Subject: Re: [pcp] Official reviewers Request for Learn NAT64 PREFIX64s using PCP

From: Iljitsch van Beijnum <[email-masked]>
Date: Sat, 18 May 2013 09:29:01 +0200

> > In the security considerations, I would expect a discussion about what happens
> > when a malicious third party impersonates a PCP server and provides a fake
> > Pref64.

> This is not a problem when ICE is used. If during ICE connectivity checks, STUN request is sent to attacker. The attacker cannot send a valid
> STUN response because it will not be aware the password using for STUN message integrity. Further RTCWEB (use case mentioned in 3.1) recommends SRTP, so DTLS will also fail. 

But what about other protocols? Especially DNSSEC.

Iljitsch

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Sat, 18 May 2013 07:35:16 +0000

> -----Original Message-----
> From: Iljitsch van Beijnum [mailto:[email-masked]]
> Sent: Saturday, May 18, 2013 12:59 PM
> To: Tirumaleswar Reddy (tireddy)
> Cc: [email-masked]
> Subject: Re: [pcp] Official reviewers Request for Learn NAT64 PREFIX64s using
> PCP
> 
> 
> > This is not a problem when ICE is used. If during ICE connectivity checks,
> STUN request is sent to attacker. The attacker cannot send a valid
> > STUN response because it will not be aware the password using for STUN
> message integrity. Further RTCWEB (use case mentioned in 3.1) recommends SRTP,
> so DTLS will also fail.
> 

PCP client and server can be mutually authenticated using PCP authentication.  This avoids the problem of attacker posing as PCP server.
This way PCP client will not learn Pref64 from attacker.

--Tiru.