Subject: [pcp] pcp-base: Mapping Nonce

From: "Dan Wing" <[email-masked]>
Date: Thu, 3 May 2012 16:37:31 -0700

Working group,

During IESG evaluation of draft-ietf-pcp-base (*) we received several
DISCUSSes that PCP needs a "transaction id" for two reasons:  security and
to simplify the protocol design.  After several face to face meetings at
IETF83 in Paris, we believe we resolved most of the concerns around needing
transaction-id to ease protocol design and that adding a transaction id
would make some aspects of the protocol more difficult.  That left us with a
"transaction id" for reasons of security.  The specific concern is around
Mapping Update.  Mapping Update is where a PCP server sends updated
information to the PCP client about a mapping.  For example, if a PCP server
is running on a home NAT and the ISP renumbers the subscriber, a Mapping
Update can be sent to immediately inform the PCP client that the mapping has
changed.  An attacker, able to spoof the PCP server's IP address, could
cause PCP clients to think a mapping had changed and cause traffic to flow
through a host operated by the attacker.

To prevent this attack, at the IETF83 PCP meeting, Margaret Wasserman
proposed adding a "mapping nonce".  The client would chose this value and
include it in MAP and PEER requests, and the PCP server would include this
same mapping none value in all responses it sends -- both the first response
it sends and all Mapping Update responses it sends (if any).  A mapping
nonce does not appear to complicate PCP as much as a (typical)
transaction-id, so this seems a win from both a security perspective and
protocol design perspective.

If there are questions or concerns about this change, please say so.  I hope
to finish editing in the next several days to add the Mapping Nonce and
resolve some other IESG DISCUSS and COMMENTS.
 
(*) https://datatracker.ietf.org/doc/draft-ietf-pcp-base/ballot/

-d