Subject: RE: Security threat (was: RE: [issue9] Message format)

From: <[email-masked]>
Date: Tue, 24 Jun 2003 13:26:00 +0300

Hi Alper,

PANA kind of bootstraps with the help of EAP the initial SA between the client and the access network. This makes PANA a natural protocol to (securely) carry the IP addresses to the access network. Additionally the MAC address can be sent too. Why not to use two Device-Id AVPs, one for MAC (if needed) and one for IP address? 

- Dan

> -----Original Message-----
> From: ext Alper Yegin [mailto:[email-masked]]
> Sent: 23 June, 2003 21:38
> To: Forsberg Dan (NRC/Helsinki); [email-masked]
> Subject: Re: Security threat (was: RE: [issue9] Message format)
> 
> 
> Hi Dan,
> 
> > What if the authenticated PaC itself becomes malicious? It 
> can blindly
> > spoof other PaCs addresses. This is a security threat, even 
> if the MAC
> > address is bound to accounting.
> 
> I agreed :) I'm not disagreeing with the security threat here. I'm
> disagreeing with the assumption that this is a problem that 
> *must* be solved
> by PANA. Let's first agree (or disagree :) on that. Note that 
> this does not
> mean PANA *must not* solve it. PANA may solve it, or PANA may 
> assist another
> protocol solve it, etc... But we need to thoroughly 
> understand the problem,
> and its relation to existing/upcoming solution space.
> 
> > 
> >> 
> >>> 
> >>> That would mean that PaC can freely spoof IP addresses.
> >> 
> >> Exactly. But, this is a SEND problem, not PANA problem.
> > 
> > This problem goes beyond SEND and even IPSec. SEND is for discovery
> > only, not for protecting data packets like IPSec.
> 
> I agree this is beyond SEND, according to SEND's current 
> scope. But it is
> the closest to what SEND is aiming: proving ownership of IP 
> address for
> address resolution. It's only reasonable to assume that the 
> next step could
> be proving ownership of IP address for sending IP packets.
> 
> > On the other 
> > hand IPSec is used for protecting malicious users from stealing
> > other's connections on the access link, right? Or should we say
> > that IPSec is used for making sure that only "paying" customers
> > can send packets.
> > 
> > The access network doesn't want the PaCs to be able to spoof
> > network nodes that are inside the access network (behind the
> > first AR). What the EP wants to do is to make sure that the
> > packet coming from PaCs has an IP address that belongs to the
> > correct subnet prefix (access link prefix). By default the
> > policy in the EP (in most cases) is to deny all IP addresses
> > if not authenticated AND authorized properly.
> > 
> > The problem is authorization of data packets that pass through
> > the EP. IPSec takes care of authentication (SEND doesn't do
> > neither).
> > 
> > With IPSec tunnel between PaC and PAA, the inner IP address
> > MUST be checked too! Otherwise authenticated and authorized
> > PaCs can spoof IP addresses.
> 
> PANA deals with authorizing a Pac to send and receive 
> packets. That's all.
> PANA does not deal with any other authorization.
> 
> That does not mean that these are all the problems that needs 
> to be solved
> to make an access network 100% secure.
> 
> 
> Alper
> 
>