Subject: [Pana] PANA and PaC-generated cookie AVP

From: "Susan Thomson \(sethomso\)" <[email-masked]>
Date: Fri, 24 Jun 2005 16:04:54 -0400

In the "solicited PANA-Start-Request" mode of operation, PANA supports a
PAA-generated cookie AVP to protect against blind attackers acting as
legitimate PaCs. It seems that, in the "unsolicited PANA-Start-Request"
mode of operation (no discovery), the protocol should also support a
cookie AVP that can be generated by the client so that the PaC can
protect itself from blind attackers acting as PAAs. 
 
Client behavior would be similar to PAA usage of cookie AVP, but a
PaC-generated cookie AVP would be carried in PANA-Start-Answer and first
PANA-Auth-request messages.
 
The behavior would be something like the following:
1. If NAD is responding to a client-initiated Discovery, then PAA would
send a cookie AVP in PANA-Start-Request message and only store state
when PaC responds. 
2. If NAD initiates PANA-Start-Request message without a client-initated
Discovery, then the client responds with a Cookie-AVP in the
PANA-Start-Answer message and only stores state when NAD sends the first
PANA-Auth-Request message.
 
So only one peer is sending a cookie avp depending on the mode of
operation. The presence or absence of the cookie AVP in the
PANA-Start-Request tells the client what mode  the PAA is operating in
(the text in the PANA spec says this, although the figure indicates that
a cookie avp is sent from PAA regardless). 
 
Comments?
 
Thanks
Susan
_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 24 Jun 2005 17:37:44 -0400

This was discussed in issue 55 and rejected.  Your proposal might be a
bit different from the previous discussion in that either PAA or PaC
is the generator of a cookie in your proposal, but the same in that
the PaC does not need to communicate with multiple PAAs in parallel.
For this reason, effectiveness of having a client cookie is still not
clear to me.

http://danforsberg.info:8080/pana-issues/issue55

Yoshihiro Ohba