Re: [pcp] WG status on PCP authentication

[Yoshihiro Ohba <[e-mail]>]

(2012/09/14 23:26), Sam Hartman wrote:
> 
>      Yoshihiro> Hi Dacheng, A good question.  Actually both approaches
>      Yoshihiro> has some impact on RFC 5191 to allow PANA to run over a
>      Yoshihiro> non-PANA port (which would require updating RFC 5191).
>      Yoshihiro> This made me think that the need for updating RFC 5191 to
>      Yoshihiro> use the Reserved field in the demultiplexing approach is
>      Yoshihiro> not considered as a cons.
> 
> 
> Hi.
> I have two questions about your comparison:
> 
> 1) How the encapsulation approach requires tight coupling

As I mentioned in my comparison, I see the following two issues:

"One issue is that some workaround is needed to carry a PCI
(PANA-Client-Initiation) message which does not fit PCP's
request-response type messaging.  Another issue is that double
integrity protection
can happen after establishing a PCP SA, where a PANA message carried
in the PCP message is protected by a PANA AUTH AVP and the PCP message
itself is protected by a PCP Authentication Tag.  Double integrity
protection can be considered as overhead."

To add more to the 2nd issue, tight coupling of PCP and PANA would be
 needed to avoid double integrity protection (e.g., omitting AUTH AVP
when there is a PCP Authentication Tag, etc...)

> 
> 2) Why tight coupling is a bad thing given that we've ruled relays out
> of scope.

As far as I understand, we ruled out relays to deal with EAP channel
binding without need to tightly couple PCP and PANA (such as carrying
PCP-specific information in a PANA message).  Tight coupling is better
to avoid, IMO.

Yoshihiro Ohba




> 
> --Sam
>