Re: [pcp] Comparison of PCP authentication

[Margaret Wasserman <[e-mail]>]

On Aug 6, 2012, at 5:19 PM, Dan Wing wrote:
> 
> Also, if an update to PANA allows 0b00000010 in that first octet, we will
> have a problem.  It would be safer if we assign the last two bits in that
> first octet of PANA to must-be-zero.  Perhaps via an Errata against the PANA
> spec, if we decide this is the best solution.

Good point Dan.  We will mention this in the updated draft (the one with the three choices), just so we don't lose track of it.

>>   But, the encapsulation
>> approach would allow us to gain some optimization by piggy-backing the
>> first (and possibly the final?) messages of the PANA exchange in the
>> original PCP request (and response?) to cut down on the number of
>> messages needed to create a secure mapping. 
> 
> How many messages are we talking about (5?), and how much reduction 
> could we see (reduction from 5 to 3??).

I think we are talking about ~7 messages, cut down to 5 or 6...  I realize that is a fairly small optimization, as a percentage, but security folks do go to fairly significant ends to cut out round trips, when possible, to make people less averse to adopting security solutions.  I don't know how many of those steps are lock-step... This is something I will try to look into and provide more information about for the interim meeting.  I'm hoping we'll have more time to go over the trade-offs in detail on a call than we did in the meeting (when we only had ~25 minutes).

Margaret