Subject: [Pana] Issue122: Replay attack protection clarification

From: Alper Yegin <[email-masked]>
Date: Wed, 01 Dec 2004 12:18:38 -0800

http://danforsberg.info:8080/pana-issues/issue122

Proposed change is to replace the following paragraph in 11.1:

   PANA messages carry sequence numbers, which are monotonically
   incremented by 1 with every new request message.  These numbers are
   randomly initialized at the beginning of the session, and verified
   against expected numbers upon receipt.  A message whose sequence
   number is different than the expected one is silently discarded.  In
   addition to accomplishing orderly delivery of EAP messages and
   duplicate elimination, this scheme also helps prevent an adversary
   spoof messages to disturb ongoing PANA and EAP sessions unless it can
   also eavesdrop to synchronize on the expected sequence number.

With this one:

   PANA messages carry sequence numbers, which are monotonically
   incremented by 1 with every new request message.  These numbers are
   randomly initialized at the beginning of the session, and verified
   against expected numbers upon receipt.  A message whose sequence
   number is different than the expected one is silently discarded.  In
   addition to accomplishing orderly delivery of EAP messages and
   duplicate elimination, this scheme also helps prevent an adversary
   spoof messages to disturb ongoing PANA and EAP sessions unless it can
   also eavesdrop to synchronize on the expected sequence number. 
   Furthermore, impact of replay attacks are reduced as any stale
message
   (i.e., a request or answer with an unexpected sequence number) and
any 
   duplicate answer are immediately discarded, and a duplicate
   request can trigger transmission of the cached answer (i.e., no need
to
   process the request and generate a new answer).

 Comments welcome.

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana