Subject: RE: Device ID and MitM attacks

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 6 Nov 2002 21:37:31 +0100

> > => If IPsec is used then all communication will be done 
  > > via the EP. On a shared link this will be problematic when
  > > nodes are communicating directly to each other. You would need
  > > all nodes to put filters that will only accept packets from 
  > > EPs that they have SAs with. 
  > 
  > Yes.
  > 
  > > So I think this will work only 
  > > for packets whose destination is outside the link. 
  > 
  > No, even for on-link destinations, client would have to send
  > packets through EP. Otherwise, local traffic bypasses
  > enforcement procedures.

=> I said that to roule out the assumption of the last sentence
in the earlier paragraph: "You would need
all nodes to put filters that will only accept packets from 
EPs that they have SAs with. " This would mean that PANA
is ruling out multiaccess links. Are we sure we can/want
to mandate that? To me, this seems infeasible to mandate.

Hesham

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Wed, 6 Nov 2002 18:33:28 -0800

> to mandate that? To me, this seems infeasible to mandate.

OK, I see... I was talking about one possible (simplest?)
scenario. In the context of using IPsec for per-packet
authentication, one can think of using some public key
crypto, or id based crypto to enable peer2peer authentication.
I'm not sure about the details though. PANA can be used to 
bootstrap the required parameters for the clients.

alper