Re: [pcp] Implementation Analysis: strong preference for PCP-specific approach

[Alper Yegin <[e-mail]>]

Hi Margaret,

On Sep 19, 2012, at 1:11 PM, Margaret Wasserman wrote:

> 
> Hi Alper,
> 
> On Sep 17, 2012, at 5:24 AM, Alper Yegin wrote:
>> Yep, they are implementing "EAP lower layers". "EAP-over-UDP/PCP" is an EAP lower-layer and it'll have the same thing (once people realize it's more than defining a EAP container to qualify as a "working" and "compliant" EAP lower layer).
> 
> You have mentioned this several times, but you haven't provided any specifics.  What do you think is missing from the PCP-specific approach, as document, that would need to be added to make it a "working" and "compliant" EAP lower layer?  Is there an RFC that specifies the requirements that the PCP-Specific approach is failing to meet? 

The major missing piece is the support for EAP re-authentication. It's totally omitted.

Security considerations section is too light on content. Please see PANA's. We need to see a thorough analysis to conclude that the design is complete. For example, there's a mention of DoS resilience, but it's not sufficient. Please refer back to PANA to see how DoS resilience is achieved with EAP lower-layer.

Also, I don't see the message validity checks (again, see PANA). It's not possible to get a standard state machine w/o that (either in a dedicated section like in RFC 5191, or captured in a distributed way in the document).

Alper