Re: [pcp] Comparison of PCP authentication

[Margaret Wasserman <[e-mail]>]

On Aug 8, 2012, at 1:02 PM, Dan Wing wrote:
> So, I think we are okay -- assuming we keep the idea that the PCP 
> client tries to first send a PCP request (and not to first send
> a PANA request).  

Actually, we don't keep this, even now.  There is certainly a notion that a client could be configured to use authentication for all (or some) PCP exchanges, and that the authentication would come first.  

> However, I do worry that implementations may optimize themselves
> to send a PANA request first, which would cause the problem you
> describe if they send the PANA request to a NAT-PMP server.  That
> is, this would be a problem:
> 
>  PCP client                           NAT-PMP server
>      |                                    |    
> 1.    |-------(authentication message)---->|
> 2.    |<--NAT-PMP error--------------------|
>      |                                    | 
> 
> But the PCP client doesn't speak NAT-PMP, so there isn't a way
> for it to handle that case, anyway (no matter if we had PCP
> authentication or not).
> 
> In summary, I think we can skate around problems with talking
> to a NAT-PMP server.

Makes sense.

Margaret