Re: [pcp] Posted auth req slide that was edited during meeting

[Sam Hartman <[e-mail]>]

>>>>>   <[e-mail]> writes:

    > Can we take silence as agreement about re-auth to happen before
    > the SA expires?  Yoshihiro Ohba
I'm sorry; I missed this message somehow (my fault) and noticed it
because you replied to it.

When we were last conversing, we agreed that the attacks we were trying
to prevent were a PCP client modifying mapping state after the SA has
expired.

However,  I don't see how those attacks are  possible with either option
3 or 4.

Option 3 provides protected signaling of a re-auth request.
At worst, option 3 is no more secure than option 2.

Option 4  provides  protected signaling about potential server updates
in an expired SA. However, the attacks we agreed are the ones of concern
cannot happen with option 4 , because the client cannot change PCP state
using an expired SA in that case.

My preference list of options is 4, 3, 2, 1, your modified option 1.
The reason I dislike your modified option is that it's not clear when a
client or server should offer re-authentication in that case, so I
believe that your proposal will lead to less interoperability than
option 1.

Prior to the meeting, I believe that we had ruled out option 1 and 4 and
had a consensus on the list that was ambiguous between option 2 and 3.
At the meeting Stuart asked to re-open option 4.
My assumption is that Stuart probably also considers option 4 most
preferred.

--Sam