RE: Protection capability needed? (was RE: [Pana] Other suggestions for pana-pana)

Yoshi,

Irrespective of whether PANA is used, "how PaC knows the right layer to
enable per-packet security" is an orthogonal issue (note PANA's business).
Agreed?

If so, unless the appropriate per-packet security was already established
prior to PANA execution, PaC can figure out that it needs to be enabled
after PANA.

I think this is how we can clean PANA off this mechanism. Sure I agree that
an explicit message like we have in PANA is, well, "more explicit!" But I
think this approach also make sense, especially for the sake of simplifying
the PANA.

Alper

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:yohba@tari.toshiba.com]
> Sent: Friday, October 06, 2006 11:33 PM
> To: Alper Yegin
> Cc: 'Yoshihiro Ohba'; 'Mark Townsley'; pana@ietf.org
> Subject: Re: Protection capability needed? (was RE: [Pana] Other
> suggestions for pana-pana)
> 
> Does it mean bootstrapping lower-layer security (i.e., mechanisms
> described
> in draft-ietf-pana-ipsec, etc.) is not an aspect introduced by PANA?
> 
> Yoshihiro Ohba
> 
> 
> 
> On Fri, Oct 06, 2006 at 11:27:23PM +0300, Alper Yegin wrote:
> > > Similar to PPAC discussion, I think we still need one bit to indicate
> >
> > This is different than PPAC. In PPAC case, configuration of so-called
> POPA
> > is an aspect introduced by PANA. Hence we deal with it.
> >
> > The same cannot be said about protection capability of the access
> network.
> > For that, I'm inclined to think this is not a problem that we need to
> deal
> > with PANA.
> >
> > Alper
> >
> >
> >
> > > that protection is needed.  Actual protection layer can be known from
> > > the Address Family information in EP's Device-Id in PBR.
> > >
> > > Yoshihiro Ohba
> > >
> > >
> > > On Fri, Oct 06, 2006 at 04:12:56PM +0300, Alper Yegin wrote:
> > > > > > 8.13: The "Protection Capability" AVP is another layer
violation.
> > > Why
> > > > > does
> > > > > > the PANA protocol itself care about what kind of a connection it
> is
> > > > > running
> > > > > > over? At the system level you may be concerned, but why within
> PANA
> > > > > itself?
> > > > > > What if
> > > > > > you are using something other than IPsec (DTLS? SSL? etc?)? Do
> you
> > > > > really
> > > > > > want to maintain all of the possibilities here? To what gain?
> > > > >
> > > > > Similar question: If we don't define Protection-Capability AVP,
> how
> > > > > the PaC can/should know which layer security needs to be
> bootstrapped?
> > > >
> > > > Similar to my feedback on the earlier comment, maybe this is not our
> > > problem
> > > > either. Unless we identify some PANA-specific aspect here, we may
> not
> > > have
> > > > to solve this problem as well.
> > > >
> > > > Alper
> > > >
> > > >
> > > >
> > > >
> > > >
> >
> >

_______________________________________________
Pana mailing list
Pana@ietf.org
https://www1.ietf.org/mailman/listinfo/pana