Subject: RE: PANA threat evaluation draft.

From: <[email-masked]>
Date: Tue, 22 Oct 2002 17:17:16 -0500

>>   Requirement 9: 
>> 
>> What is a valid IP address? 
>> 
>I should have said just "IP address". If PANA assumes that client should 
>have an IP address before PANA begins, assuming DHCP as one of the 
>common ways of acquiring IP address, it does open up to DHCP address 
>depletion attack. 
 
The requirement for PANA is that the PaC have an IP address before any
request messages can be initiated. In the case of IPv4, DHCP is one
way of acquiring an address. But the lease period of the DHCP address
assigned could be quite limited is'nt it? And subject to succesful
authentication. 
With IPv6 this is not necessarily an issue when address autoconfig is used.
 
-Basavaraj
>thanks 
>-mohan 
>> BR, 
>> - Dan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 23 Oct 2002 09:30:50 -0700

> 
> > > Section 7.5:
> > > 
> > >   "-- EP may need to add filters at the beginning (as soon as
> > > the address 
> > >    is assigned) to prevent unauthorized access. --"
> > > 
> > > To my understanding the default functionality in EPs are that
> > > they deny all access. Thus, this doesn't make sense.
> > > 
> > If PaC has acquired an IP address before authentication, 
> what prevents 
> > it from sending packets before authenticating itself to the 
> network. 
> > How does the EP prevent the access for this client ? For example, 
> > there is a good client with IP address 10.0.0.1 which authenticates 
> > itself to the network. The next client gets the IP address 10.0.0.2 
> > and now before authenticating itself to the network, starts sending 
> > packets with IP address 10.0.0.2. How does EP deny access to this 
> > client ? If the network does not give an IP address before 
> > authentication, may be this problem does not happen. 
> (Spoofing the IP 
> > address of the other client and gaining access is separately 
> > mentioned).
> 
> I don't understand something: I don't see why if you give an 
> IP address to the PaC then you can't prevent him to access 
> the network..If it is not possible so it should be better to 
> not attribue IP address before authentication....
> 
> For example, you configure your EP to deny access to all IP 
> address, so you give IP address 10.0.0.1 to your PaC to begin 
> authentication process. When it is correctly authenticated 
> the PAA sends a message to the EP saying that this 
> address is valid. Sure you have clearly a spoofing IP address 
> problem :-( 
> 
Agreed that spoofing is the only problem. Initially I was thinking
about restricted access to the PaC till the client is authenticated.
But providing this feature comes with its own risk I guess.

-mohan

> maybe I miss something,
> 
> [email-masked]
>

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 23 Oct 2002 11:58:46 -0700

> > Mohan Parthasarathy wrote:
> > 
> > Subir,
> > 
> > >
> > >
> > > Mohan,
> > > Here is a quick comment:
> > >
> > > Requirement 3:
> > >
> > > Are you assuming that layer-2 security exists here? If 
> not, then by 
> > > mutual authentication you may not be able to avoid some MITM
> > attacks.
> > >
> > There is no assumption about layer 2 in this case.
> > 
> > > For example, an AP can come in between PaC and PAA and 
> forward the 
> > > PaC's credentials by simply changing the IP/MAC address. Once 
> > > authentication is successful (mutual authentication is 
> performed) AP 
> > > disconnects the PaC and gains the access.
> > >
> > How does mutual authentication succeed in this case ?  PaC and AS 
> > share a secret (could be in the form of pre-shared key, certificates
> > etc.) which is not known to anybody else and they verify 
> the identity
> > of each other by generating and verifying a hash. For example, IKE
> > provides mutual authentication.
> 
>   Remember AP is forwarding everything what PaC is sending until 
>   authentication process is completed.
> 
That can sure lead to DoS attacks, and at the end, mutual authentication
would have failed.

-mohan

> > 
> > -mohan
> > 
> > >
> > > Subir
> > >
> > >
> > >
> > > > Mohan Parthasarathy wrote:
> > > >
> > > > Folks,
> > > >
> > > > PANA threats and secuirty requirements doc is at
> > > >
> > > >
> > http://www.toshiba.com/tari/pana/draft-ietf-pana-threats-eval-00.txt
> > > >
> > > > before it is officially annonunced.
> > > >
> > > > Please send comments to the list.
> > > >
> > > > -thanks
> > > > mohan
> > >
>