02 -0400 Received: from custom-daemon.mailout2.samsung.com by mailout2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) id <0I0300201EE1LG@mailout2.samsung.com> for pana@ietf.org; Wed, 30 Jun 2004 07:56:25 +0900 (KST) Received: from ep_mmp2 (mailout2.samsung.com [203.254.224.25]) by mailout2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTP id <0I03000FUEE1P9@mailout2.samsung.com> for pana@ietf.org; Wed, 30 Jun 2004 07:56:25 +0900 (KST) Received: from Alperyegin ([105.144.29.152]) by mmp2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTPA id <0I03000RREDYPI@mmp2.samsung.com> for pana@ietf.org; Wed, 30 Jun 2004 07:56:25 +0900 (KST) Date: Tue, 29 Jun 2004 15:56:22 -0700 From: Alper Yegin Subject: RE: [Pana] PANA key derivation key In-reply-to: <20040622153953.GA2625@steelhead> To: "'Yoshihiro Ohba'" , pana@ietf.org Message-id: <000001c45e2c$4d99bef0$981d9069@sisa.samsung.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Mailer: Microsoft Outlook, Build 10.0.2627 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7BIT X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7BIT Yoshi, I understand these changes are proposed to have combine AAA keys when there are two of them. Couldn't we achieve the same by stating: "AAA-key is set to (AAA-Key1 | AAA-Key2) when there are two EAP runs." This could help collapse the two separate calculations into one in the pana-pana draft. Also what pana-ipsec refers to would still be valid. And we wouldn't need to compute a new key and use prf+ (simplification). What do you think? Alper > -----Original Message----- > From: pana-bounces@ietf.org [mailto:pana-bounces@ietf.org] On Behalf Of > Yoshihiro Ohba > Sent: Tuesday, June 22, 2004 8:40 AM > To: pana@ietf.org > Subject: [Pana] PANA key derivation key > > To reflect Pasi's comment on how to deal with two AAA-Keys in > pana-ipsec draft and resulting discussions, here is a proposed text > for PANA specification draft to define PANA_KD_Key. > > In section 4.1.5 of draft-ietf-pana-pana-04.txt, > > change: > > " > * PANA SA attributes: > > + AAA-Key > > + AAA-Key Identifier > > + PANA_MAC_Key > > The PANA_MAC_Key is used to integrity protect PANA messages. When > the PANA_MAC_Key is derived from a single AAA-Key, it is computed in > the following way: > > > PANA_MAC_KEY = The first N bits of > HMAC_SHA1(AAA-Key, ISN_pac | ISN_paa | Session-ID) > > where the value of N depends on the integrity protection algorithm in > use, i.e., N=160 for HMAC-SHA1. > > When the PANA_MAC_Key is derived from two AAA-Keys, it is computed in > the following way: > > PANA_MAC_KEY = The first N bits of > HMAC_SHA1(AAA-Key1 | AAA-Key2, ISN_pac | ISN_paa | > Session-ID) > > where AAA-Key1 and AAA-Key2 are AAA-Keys for the first and second EAP > authentication in a single PANA authentication phase, respectively. > > The length of AAA-Key, AAA-Key1 and AAA-Key2 MUST be N bits or > longer. See Section 4.1.6 for the detailed usage of the > PANA_MAC_Key. > " > > to: > > * PANA SA attributes: > > + AAA-Key > > + AAA-Key Identifier > > + PANA_MAC_Key > > + PANA_KD_Key > > The PANA_MAC_Key is used to integrity protect PANA messages. The > PANA_KD_Key is used to derive keys used for bootstrapping > per-packet ciphering between PaC and EP. The PANA_MAC_Key has a > length of N bits, where the value of N depends on the integrity > protection algorithm in use, which is HMAC-SHA1 in this document > and N would be 160 bits for this case. The PANA_KD_Key has a > length of 512 bits, which is equal to the typical length of a > AAA-Key or an EAP Master Session Key [I-D.ietf-eap-keying]. > > When the PANA_MAC_Key and PANA_PD_Key are derived from a single > AAA-Key, it is computed in the following way: > > {PANA_MAC_Key | PANA_KD_Key} = > HMAC_SHA1+(AAA-Key, ISN_pac | ISN_paa | Session-ID) > > When PANA_MAC_Key and PANA_PD_Key are derived from two AAA-Keys, it > is computed in the following way: > > {PANA_MAC_Key | PANA_KD_Key} = > HMAC_SHA1+(AAA-Key1 | AAA-Key2, ISN_pac | ISN_paa | Session- > ID) > > In the above key derivation algorithms, HMAC_SHA1+ is the > iteratively calculated version of HMAC_SHA1 algorithm by applying > HMAC_SHA1 in the prf+ function defined in IKEv2 > [I-D:ietf-ipsec-ikev2]. AAA-Key1 and AAA-Key2 are AAA-Keys for the > first and second EAP authentication in a single PANA authentication > phase, respectively. The length of AAA-Key, AAA-Key1 and AAA-Key2 > MUST be 160 bits or longer. See Section 4.1.6 for the detailed > usage of the PANA_MAC_Key. See [I-D:ietf-pana-ipsec] for the usage > of the PANA_KD_Key for bootstrapping IPsec between PaC and EP. > " > > Regards, > > Yoshihiro Ohba > > _______________________________________________ > Pana mailing list > Pana@ietf.org > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 29 19:28:11 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07104 for ; Tue, 29 Jun 2004 19:28:10 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfRtK-0002N2-H7; Tue, 29 Jun 2004 19:19:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfRgP-0000Dc-Dy for pana@megatron.ietf.org; Tue, 29 Jun 2004 19:06:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA06094 for ; Tue, 29 Jun 2004 19:06:30 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BfRgN-0003KP-Ue for pana@ietf.org; Tue, 29 Jun 2004 19:06:32 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BfRfO-0002v5-00 for pana@ietf.org; Tue, 29 Jun 2004 19:05:31 -0400 Received: from mailout1.samsung.com ([203.254.224.24]) by ietf-mx with esmtp (Exim 4.12) id 1BfReK-0002Ax-00 for pana@ietf.org; Tue, 29 Jun 2004 19:04:24 -0400 Received: from custom-daemon.mailout1.samsung.com by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) id <0I0300E01EQCW0@mailout1.samsung.com> for pana@ietf.org; Wed, 30 Jun 2004 08:03:48 +0900 (KST) Received: from ep_mmp2 (mailout1.samsung.com [203.254.224.24]) by mailout1.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTP id <0I0300M7XEQBVH@mailout1.samsung.com> for pana@ietf.org; Wed, 30 Jun 2004 08:03:48 +0900 (KST) Received: from Alperyegin ([105.144.29.152]) by mmp2.samsung.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003)) with ESMTPA id <0I0300321EQ9YB@mmp2.samsung.com> for pana@ietf.org; Wed, 30 Jun 2004 08:03:47 +0900 (KST) Date: Tue, 29 Jun 2004 16:03:45 -0700 From: Alper Yegin Subject: Issue 93 (was RE: Pasi's pana-04 comments (was RE: [Pana] Some comments about PANA drafts)) In-reply-to: <20040615140712.GG30440@steelhead> To: "'Yoshihiro Ohba'" Message-id: <000101c45e2d$556d4420$981d9069@sisa.samsung.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Mailer: Microsoft Outlook, Build 10.0.2627 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7BIT Cc: Pasi.Eronen@nokia.com, pana@ietf.org X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Content-Transfer-Encoding: 7BIT This looks good to me. > > > Section 6.3: Diameter uses SMI enterprise numbers for Vendor-Id; > > > does PANA use that also, or does it define its own number space? > > > > Yes. We shall spell this out in the document [a new issue]. > > I think PANA should use SMI enterprise numbers for Vendor-Id as > Diameter does. > > How about changing: > > " > Vendor-Id > > The Vendor-Id field is present if the 'V' bit is set in the AVP > Flags field. The optional four-octet Vendor-Id field contains the > uniquely assigned id value, encoded in network byte order. Any > vendor wishing to implement a vendor-specific PANA AVP MUST use > their own Vendor-Id along with their privately managed AVP address > space, guaranteeing that they will not collide with any other > vendor's vendor-specific AVP(s), nor with future IETF > applications. > " > > to: > > " > Vendor-Id > > The Vendor-Id field is present if the 'V' bit is set in the AVP > Flags field. The optional four-octet Vendor-Id field contains the > IANA assigned "SMI Network Management Private Enterprise Codes" > [ianaweb] value, encoded in network byte order. Any > vendor wishing to implement a vendor-specific PANA AVP MUST use > their own Vendor-Id along with their privately managed AVP > address space, guaranteeing that they will not collide with any > other vendor's vendor-specific AVP(s), nor with future IETF > applications. > " _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 29 21:24:16 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA13155 for ; Tue, 29 Jun 2004 21:24:16 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfTf3-0003tW-TI; Tue, 29 Jun 2004 21:13:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfTXh-0002Hk-3M for pana@megatron.ietf.org; Tue, 29 Jun 2004 21:05:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12265 for ; Tue, 29 Jun 2004 21:05:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BfTXf-0002Uv-5u for pana@ietf.org; Tue, 29 Jun 2004 21:05:39 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BfTWp-00028Q-00 for pana@ietf.org; Tue, 29 Jun 2004 21:04:48 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1BfTW2-0001lm-00 for pana@ietf.org; Tue, 29 Jun 2004 21:03:59 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5U13ppD017674; Wed, 30 Jun 2004 10:03:51 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5U13pbe024034; Wed, 30 Jun 2004 10:03:51 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id LAA24027 ; Wed, 30 Jun 2004 10:03:51 +0900 Received: from mx4.toshiba.co.jp by tis2.tis.toshiba.co.jp id KAA09136; Wed, 30 Jun 2004 10:03:34 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id KAA13981; Wed, 30 Jun 2004 10:03:31 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5U13UnE015811; Wed, 30 Jun 2004 10:03:30 +0900 (JST) Received: from steelhead ([172.30.24.116]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0I0300FOUK9QA9@tsbpo1.po.toshiba.co.jp>; Wed, 30 Jun 2004 10:03:29 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BlH7P-0003XH-00; Thu, 15 Jul 2004 18:02:31 -0700 Date: Thu, 15 Jul 2004 21:02:30 -0400 From: Yoshihiro Ohba To: pana@ietf.org Message-id: <20040716010230.GJ28115@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: pana@ietf.org User-Agent: Mutt/1.5.6+20040523i X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Subject: [Pana] a new issue: IANA considerations X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Here is initial text for IANA Considerations section of the PANA specification. Comments are appreciated. ----------------------------------- [1] Update Section 8 as follows: " 8. IANA Considerations This section provides guidance to the Internet Assigned Numbers Authority (IANA) regarding registration of values related to the PANA protocol, in accordance with BCP 26 [IANA]. The following policies are used here with the meanings defined in BCP 26: "Private Use", "First Come First Served", "Expert Review", "Specification Required", "IETF Consensus", "Standards Action". This section explains the criteria to be used by the IANA for assignment of numbers within namespaces defined within this document. For registration requests where a Designated Expert should be consulted, the responsible IESG area director should appoint the Designated Expert. For Designated Expert with Specification Required, the request is posted to the PANA WG mailing list (or, if it has been disbanded, a successor designated by the Area Director) for comment and review, and MUST include a pointer to a public specification. Before a period of 30 days has passed, the Designated Expert will either approve or deny the registration request and publish a notice of the decision to the PANA WG mailing list or its successor. A denial notice must be justified by an explanation and, in the cases where it is possible, concrete suggestions on how the request can be modified so as to become acceptable. 8.1 PANA UDP Port Number PANA uses one well-known UDP port number (Section 4.1.2, Section 4.2 and Section 6.1), which needs to be assigned by the IANA. 8.2 PANA Multicast Address PANA uses one well-known IPv4 multicast address for which the scope is limited to be link-local by setting the TTL field to 255, and one well-known IPv6 link-local scoped multicast address (Section 4.2 and Section 6.1), which need to be assigned by the IANA. 8.3 PANA Header As defined in Section 6.2, the PANA header contains two fields that requires IANA namespace management; the Message Type and Flags field. 8.3.1 Message Type The Message Type namespace is used to identify PANA messages. Values 0-16,777,213 are for permanent, standard message types, allocated by IETF Consensus [IANA]. This document defines the Message Types 1-8. See Section 6.4 for the assignment of the namespace in this specification. The values 16,777,214 and 16,777,215 (hexadecimal values 0xfffffe - 0xffffff) are reserved for experimental messages. As these codes are only for experimental and testing purposes, no guarantee is made for interoperability between communicating PaC and PAA using experimental commands, as outlined in [IANA-EXP]. 8.3.2 Flags There are eight bits in the Flags field of the PANA header. This document assigns bit 0 ('R'equest), bit 4 ('S'eparate) and bit 5 ('N'AP Authentication). The remaining bits MUST only be assigned via a Standards Action [IANA]. 8.4 AVP Header As defined in Section 6.3, the AVP header contains three fields that requires IANA namespace management; the AVP Code, AVP Flags and Vendor-Id fields where only the AVP Code and AVP Flags create new namespaces. 8.4.1 AVP Code The AVP Code namespace is used to identify attributes. There are multiple namespaces. Vendors can have their own AVP Codes namespace which will be identified by their Vendor-ID (also known as Enterprise-Number) and they control the assignments of their vendor-specific AVP codes within their own namespace. The absence of a Vendor-ID or a Vendor-ID value of zero (0) identifies the IETF IANA controlled AVP Codes namespace. The AVP Codes and sometimes also possible values in an AVP are controlled and maintained by IANA. AVP Code 0 is not used. This document defines the AVP Codes 1024-1041. See Section 6.5 for the assignment of the namespace in this specification. AVPs may be allocated following Designated Expert with Specification Required [IANA]. Release of blocks of AVPs (more than 3 at a time for a given purpose) should require IETF Consensus. Note that PANA defines a mechanism for Vendor-Specific AVPs, where the Vendor-Id field in the AVP header is set to a non-zero value. Vendor-Specific AVPs codes are for Private Use and should be encouraged instead of allocation of global attribute types, for functions specific only to one vendor's implementation of PANA, where no interoperability is deemed useful. Where a Vendor-Specific AVP is implemented by more than one vendor, allocation of global AVPs should be encouraged instead. 8.4.2 AVP Flags There are 8 bits in the AVP Flags field of the AVP header, defined in Section 6.3. This document assigns bit 0 ('V'endor Specific) and bit 1 ('M'andatory). The remaining bits should only be assigned via a Standards Action [IANA]. 8.5 AVP Values Certain AVPs in PANA define a list of values with various meanings. For attributes other than those specified in this section, adding additional values to the list can be done on a First Come, First Served basis by IANA. 8.5.1 Algorithm Values of MAC AVP As defined in Section 6.5.1, the Algorithm field of MAC AVP (AVP Code 1024) defines the value of 1 (one) for HMAC-SHA1. All remaining values are available for assignment via IETF Consensus [IANA]. 8.5.2 Protection-Capability AVP Values As defined in Section 6.5.5, the Protection-Capability AVP (AVP Code 1028) defines the values 0 and 1. All remaining values are available for assignment via a Standards Action [IANA]. 8.5.3 Termination-Cause AVP Values As defined in Section 6.5.6, the Termination-Cause AVP (AVP Code 1029) defines the values 1, 4 and 8. All remaining values are available for assignment via IETF Consensus [IANA]. 8.5.4 Result-Code AVP Values As defined in Section 6.5.7, the Result-Code AVP (AVP Code 1030) defines the values 2001, 3001-3002, 3008-3009, 4001, 5001-5009 and 5011-5019. All remaining values are available for assignment via IETF Consensus [IANA]. 8.5.5 Post-PANA-Address-Configuration AVP Values As defined in Section 6.5.17, the Post-PANA-Address-Configuration AVP (AVP Code 1040) defines the bits 0 ('N': no configuration), 1 ('D': DHCP), 2 ('A' stateless autoconfiguration), 3 ('T': DHCP with IPsec tunnel mode) and 4 ('I': IKEv2). All remaining values are available for assignment via a Standards Action [IANA]. " [2] Add the following informative reference: " [IANA-EXP] Narten, T., "Assigning Experimental and Testing Numbers Considered Useful", BCP 82, RFC 3692, January 2004. " _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Tue Jun 29 21:47:32 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA14284 for ; Tue, 29 Jun 2004 21:47:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfU7c-0001CN-7Y; Tue, 29 Jun 2004 21:42:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfU4e-0000Ey-BB for pana@megatron.ietf.org; Tue, 29 Jun 2004 21:39:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA13877 for ; Tue, 29 Jun 2004 21:39:42 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BfU4c-00009X-Jk for pana@ietf.org; Tue, 29 Jun 2004 21:39:42 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BfU3e-0007Yh-00 for pana@ietf.org; Tue, 29 Jun 2004 21:38:43 -0400 Received: from inet-tsb.toshiba.co.jp ([202.33.96.40]) by ietf-mx with esmtp (Exim 4.12) id 1BfU2f-0007AG-00 for pana@ietf.org; Tue, 29 Jun 2004 21:37:41 -0400 Received: from tsb-wall.toshiba.co.jp ([133.199.160.134]) by inet-tsb.toshiba.co.jp with ESMTP id i5U1bepD016678; Wed, 30 Jun 2004 10:37:41 +0900 (JST) Received: (from root@localhost) by tsb-wall.toshiba.co.jp id i5U1begF013383; Wed, 30 Jun 2004 10:37:40 +0900 (JST) Received: from tis2 [133.199.160.66] by tsb-wall.toshiba.co.jp with SMTP id LAA13375 ; Wed, 30 Jun 2004 10:37:40 +0900 Received: from mx.toshiba.co.jp by tis2.tis.toshiba.co.jp id KAA11070; Wed, 30 Jun 2004 10:37:40 +0900 (JST) Received: from tsb-sgw.toshiba.co.jp by toshiba.co.jp id KAA23574; Wed, 30 Jun 2004 10:37:39 +0900 (JST) Received: from tsbpo1.po.toshiba.co.jp by tsb-sgw.toshiba.co.jp with ESMTP id i5U1bdnE010933; Wed, 30 Jun 2004 10:37:39 +0900 (JST) Received: from steelhead ([172.30.24.116]) by tsbpo1.po.toshiba.co.jp (Sun Internet Mail Server sims.3.5.1999.01.13.19.49.p4) with ESMTP id <0I030000FLUNRN@tsbpo1.po.toshiba.co.jp>; Wed, 30 Jun 2004 10:37:38 +0900 (JST) Received: from ohba by steelhead with local (Exim 3.36 #1 (Debian)) id 1BlHfJ-0003hA-00; Thu, 15 Jul 2004 18:37:33 -0700 Date: Thu, 15 Jul 2004 21:37:33 -0400 From: Yoshihiro Ohba Subject: Re: [Pana] PANA key derivation key In-reply-to: <000001c45e2c$4d99bef0$981d9069@sisa.samsung.com> To: Alper Yegin Message-id: <20040716013733.GL28115@steelhead> MIME-version: 1.0 Content-type: text/plain; charset=iso-2022-jp Content-disposition: inline Mail-Followup-To: Alper Yegin , 'Yoshihiro Ohba' , pana@ietf.org User-Agent: Mutt/1.5.6+20040523i References: <20040622153953.GA2625@steelhead> <000001c45e2c$4d99bef0$981d9069@sisa.samsung.com> X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.2 required=5.0 tests=AWL,DATE_IN_FUTURE_96_XX autolearn=no version=2.60 Cc: "'Yoshihiro Ohba'" , pana@ietf.org X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Hi Alper, Your proposal looks simpler and better. Yoshihiro Ohba On Tue, Jun 29, 2004 at 03:56:22PM -0700, Alper Yegin wrote: > Yoshi, > > I understand these changes are proposed to have combine AAA keys when > there are two of them. Couldn't we achieve the same by stating: > > "AAA-key is set to (AAA-Key1 | AAA-Key2) when there are two EAP runs." > > This could help collapse the two separate calculations into one in the > pana-pana draft. Also what pana-ipsec refers to would still be valid. > And we wouldn't need to compute a new key and use prf+ (simplification). > > What do you think? > > Alper > > > > > > -----Original Message----- > > From: pana-bounces@ietf.org [mailto:pana-bounces@ietf.org] On Behalf > Of > > Yoshihiro Ohba > > Sent: Tuesday, June 22, 2004 8:40 AM > > To: pana@ietf.org > > Subject: [Pana] PANA key derivation key > > > > To reflect Pasi's comment on how to deal with two AAA-Keys in > > pana-ipsec draft and resulting discussions, here is a proposed text > > for PANA specification draft to define PANA_KD_Key. > > > > In section 4.1.5 of draft-ietf-pana-pana-04.txt, > > > > change: > > > > " > > * PANA SA attributes: > > > > + AAA-Key > > > > + AAA-Key Identifier > > > > + PANA_MAC_Key > > > > The PANA_MAC_Key is used to integrity protect PANA messages. When > > the PANA_MAC_Key is derived from a single AAA-Key, it is computed > in > > the following way: > > > > > > PANA_MAC_KEY = The first N bits of > > HMAC_SHA1(AAA-Key, ISN_pac | ISN_paa | > Session-ID) > > > > where the value of N depends on the integrity protection algorithm > in > > use, i.e., N=160 for HMAC-SHA1. > > > > When the PANA_MAC_Key is derived from two AAA-Keys, it is computed > in > > the following way: > > > > PANA_MAC_KEY = The first N bits of > > HMAC_SHA1(AAA-Key1 | AAA-Key2, ISN_pac | ISN_paa > | > > Session-ID) > > > > where AAA-Key1 and AAA-Key2 are AAA-Keys for the first and second > EAP > > authentication in a single PANA authentication phase, respectively. > > > > The length of AAA-Key, AAA-Key1 and AAA-Key2 MUST be N bits or > > longer. See Section 4.1.6 for the detailed usage of the > > PANA_MAC_Key. > > " > > > > to: > > > > * PANA SA attributes: > > > > + AAA-Key > > > > + AAA-Key Identifier > > > > + PANA_MAC_Key > > > > + PANA_KD_Key > > > > The PANA_MAC_Key is used to integrity protect PANA messages. The > > PANA_KD_Key is used to derive keys used for bootstrapping > > per-packet ciphering between PaC and EP. The PANA_MAC_Key has a > > length of N bits, where the value of N depends on the integrity > > protection algorithm in use, which is HMAC-SHA1 in this document > > and N would be 160 bits for this case. The PANA_KD_Key has a > > length of 512 bits, which is equal to the typical length of a > > AAA-Key or an EAP Master Session Key [I-D.ietf-eap-keying]. > > > > When the PANA_MAC_Key and PANA_PD_Key are derived from a single > > AAA-Key, it is computed in the following way: > > > > {PANA_MAC_Key | PANA_KD_Key} = > > HMAC_SHA1+(AAA-Key, ISN_pac | ISN_paa | Session-ID) > > > > When PANA_MAC_Key and PANA_PD_Key are derived from two AAA-Keys, it > > is computed in the following way: > > > > {PANA_MAC_Key | PANA_KD_Key} = > > HMAC_SHA1+(AAA-Key1 | AAA-Key2, ISN_pac | ISN_paa | > Session- > > ID) > > > > In the above key derivation algorithms, HMAC_SHA1+ is the > > iteratively calculated version of HMAC_SHA1 algorithm by applying > > HMAC_SHA1 in the prf+ function defined in IKEv2 > > [I-D:ietf-ipsec-ikev2]. AAA-Key1 and AAA-Key2 are AAA-Keys for the > > first and second EAP authentication in a single PANA authentication > > phase, respectively. The length of AAA-Key, AAA-Key1 and AAA-Key2 > > MUST be 160 bits or longer. See Section 4.1.6 for the detailed > > usage of the PANA_MAC_Key. See [I-D:ietf-pana-ipsec] for the usage > > of the PANA_KD_Key for bootstrapping IPsec between PaC and EP. > > " > > > > Regards, > > > > Yoshihiro Ohba > > > > _______________________________________________ > > Pana mailing list > > Pana@ietf.org > > https://www1.ietf.org/mailman/listinfo/pana > > > _______________________________________________ > Pana mailing list > Pana@ietf.org > https://www1.ietf.org/mailman/listinfo/pana _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana From pana-bounces@ietf.org Wed Jun 30 05:37:51 2004 Received: from megatron.ietf.org (megatron.ietf.org [132.151.6.71]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA04499 for ; Wed, 30 Jun 2004 05:37:51 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfbTd-0001qr-Qk; Wed, 30 Jun 2004 05:34:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1BfbLt-0000vJ-7W for pana@megatron.ietf.org; Wed, 30 Jun 2004 05:26:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA04171 for ; Wed, 30 Jun 2004 05:25:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BfbLq-0003Sk-LM for pana@ietf.org; Wed, 30 Jun 2004 05:25:58 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BfbKw-00034d-00 for pana@ietf.org; Wed, 30 Jun 2004 05:25:02 -0400 Received: from smtp2.int-evry.fr ([157.159.10.45]) by ietf-mx with esmtp (Exim 4.12) id 1BfbK1-0002H1-00 for pana@ietf.org; Wed, 30 Jun 2004 05:24:05 -0400 Received: from ipv6-5.int-evry.fr (ipv6-5.int-evry.fr [157.159.100.78]) by smtp2.int-evry.fr (Postfix) with ESMTP id 0E9052FDC5; Wed, 30 Jun 2004 11:23:30 +0200 (CEST) Received: from jb by ipv6-5.int-evry.fr with local (Exim id 1BfbIO-0002NW-CA; Wed, 30 Jun 2004 11:22:24 +0200 Date: Wed, 30 Jun 2004 11:22:24 +0200 From: Julien Bournelle To: pana@ietf.org Message-ID: <20040630092224.GO6107@ipv6-5.int-evry.fr> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-INT-MailScanner-Information: Please contact the ISP for more information X-INT-MailScanner: Found to be clean X-INT-MailScanner-SpamCheck: n'est pas un polluriel, SpamAssassin (score=-4.9, requis 4.5, autolearn=not spam, BAYES_00 -4.90) X-MailScanner-From: jb@ipv6-5.int-evry.fr X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Cc: Gerardo Giaretta , Maryline MAKNAVICIUS-LAURENT , yacine , Hannes Tschofening Subject: [Pana] I-D ACTION:draft-bournelle-pana-ctp-00.txt X-BeenThere: pana@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Protocol for carrying Authentication for Network Access List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: pana-bounces@ietf.org Errors-To: pana-bounces@ietf.org Hi all, We have published a draft regarding mobility handling and the usage of CTP in PANA. Comments are highly appreciated. Best regards, -------- A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : Context Transfer for PANA Author(s) : J. Bournelle, et al. Filename : draft-bournelle-pana-ctp-00.txt Pages : 24 Date : 2004-6-23 The PANA protocol offers a way to authenticate clients in IP based access networks. It carries EAP over UDP which permits ISPs to use multiple authentication methods. However, in roaming environments IP clients might change of gateways and new EAP authentication from scratch may occur. This can considerably degrade performance. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-bournelle-pana-ctp-00.txt -- julien.bournelle@int-evry.fr _______________________________________________ Pana mailing list Pana@ietf.org https://www1.ietf.org/mailman/listinfo/pana