Subject: [Pana] issue 38

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 21 Jan 2004 09:47:47 -0800

http://www.danforsberg.info:8080/pana-issues/issue38

It is true that in sectionm 9.4.1, multiple hash algorithms are
supported for MAC AVP, while only HMAC-SHA1 is specified section 4.1.6.

There is also an issue of whether PANA should allow negotiation of MAC
algorithm.  I think PANA should not allow algorithm negotiation, since
there is a possible downgrading attack if negotiation is allowed.
Instead, the PAA should specify which algorithm is used.  As a result,
the PaC either accepts the specified algorithm or fails to complete
authentication successfully.  

Here is suggested text:

In section 4.1.6, change:

   "When a MAC AVP is included in a PANA message, the value field of the
   MAC AVP is calculated by using the PANA_MAC_Key in the following way:
                                                                                
      MAC AVP value = HMAC_SHA1(PANA_MAC_Key, PANA_PDU)
                                                                                
   where PANA_PDU is the PANA message including the PANA header, with
   the MAC AVP value field first initialized to 0."
                                                                                
to:

   "When a MAC AVP is included in a PANA message, the value field of the
   MAC AVP is calculated by using the PANA_MAC_Key in the following way:
                                                                                
      MAC AVP value = PANA_MAC_PRF(PANA_MAC_Key, PANA_PDU)
                                                                                
   where PANA_PDU is the PANA message including the PANA header, with
   the MAC AVP value field first initialized to 0.  PANA_MAC_PRF
   represents the pseudo random function corresponding to the MAC
   algorithm specified in the MAC AVP.  In this version of draft,
   PANA_MAC_PRF is either HMAC-MD5 or HMAC-SHA1.  The PaC and PAA MUST
   use the same algorithm to calculate a MAC AVP they originate and
   receive.  The algorithm is determined by the PAA when
   a PANA-Bind-Request with a MAC AVP is sent.  When the PaC does not
   support the MAC algorithm specified in the PANA-Bind-Request
   message, it MUST silently discard the message.  The PAA MUST NOT
   change the MAC algorithm throughout the continuation of the PANA
   session."

Regards,

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana