Re: [pcp] I-D Action: draft-ietf-pcp-authentication-04.txt

["Tirumaleswar Reddy (tireddy)" <[e-mail]>]

> -----Original Message-----
> From: Zhangdacheng (Dacheng) [mailto:[e-mail]]
> Sent: Monday, August 11, 2014 11:56 AM
> To: Tirumaleswar Reddy (tireddy); [e-mail]
> Subject: RE: [pcp] I-D Action: draft-ietf-pcp-authentication-04.txt
> 
> 
> 
> > -----Original Message-----
> > From: Tirumaleswar Reddy (tireddy) [mailto:[e-mail]]
> > Sent: Friday, August 08, 2014 7:17 PM
> > To: Zhangdacheng (Dacheng); [e-mail]
> > Subject: RE: [pcp] I-D Action: draft-ietf-pcp-authentication-04.txt
> >
> > Hi Dacheng,
> >
> > Responding to the only ones which needs further discussion.
> >
> > > >
> > > > [12] I think a section is required to explain how PCP
> > > > authentication works in the presence of PCP proxies ?
> > > >         In specific explain what happens when PCP proxy and PCP
> > > > server are involved in re-authentication while PCP clients are
> > > > sending PCP
> > > requests.
> > > >
> > > [Dacheng Zhang:]
> > > How about the following text?
> > >
> > > " During a re-authentication procedure between a PCP server and a
> > > PCP proxy, the proxy SHOULD discard the mapping creation requests
> > > from its PCP
> >
> > It could be any PCP request (not just specific to mapping creation
> > request)
> >
> > > clients if the PCP proxy does not already have a valid active
> > > mapping for this mapping-creation request. Because PCP clients are
> > > responsible for reliable delivery of PCP request messages, it will
> > > resend the requests. Then, after the re-authentication finishes, the
> > > requests will be
> > processed. "
> >
> > The other variation is that in case of re-authentication b/w PCP proxy
> > and PCP server, PCP proxy can use current SA to proxy the PCP request
> > from the client and does not have to discard PCP messages.
> [Dacheng Zhang:]
> I think it works. Before the current key are discarded by the new keys
> generated during the re-auth, this key can be used to protect the PCP-auth
> messages. So, it is also reasonable to used this key to protect the common
> pcp messages. Thanks for pointing this out.

One corner case I forgot to comment earlier: When 32-bit sequence number reaches max value, authentication should be triggered to reset the value (similar to IPSEC where old SA is deleted and new one is established to reset sequence number).

-Tiru

> 
> Cheers
> 
> Dacheng
> > -Tiru
> >
> > >
> > > > Cheers,
> > > > -Tiru
> > > >
> > > > > -----Original Message-----
> > > > > From: Dacheng Zhang [mailto:[e-mail]]
> > > > > Sent: Monday, July 21, 2014 8:35 PM
> > > > > To: [e-mail]
> > > > > Subject: [pcp] I-D Action: draft-ietf-pcp-authentication-04.txt
> > > > >
> > > > > Hi, in this version of the document, we try to address the
> > > > > comments got since the last meeting.  Particularly, we:
> > > > >    o  Refine the retransmission policies.
> > > > >
> > > > >    o  Provide the discussion about how to instruct a PCP client to
> > > > >       choose proper credential during authenticaiton, and an ID
> > > > >       Indication Option is defined for that purpose.
> > > > > In addition, it is advised that we should remove the key ID from
> > > > > the PCP authentication message, and only use one key for a PCP
> session.
> > > > > However, this indicates we will use the MSK to generate MACs for
> > > > > PCP
> > > > message directly.
> > > > > We would like to check with the group again before including it
> > > > > into the document.
> > > > >
> > > > > Any comments and suggestions are appreciated.
> > > > >
> > > > > Cheers
> > > > >
> > > > > Dacheng
> > > > >
> > > > >
> > > > > >
> > > > > > A New Internet-Draft is available from the on-line
> > > > > > Internet-Drafts
> > > > > directories.
> > > > > > This draft is a work item of the Port Control Protocol Working
> > > > > > Group of the
> > > > > IETF.
> > > > > >
> > > > > >        Title           : Port Control Protocol (PCP) Authentication
> > > > Mechanism
> > > > > >        Authors         : Margaret Wasserman
> > > > > >                          Sam Hartman
> > > > > >                          Dacheng Zhang
> > > > > > 	Filename        : draft-ietf-pcp-authentication-04.txt
> > > > > > 	Pages           : 24
> > > > > > 	Date            : 2014-07-21
> > > > > >
> > > > > > Abstract:
> > > > > >   An IPv4 or IPv6 host can use the Port Control Protocol (PCP) to
> > > > > >   flexibly manage the IP address and port mapping information on
> > > > > >   Network Address Translators (NATs) or firewalls, to facilitate
> > > > > >   communications with remote hosts.  However, the un-controlled
> > > > > >   generation or deletion of IP address mappings on such
> > > > > > network
> > > devices
> > > > > >   may cause security risks and should be avoided.  In some cases the
> > > > > >   client may need to prove that it is authorized to modify, create or
> > > > > >   delete PCP mappings.  This document proposes an in-band
> > > > > >   authentication mechanism for PCP that can be used in those cases.
> > > > > >   The Extensible Authentication Protocol (EAP) is used to perform
> > > > > >   authentication between PCP devices.
> > > > > >
> > > > > >
> > > > > > The IETF datatracker status page for this draft is:
> > > > > > https://datatracker.ietf.org/doc/draft-ietf-pcp-authentication
> > > > > > /
> > > > > >
> > > > > > There's also a htmlized version available at:
> > > > > > http://tools.ietf.org/html/draft-ietf-pcp-authentication-04
> > > > > >
> > > > > > A diff from the previous version is available at:
> > > > > > http://www.ietf.org/rfcdiff?url2=draft-ietf-pcp-authentication
> > > > > > -0
> > > > > > 4
> > > > > >
> > > > > >
> > > > > > Please note that it may take a couple of minutes from the time
> > > > > > of submission until the htmlized version and diff are
> > > > > > available at
> > > tools.ietf.org.
> > > > > >
> > > > > > Internet-Drafts are also available by anonymous FTP at:
> > > > > > ftp://ftp.ietf.org/internet-drafts/
> > > > > >
> > > > > > _______________________________________________
> > > > > > pcp mailing list
> > > > > > [e-mail]
> > > > > > https://www.ietf.org/mailman/listinfo/pcp
> > > > > >
> > > > >
> > > >
> > > > _______________________________________________
> > > > pcp mailing list
> > > > [e-mail]
> > > > https://www.ietf.org/mailman/listinfo/pcp