Subject: RE: Device ID and MitM attacks

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 6 Nov 2002 20:50:23 +0100

> Some thoughts on device ID and man-in-the-middle attacks. 
> 
> In the requirements draft, we had stated that device id (DI) 
> must be integrity protected against MitM attacks (req 4.1.1). 
> 
> When PANA is used in networks where underlying layers are 
> secured (see sections 4.1, 4.2 of usage scenarios draft), 
> protection of DI should not be an issue. Assumption is that 
> there cannot be a MitM on the link to alter DI information. 
> 
If the device identifier is the IP address, layer 2 security 
does not help. I can still send packets with somebody else's 
IP address but pass the layer 2 authentication.  
 
=> I think the assumption is that the DI will be tied 
to the L2 security credential
 
Hesham

-mohan 

> But, when there is no lower layer security at all (see 
> section 4.3 of usage scenarios draft), it seems like we have 
> to make sure DI is integrity protected. But, having the right 
> DI should not be sufficient for a client to gain access once 
> it's authenticated. 
> Since these are unprotected links, nothing prevents an 
> attacker from spoofing DI of an already authenticated client 
> for gaining network 
> access. A complete solution would require this DI to be used with 
> per-packet authentication, e.g., by using IPsec. So, being able to 
> alter the DI information during PANA exchanges would not help 
> an attacker. 
> 
> As long as per-packet authentication is based on a security 
> association that was bootstraped using a shared secret that 
> was a by-product of the EAP authentication method, that should work. 
> 
> Comments? 
> 
> alper 
> 
> 
> 
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 6 Nov 2002 15:36:38 -0500

> to the L2 security credential

I have one question.  If we consider a DSL scenario in which the
customer's network beyond the DSL modem uses insecure link layer
(i.e., legacy 802.11 with static WEP or no WEP) and the PaC is on the
insecure link layer, do we need DI protection for PANA or not?  I mean
that DSL link is physically secured but the entire access network may
not be secured.

Yoshihiro Ohba

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Wed, 6 Nov 2002 12:56:11 -0800

> that DSL link is physically secured but the entire access network may

We are looking at two separate legs of secure access here.
1- wireless client's access to LAN
2- wireless client's access to Internet via ISP.

They should be handled separately. [1] is the responsibility
of the customer. If she opens up her network to outsiders, there is
not much the ISP can do, or control.

alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 6 Nov 2002 16:42:38 -0500

> not much the ISP can do, or control.

In some case, it may not be handled separately.  For example, if the
DSL provider provides hot-spot wireless access service by using their
DSL links available at the hot-spot, with legacy 802.11 APs (also
owned by the DSL provider) connected to the DSL links.  In this case,
the DSL provider may want to force DI protection to their clients.

So I tend to agree with Hesham on that my question is a deployment 
question to operators.

Yoshihiro Ohba