Subject: RE: PANA threat evaluation draft.

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 22 Oct 2002 09:31:46 -0700

> 
> Couple of comments:
> 
> Section 7.2.2: 
> 
>   "-- By sending false success, the attacker can let any node 
> gain access to the 
>    network --"
> 
> I don't think this is true. PAA doesn't open the network for 
> PaC if PaC gets false success message.
> 
Agreed. Though the PaC thinks that it was authenticated successfully,
EP will not allow the access for this client.

> 
> Section 7.5:
> 
>   "-- EP may need to add filters at the beginning (as soon as 
> the address 
>    is assigned) to prevent unauthorized access. --"
> 
> To my understanding the default functionality in EPs are that 
> they deny all access. Thus, this doesn't make sense.
> 
If PaC has acquired an IP address before authentication, what
prevents it from sending packets before authenticating itself
to the network. How does the EP prevent the access for this
client ? For example, there is a good client with IP address
10.0.0.1 which authenticates itself to the network. The next
client gets the IP address 10.0.0.2 and now before authenticating
itself to the network, starts sending packets with IP address
10.0.0.2. How does EP deny access to this client ? If the network
does not give an IP address before authentication, may be this
problem does not happen. (Spoofing the IP address of the other
client and gaining access is separately mentioned).

>   Requirement 9:
> 
> What is a valid IP address?
> 
I should have said just "IP address". If PANA assumes that client should
have an IP address before PANA begins, assuming DHCP as one of the
common ways of acquiring IP address, it does open up to DHCP address
depletion attack.

thanks
-mohan

> BR,
> - Dan
> 
> 
> 
> -----Original Message-----
> From: ext Mohan Parthasarathy [mailto:[email-masked]]
> Sent: 22 October, 2002 02:58
> To: [email-masked]
> Subject: PANA threat evaluation draft.
> 
> 
> Folks, 
> PANA threats and secuirty requirements doc is at 
> http://www.toshiba.com/tari/pana/draft-ietf-pana-threats-eval-00.txt 
> before it is officially annonunced. 
> Please send comments to the list. 
> -thanks 
> mohan 
>

---

From: Julien Bournelle <[email-masked]>
Date: Wed, 23 Oct 2002 10:30:53 +0200

> client and gaining access is separately mentioned).

I don't understand something: I don't see why if you give an IP address
to the PaC then you can't prevent him to access the network..If it is not
possible so it should be better to not attribue IP address before authentication....

For example, you configure your EP to deny access to all IP address, so
you give IP address 10.0.0.1 to your PaC to begin authentication process. When
it is correctly authenticated the PAA sends a message to the EP saying that this 
address is valid. Sure you have clearly a spoofing IP address problem :-( 

maybe I miss something,

[email-masked]