Subject: [Pana] PANA threats Issue 90

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 11 Jun 2004 16:16:15 -0700

Here is the resolution.

Change 

T6.5.2: PaC acquires IP address before PANA authentication begins  
   using methods like e.g., DHCP in IPv4 and auto-configuration in IPv6  
   [PANAREQ]. If IP addresses are assigned before authentication, it  
   opens up the possibility of DoS attack where malicious nodes can  
   deplete the IP addresses by assigning multiple IP addresses. If  
   stateless auto-configuration [ADDRCONF] is used, the attacker can  
   respond to duplicate address detection probes sent by any node on the    
   network effectively not allowing the node to configure a link local  
   address. If stateful mechanism is used in IPv6 e.g., DHCPv6, then  
   this attack is still possible. Address depletion attack is not  
   specific to PANA, but a known attack in DHCP [DHCP-AUTH]. If PANA  
   assumes that the client has an IP address already, it opens up the  
   network to the DoS attack.  

TO:

  T6.5.2: PaC acquires an IP address by using stateful or stateless
   mechanisms before PANA authentication begins [PANAREQ]. 
   When the IP addresses are assigned before the client authentication, it  
   opens up the possibility of DoS attacks where unauthenticated 
   malicious nodes can deplete the IP address space by acquiring multiple IP
   addresses, or denying allocation to others by responding to every 
   duplicate address detection (DAD) query.

   Depleting a /64 IPv6 link-local address space or a /8 RFC1918 private
   address space requires a brute-force attack. Such an attack is part of a
   DoS class that can equally target the link capacity or the CPU cycles on 
   the target system by bombarding arbitrary packets. Therefore solely 
   handling the IP address depletion attack is not going to improve the
   security as a more general solution is needed to tackle 
   the whole class of brute-force attacks.

   The DAD attack can be prevented by deploying secure address resolution
   that does not depend on the client authentication, such as [SEND]. The attack
   may also be prevented if the EP is placed in between the PaCs to monitor
   the ND/ARP activity and detect DAD attacks (excessive NA/ARP replies).
   If none of these solutions are applicable to a deployment, the PaCs can send
   arbitrary packets to each other without going through the EP which enables a
   class of attacks that are based on  interfering with the PANA messaging
   (See T6.1.1). Since there will always be an unhandled threat in this class
   (e.g., insecure discovery), addressing DAD attack is not going to  improve the
   overall security.

Comments ?

-mohan

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Fri, 11 Jun 2004 18:20:15 -0700

Looks good to me.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of
> Mohan Parthasarathy
> Sent: Friday, June 11, 2004 4:16 PM
> To: [email-masked]
> Subject: [Pana] PANA threats Issue 90
> 
> Here is the resolution.
> 
> Change
> 
>    malicious nodes can deplete the IP address space by acquiring
multiple
> IP
>    address space requires a brute-force attack. Such an attack is part
of
> a
>    DoS class that can equally target the link capacity or the CPU
cycles
> on
>    that does not depend on the client authentication, such as [SEND].
The
> attack
>    If none of these solutions are applicable to a deployment, the PaCs
can
> send
>    (See T6.1.1). Since there will always be an unhandled threat in
this
> class