Re: [pcp] EAP retransmits and re-authentication

[Yoshihiro Ohba <[e-mail]>]

Margaret,

(2012/09/21 1:45), Margaret Wasserman wrote:
> 
> On Sep 20, 2012, at 12:12 PM, Yoshihiro Ohba wrote:
>>> Actually, I didn't propose a change; I simply pointed out that you can
>>> do it either way depending on what is easiest for PCP implementations;
>>> we should pick, but what we pick should be based on the needs of the PCP
>>> community.
>>
>> I would rather consider this as the major disadvantage of tight
>> coupling EAP and PCP.  It is much easier to run PANA and PCP
>> side-by-side which achieves loose coupling of EAP and PCP.=
> 
> The problem is that running PCP and PANA side-by-side doesn't really change anything...
> 
> Either we change PCP to have a notion of a "session" that is associated with every mapping, and to understand to understand that external events can cause an asynchronous event of some sort that invalidates all of those mappings, or we don't...
> 
> I greatly prefer a model where the a client is authenticated and authorized to create a mapping, at the time that the mapping is created, and there is no presumption that the mapping is tied to any sort of ongoing client authentication/authorization.
> 

I disagree.  Loose coupling of authentication/authorization and states
associated with authorization creates a security issue.  Loose
coupling makes it difficult for service providers to strictly enforce
their services based on the authentication/authorization.

> Otherwise, I suppose we could _claim_ to support re-authentication, but what does it mean if PANA performs re-authentication and there is no meaningful way to communicate a re-authentication success, or more importantly perhaps, a re-authentication failure to PCP.
> 
> How are you imagining this would work in the side-by-side case -- re-authentication occurs, and then what?
> 

I suggest you to take a look at RFC 5609 on how it can work.
Completion of initial authentication and re-authentication calls
Authorize() upon success and Disconnect() upon failure which are
typically implemented as a callback.

"
   void Disconnect()

      A procedure to delete the PANA session as well as the
      corresponding EAP session and authorization state.

   boolean Authorize()

      A procedure to create or modify authorization state.  It returns
      TRUE if authorization is successful.  Otherwise, it returns FALSE.
      It is assumed that Authorize() procedure of PaC state machine
      always returns TRUE.  In the case that a non-key-generating EAP
      method is used but a PANA SA is required after successful
      authentication (generate_pana_sa() returns TRUE), Authorize()
      procedure must return FALSE.
"

If you find some issue, we can work on revising RFC 5609 if something
is missing for PCP needs, which would be more productive IMO.

Yoshihiro Ohba


> Margaret
> 
> 
>