Subject: [issue9] Message format

From: <[email-masked]>
Date: Mon, 23 Jun 2003 18:26:19 +0300

Dan Forsberg <[email-masked]> added the comment:

New version (e).
Changes:
 - PANA-Auth-Answer abbr to PAN (was PAA).
 - PANA-Result-Request MUST always have an EAP payload AVP.
 - Removed Result-Code AVP from PANA-Auth-Answer.
 - Removed EAP-Payload from PANA-Reauth-*
 - Removed Add/Remove-Device-Id for now (see issue16).
 - Added more text for the session id AVP.
 - Result-Code AVP values <TBD>.
 - Termination-Cause AVP values <TBD>.
 - PANA-Result-Request --> PANA-Bind-Request
   PANA-Result-Answer  --> PANA-Bind-Answer
 - Editorial fixes.

_______________________________________________
PANA Issues <[email-masked]>
http://danforsberg.info:8080/pana-issues/issue9
_______________________________________________

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 23 Jun 2003 14:31:49 -0700

> 
> On Mon, Jun 23, 2003 at 12:40:18PM -0700, Mohan Parthasarathy wrote:
> > 
> >  
> > > 
> > > On Mon, Jun 23, 2003 at 11:14:03AM -0700, Mohan 
> Parthasarathy wrote:
> > > > > > When L2 ciphering is already used in the network, 
> what kind of 
> > > > > > protection is gained by also enabling IPsec between the
> > > PaC and EP
> > > > > > (other than potentially solving IP address 
> ownership issues)?
> > > > > 
> > > > > Insider attacker (meaning that he has L2 ciphering keys) can 
> > > > > spoof other insider's higher-layer fields in data packets 
> > > > > (though he cannot spoof L2 headers).  I think SEND 
> only protects 
> > > > > ND messages, not data packets.  For the same reason,
> > > > 
> > > > Right. Ipsec will prevent someone spoofing at layer 3. But
> > > what does
> > > > it buy for the attacker ? Here the attacker is the one 
> who is also
> > > > using L2 cipher. What is the motivation for the attacker to 
> > > spoof the
> > > > L3 fields ? He can potentially launch some attack with 
> spoofed L3
> > > > fileds. What else ?
> > > 
> > > He can also spoof L4 and higher-layer fields of a legitimate
> > > client's traffic in addition to L3 fields.  Note that a 
> > 
> > If the PaC needs to protect against that, why would it not use some 
> > other end-to-end mechanism rather than resorting to 
> securing just the 
> > first hop with IPsec ?
> 
> You are right.  On the other hand, I just answered to your 
> question on what fields an attacker on the first hop can 
> spoof when there is no first hop IPsec.

Ok. The original argument (I may have mistaken) was about whether
L2 and Ipsec will be used together. Even though there might
be spoofing without Ipsec, the PaC/application needs other
way to protect traffic end2end and hence using Ipsec just
on the first hop when L2 ciphering is in use may not be
that common.

-mohan

> 
> Yoshihiro Ohba
> 
> > 
> > > legitimate client with using IPsec in the access network (or
> > > VPN or end-to-end ) can also spoof its own higher-layer 
> > > traffic, but that is completely out of the scope of network 
> > > access security and should be protected by using
> > > transport- and/or application-layer security.
> > > 
> > > Yoshihiro Ohba
> > > 
> > mohan
> > 
>