Subject: [Pana] issue119: resolution

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 06 Dec 2004 15:27:08 -0500

In section 4.1 of pana-pana-07a,

Change:

"
   o  Cookie AVP: contains a random value that is used for making PAA
      discovery robust against blind resource consumption DoS attacks.
"

"
      Cookie AVP: contains a random value that is generated by a PAA
      and used for making PAA discovery robust against blind resource
      consumption DoS attacks.
"

In section 4.2 of pana-pana-07a change:

"
   A PANA-Start-Request message MAY carry a Cookie AVP that contains a
   cookie.  The cookie is used for preventing the PAA from resource
   consumption DoS attacks by blind attackers which bombard the PAA with
   PANA-PAA-Discover messages.  By relying on a cookie mechanism the PAA
   can avoid per-PaC state creation until after the PaC can produce the
   same cookie in its PANA-Start-Answer message.  In order to do that,
   the cookie MUST be computed in such a way that it does not require
   any per-session state maintenance on the PAA in order to verify the
   cookie returned in a PANA-Start-Answer message.  The PAA discovery
   that takes advantage of cookies is called "stateless PAA discovery".
   The exact algorithms and syntax used for generating cookies does not
   affect interoperability and hence is not specified here.  An example
   algorithm is described below.
"

to:

"
   A PANA-Start-Request message MAY carry a Cookie AVP that contains a
   random value generated by the PAA.  The random value is referred to
   as a cookie.  The cookie is used for preventing the PAA from
   resource consumption DoS attacks by blind attackers which bombard
   the PAA with PANA-PAA-Discover messages.  By relying on a cookie
   mechanism the PAA can avoid per-PaC state creation until after the
   PaC can produce the same cookie in its PANA-Start-Answer message.
   In order to do that, the cookie MUST be computed in such a way that
   it does not require any per-session state maintenance on the PAA in
   order to verify the cookie returned in a PANA-Start-Answer message.
   The PAA discovery that takes advantage of cookies is called
   "stateless PAA discovery".  The exact algorithms and syntax used by
   the PAA to generate cookies does not affect interoperability and
   hence is not specified here.  An example algorithm is described
   below.
"

Change:

"
8.3.4  Cookie AVP

   The Cookie AVP (AVP Code 4) is used for carrying a cookie value
   generated by the PAA.  The AVP data is of type OctetString.  It is
   opaque and the exact content is outside the scope of this protocol.
"

to:

"
8.3.4  Cookie AVP

   The Cookie AVP (AVP Code 4) is used for carrying a random value
   generated by the PAA.  The AVP data is of type OctetString.  The
   random value is referred to as a cookie and used for making PAA
   discovery robust against blind resource consumption DoS attacks.
   The exact algorithms and syntax used by the PAA to generate a
   cookie does not affect interoperability and not specified in this
   document.  An example cookie generation algorithm is shown in
   section 4.2.
"

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 07 Dec 2004 11:50:03 -0800

Looks good to me.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of
> Yoshihiro Ohba
> Sent: Monday, December 06, 2004 12:27 PM
> To: [email-masked]
> Subject: [Pana] issue119: resolution
>