Re: [pcp] Posted auth req slide that was edited during meeting

Here is my suggested change on REQ-5 of draft-reddy-pcp-auth-req-01.

(Current)

   REQ-5:  PCP allows a server to send multiple responses.  If the
      server wants to send an unsolicited message, but the previous
      security association has expired, the server MUST be able to
      trigger re-authentication with the client.
"

(New)

"
   REQ-5:  PCP allows a server to send multiple responses.  If the
      server wants to send an unsolicited message, but the previous
      security association is going to expire, the server MUST be able to
      trigger re-authentication with the client prior to expiration of the security association.
"

Best Regards,
Yoshihiro Ohba

-----Original Message-----
From: pcp-bounces@ietf.org [mailto:pcp-bounces@ietf.org] On Behalf Of yoshihiro.ohba@toshiba.co.jp
Sent: Friday, March 22, 2013 1:42 AM
To: pcp@ietf.org
Subject: Re: [pcp] Posted auth req slide that was edited during meeting

Can we take silence as agreement about re-auth to happen before the SA expires?

Yoshihiro Ohba

-----Original Message-----
From: pcp-bounces@ietf.org [mailto:pcp-bounces@ietf.org] On Behalf Of yoshihiro.ohba@toshiba.co.jp
Sent: Monday, March 18, 2013 11:12 PM
To: hartmans@painless-security.com
Cc: pcp@ietf.org
Subject: Re: [pcp] Posted auth req slide that was edited during meeting

Sam,

-----Original Message-----
From: Sam Hartman [mailto:hartmans@painless-security.com] 
Sent: Monday, March 18, 2013 11:00 PM
To: ohba yoshihiro
Cc: alper.yegin@yegin.org; pcp@ietf.org
Subject: Re: [pcp] Posted auth req slide that was edited during meeting

>>>>>   <yoshihiro.ohba@toshiba.co.jp> writes:

    > In any case, we should follow the definition of EAP
    > re-authentication in RFC 5247 about re-authentication timing.  I
    > see absolutely no reason to change the definition.

OK. So you're saying that the goal of the security association expiration is to make sure that a client cannot change the PCP state in a manner that requires authentication outside a time window defined by the AAA infrastructure/PCP server?

[YO] Yes.

So, the sorts of attacks we'd want to prevent are people changing state after credentials have changed or authorizations have changed?

[YO] Yes, unless the credentials or authorizations are changed via a valid re-authentication, that is the whole purpose of re-authentication.

Yoshihiro Ohba

--Sam

_______________________________________________
pcp mailing list
pcp@ietf.org
https://www.ietf.org/mailman/listinfo/pcp

_______________________________________________
pcp mailing list
pcp@ietf.org
https://www.ietf.org/mailman/listinfo/pcp