[pcp] issue#60: Loosely coupled vs. tightly coupled authentication

[Alper Yegin <[e-mail]>]

Let me summarize my thoughts on each of these outstanding issues….


First of all, the issue description has lot of problems. See further below for more specifics… 
Nevertheless, here's what I can say about the essence of this discussion:

- EAP session lifetime, EAP session keys lifetime, hence PCP SA (security association) lifetime are all driven by the AAA server.
- The state created by the execution of PCP (i.e., NAT mappings, firewall rules) may have a lifetime different than the PCP SA lifetime. Such state's lifetime may be initially set to PCP SA lifetime (and may be not). Their lifetime may be extended or cut-down by actors other than PCP, without any coordination with the PCP SA lifetime. These are all scenario specific. I think all we can really say is, anything is possible. 




Coming back to the flaws in the issue description:

Loosely coupled: 
– Authentication needed only at the time of a request, to create/modify a mapping. 

Alper> Authentication of the end-point (the ID that gets authenticated via EAP) is what this text must be referring to.
Alper> There's also the "origin authentication for PCP packets (+ integrity and replay protection). 
Alper> Gotta be specific about which authentication we are talking about.
Alper> Since PCP server can be sending unsolicited messages updating the PCP client, that also needs to be taken into account.

– Authorization done separately, using the same mechanism as in non-authenticated PCP 

• Mappings are removed when authorization is revoked 

Alper> I have no idea what these two lines really mean. 

– Mapping lifetime is not tied to authentication lifetime

Alper> Good, this makes sense as the definition of "loosely coupled". 

Tightly coupled: 

– Authentication and authorization are performed using the same mechanism, or there is a link between them 

Alper> There's always. There's a corner case where AAA server authenticates the user, and the PCP server has a database mapping user IDs to authorization parameters. That way you can say AAA authenticates the user, PCP server authorizes the user. But that's such a corner case. Typically, user IDs (with credentials to authenticate) and the mapping to authorization parameters are maintained by the AAA server (remember the second A in that acronym).


– Mapping lifetime is tied to authentication lifetime

• Mappings are removed when keys expire OR authorization is revoke

Alper