Subject: [Pana] Issue2: Downgrading protection

From: [email-masked]
Date: Wed, 3 Dec 2003 17:52:48 -0800

Issue2. Downgrading protection. This is an EAP problem. Use EAP-GSSAPI to
negotiate EAP in secure way.

The consensus in the IETF58 meeting is that this is an EAP issue
and not a PANA problem.  The PANA draft already has the following
text in the Security Considerations section. However, if this is not a PANA
problem, do we still need the text in PANA draft?

"  e) Preventing downgrading attacks
   EAP supports a number of different EAP methods for authentication and
   therefore it might be required to agree on a specific mechanism.  An
   unprotected negotiation mechanism is supported in EAP and a secure
   negotiation procedure for the GSS-API methods. The support of the
   GSS-API as an EAP method is described in [I-D.aboba-pppext-eapgss]. A
   protected negotiation is supported by the GSS-API with RFC 2478
   [RFC2478]. If desired, such a protection can also be offered by PANA
   by repeating the list of supported EAP methods protected with the
   PANA SA. This type of protection is similar to the protected
   negotiation described in [RFC3329].
   This issue requires further investigation especially since the EAP
   protocol is executed between different endpoints than the PANA
   protocol."

The issue can be found at:
http://www.danforsberg.info:8080/pana-issues/issue2
Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Mon, 08 Dec 2003 15:40:37 -0800

> problem, do we still need the text in PANA draft?

I suggest we remove that text from the draft.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 08 Dec 2003 15:40:37 -0800

Alper