Re: [pcp] Comparison of PCP authentication

[Sam Hartman <[e-mail]>]

>>>>> "Dan" == Dan Wing <[e-mail]> writes:


    Dan> Doing PANA first is a good optimization only if the PCP client
    Dan> knows that PCP authentication will be required by the PCP
    Dan> server on that particular network.  If PCP authentication is
    Dan> not needed on a particular network, requesting PCP
    Dan> authentication incurs an extra round trip.

Thinking about this as an optimization seems wrong to me.

consider the case where the client wants authentication but the server
does not require it.  For example, the client wants integrity protection
of the result of the request.
In this case it's about security requirements *not* optimization.
The client needs a way to force the server to require authentication.

Another case where this becomes important is where a server will accept
requests from unauthenticated clients but treat them differently. For
example an authenticated client is allowed to ask for longer lifetimes,
etc.

Especially since interacting with firewalls is in-scope for PCP,
supporting clients with higher security requirements seems and important
design goal for a PCP authentication mechanism.

So, I don't think we should be thinking of this purely in terms of
optimization.