[pcp] Architectural questions (was Re: Agenda question about Wednesday's meeting)

[Alper Yegin <[e-mail]>]

Hi Sam,

> However, we didn't get around to discussing the broader architectural
> questions like:
> 

Let's get these rolling….


> 1) Does PCP need re-authentication
> 

Authentication is for authorization, and it comes with finite lifetime.
The authorized service (e.g., "port mapping", "firewall rule") is good within the authorized lifetime of the service.
Before the lifetime exceeds, authorization either needs to be "extended" via re-authentication, or left to expire and disappear.

We need to support re-authentication for PCP.

> 2) Do we want authentication to be server or client initiated in PCP?
> 

EAP (RFC 3748) by its design is server initiated and driven (requests always come from the server side).
"EAP" can be triggered externally (e.g., by the mean of "EAP lower layer") from client side.

Having provided these background info, what's the significance of this question?

Alper
 



> ETc.