Re: [pcp] EAP retransmits and re-authentication

[Yoshihiro Ohba <[e-mail]>]

Sam,

(2012/09/21 0:32), Sam Hartman wrote:
>>>>>> "Yoshihiro" == Yoshihiro Ohba <[e-mail]> writes:
> 
>      Yoshihiro> While I agree that ERP is definitely not needed for PCP,
>      Yoshihiro> but I think unsupporting EAP re-authentication in the
>      Yoshihiro> context of RFC 3748 and RFC 5247 is NOT a good idea,
>      Yoshihiro> because it enables smooth migration from old SA to new
>      Yoshihiro> SA.  Without supporting EAP re-authentication in the
>      Yoshihiro> context of RFC 3748 and RFC 5247, communications
>      Yoshihiro> disruptions can happen during rekey, i.e., communication
>      Yoshihiro> quality of PCP and data traffic controlled by PCP can
>      Yoshihiro> affect in our case.
> 
> I'd like to hear from PCP implementors about whether smoothe SA
> migration is even desirable.
> My assumption would be that it would be entirely not worth the
> complexity for PCP.

I have to say that this matters for users of PCP.  PCP implementors
have to implement what PCP users want.  As a user of PCP, I don't want
my established WebEx session for the interim meeting to get disrupted
by rekey ;)

> 
>      Yoshihiro> Also, it seems that there is some desire to change
>      Yoshihiro> PCP-specific authentication design to be based on
>      Yoshihiro> client-
> 
> Actually, I didn't propose a change; I simply pointed out that you can
> do it either way depending on what is easiest for PCP implementations;
> we should pick, but what we pick should be based on the needs of the PCP
> community.

I would rather consider this as the major disadvantage of tight
coupling EAP and PCP.  It is much easier to run PANA and PCP
side-by-side which achieves loose coupling of EAP and PCP.

> 
> It's my experience that security solutions are best when they provide a
> good user experience and are easy to implement. I'm hoping to accomplish
> that here.

Then EAP re-authentication needs to be supported.

Yoshihiro Ohba

> 
> --Sam
>