Re: [pcp] EAP retransmits and re-authentication

[Sam Hartman <[e-mail]>]

>>>>> "Yoshihiro" == Yoshihiro Ohba <[e-mail]> writes:

    Yoshihiro> While I agree that ERP is definitely not needed for PCP,
    Yoshihiro> but I think unsupporting EAP re-authentication in the
    Yoshihiro> context of RFC 3748 and RFC 5247 is NOT a good idea,
    Yoshihiro> because it enables smooth migration from old SA to new
    Yoshihiro> SA.  Without supporting EAP re-authentication in the
    Yoshihiro> context of RFC 3748 and RFC 5247, communications
    Yoshihiro> disruptions can happen during rekey, i.e., communication
    Yoshihiro> quality of PCP and data traffic controlled by PCP can
    Yoshihiro> affect in our case.

I'd like to hear from PCP implementors about whether smoothe SA
migration is even desirable.
My assumption would be that it would be entirely not worth the
complexity for PCP.

    Yoshihiro> Also, it seems that there is some desire to change
    Yoshihiro> PCP-specific authentication design to be based on
    Yoshihiro> client-

Actually, I didn't propose a change; I simply pointed out that you can
do it either way depending on what is easiest for PCP implementations;
we should pick, but what we pick should be based on the needs of the PCP
community.

It's my experience that security solutions are best when they provide a
good user experience and are easy to implement. I'm hoping to accomplish
that here.

--Sam