Subject: [ANCP] Few questions and suggestions on draft-moustafa-ancp-security-threats-00.txt

From: "bharat_joshi" <[email-masked]>
Date: Mon, 27 Nov 2006 22:08:24 +0530

Hi,

    I have few questions and suggestions on this document:

* In abstract, it is mentioned that ANCP is used for "qos-, service- and
subscriber-related operations between NAS and AN". I think it should say
'xxx-related configurations; instead of 'xxx-related operations'.

* In abstract, the first statement in the second paragraph is a little
complex. You may want rephrase it something similar to:

This document investigates security threats that all network elements
running ANCP could encounter. This document develops a threat model for
ANCP security aiming to decide which security functions are required.

* In Introduction, second paragraph, first sentence, I think it would be
good it we can add "for ANCP" at the end to make it "[ID...] illustrates
the framework, usage scenarios and general requirements for ANCP"

* In Introduction, second paragraph, Second sentence is not very clear.
Its mentioned that document derives security requirements from ANCP.
Should not it be "for ANCP" instead of "from ANCP" here?

* In Introduction, "Message Protection", there is something missing in
statement:

"This applies both to ANCP payloads, and ANCP should also provide such
protection as a service to the different service parameters between the
two peers."

What is "both" referring to? I think you may want to add ANCP header and
payload.

* In some ANCP document, it is proposed that ANCP session would be
initiated by AN and so the NAS address need to be configured in there.
In this case, how NAS will authenticate or authorize an AN?

* In figure #1, I think you may want to show a ATM/Ethernet Switch
between NAS and AN as there could be multiple ANs connected to one NAS
through this switch.

* Does the Home Gateway shown in figure #1 is at correct place? Should
not it be before CPE? Something like HGW --- CPE --- Access Node?

* In the definition of 'Home Gateway', I did not get the 'DSL Network
Termination' part? Can you explain a little more?

* In section 4, typo "Attackers against the access network" -> " Attacks
against the access network".

* In section 5.3, Third paragraph, first sentence " When the ANCP allows
the AN to dynamically discovery the NAS". I did not find any such
reference in the ANCP framework document.

* Typo "When the ANCP allows the AN to dynamically discovery the NAS
then a", "discovery" -> "discover"

* I think it might be good if we can add details on how a particular
threat can be achieved and what is the solution to avoid a particular
threeat?

* How does AN ensure that a request has been received by the correct
NAS?

* In section 5.4, there is a list of information which a adversary can
get if it can access the traffic and analyze it. I think this is
possible only when the adversary has access to the network between AN
and NAS. Right?

* In section 6.1, how a passive attacker can use the information of
'access loop configuration' for any access? Learning this information
may not be proper but how it is a security threat?

* In section 6.1, I think off-path attack will always be there even if
ANCP does not exist. I am not sure if this is required.

* In section 6.1, you may want to use 'lists' to talk about the attacks.
For example:

Those attacks may be:

o Passive attacks
     o First passive attack
     o Second passive attack
o Active attacks
     o First active attack
     o Second active attack

    I am sure this way it will be more readable.

* Are you sure that replaying of Config requests can be done by an
attacker over TCP connections? I understand that after sniffing syn/ack,
it can generate a possible message but can I replay the old config
request which TCP itself would discard?

* In section 6.4, how do we damage proxy functionality in AN? BTW, is AN
doing IGMP snooping or IGMP proxy?

* In section 6.4, more descriptive format of security consideration for
Multicast can be added.

* What triggers the requirement "The protocol solution SHOULD
distinguish the control messages from the data"?

* I think you should add details of specific cases on how a threat can
be realized and what ANCP should do to avoid it?

Thanks & Regards,
Bharat

**************** CAUTION - Disclaimer *****************
This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system.
***INFOSYS******** End of Disclaimer ********INFOSYS***

_______________________________________________
ANCP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ancp