Re: [pcp] #62: Client-driven or server-driven auth retransmissions

Hi Simon:

El 24/10/2012, a las 16:29, Simon Perreault escribió:

> Le 2012-10-24 07:59, Sam Hartman a écrit :
>> We could really use input from PCP implementations about whether having
>> the authentication retransmit timer on the client is easier than the
>> server.
> 
> I can't say I understand all the technical details, but here's my view:
> 
> Without auth, only PCP clients do retransmissions. Servers only reply to packets, so that's less state and load on PCP servers. It would be nice if we could keep it the way it is.

In any case, the PCP server will have to keep a state since it will have to run an EAP authenticator state machine and a AAA client. Thus, handling a timer should not add too much (or basically nothing), specially when you already have a protocol that does that for you. 

Having said that, as far as I understand it, the side-by-side PANA solution would not touch this behavior you mention in PCP clients and PCP server implementations. At PCP level, retransmissions will work as usual: PCP clients do retransmissions. But performing authentication would be run by a different protocol which is not PCP and which already provides all the functionality required to perform with full guarantees the authentication you need.

In my opinion, using PANA to bootstrap a PCP SA is pretty straight forward. You run PANA, you get a MSK that it is used to derive a key to build the PCP SA. If during the PCP SA life, you need to refresh the key used for that, you need to perform a re-authentication to obtain a new fresh MSK and therefore a fresh PCP SA. Well, you have also that with PANA. When you do not require the key and, therefore, the PCP SA, you can terminate the PANA session and that's all.

Hope this helps.

> 
> My 2¢CAD...
> 
> Simon
> -- 
> DTN made easy, lean, and smart --> http://postellation.viagenie.ca
> NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
> STUN/TURN server               --> http://numb.viagenie.ca
> _______________________________________________
> pcp mailing list
> pcp@ietf.org
> https://www.ietf.org/mailman/listinfo/pcp

-------------------------------------------------------
Rafael Marin Lopez, PhD
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: +34868888501 Fax: +34868884151 e-mail: rafa@um.es
-------------------------------------------------------