Subject: [Pana] PANA threats Issue 86

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 1 Jun 2004 12:14:15 -0700

Hi,

Following is the resolution to Issue 86:

Include a new threat in Section 6.4:

T6.4.2: PaC can leave the network without notifying the PAA or EP  
            e.g., the Ethernet cable is unplugged, system crash. An attacker can  
            pretend to be the PaC and start using the network.  

And change FROM:

            If the link is not shared, this threat is absent as ingress filtering  
            can prevent one node from impersonating as another node.  

TO:

           If the link is not shared, T6.4.1 is absent as ingress filtering can prevent
           one node from impersonating as another node. Threat T6.4.2 is still possible
           as the disconnect may not be seen reliably by the network always.

And Change the Requirement to drop "on shared links". Also, update the summary
at the end.

Comments ?

-mohan

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Wed, 02 Jun 2004 12:48:59 -0700

>             If the link is not shared, this threat is absent as
ingress
> filtering
>            one node from impersonating as another node. 

It might not be obvious why ingress filtering is relevant here. I think
what we mean is:

"If the link is not shared, T6.4.1 is absent as there can only be one
client on the link, and ingress filtering can prevent attacker's use of
the authorized IP and MAC address on another link."

Alper

> Threat T6.4.2 is
> still possible

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 7 Jun 2004 18:41:22 -0700

> the authorized IP and MAC address on another link."
Ok.

-thanks
mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 9 Jun 2004 17:40:21 -0700

> > the authorized IP and MAC address on another link."
After re-reading the section again, there seems to be some more distinction between
shared and non-shared links. 

Following paragraph can safely be dropped:

   PANA MUST be able to prevent service theft. In some cases e.g. non- 
   shared links, it is sufficient to provide access control information  
   like IP address, MAC address, etc., to EP, which in turn can prevent  
   unauthorized users from gaining access to the network by policing the  
   packets for matching addresses. In the case of shared links, this  
   information is not sufficient to prevent service theft. PANA MUST be  
   able to bootstrap a shared secret between the PaC and PAA which can  
   be further used to setup a security association (e.g., IPsec) between  
   PaC and EP to prevent service theft on shared links.  

Final version of section 6.4:

6.4 Service theft  
     
   An attacker can gain unauthorized access into the network by stealing  
   the service from another client. Once the PaC is successfully  
   authenticated, EP will have filters in place to prevent unauthorized  
   access into the network. The filters will be based on something that  
   will be carried on every packet. For example, the filter could be  
   based on IP and MAC address where the packets will be dropped unless  
   the packets coming with certain IP address match the MAC address  
   also. Following are the possible threats.  
     
   T6.4.1: Attacker can spoof both the IP and MAC address of an  
   authorized client to gain unauthorized access. Attacker can launch  
   this attack easily by just sniffing the wire for IP and MAC address.  
   This lets the attacker use the network without any authorization,  
   getting a free service.  

   T6.4.2: PaC can leave the network without notifying the PAA or EP
   e.g., the Ethernet cable is unplugged, system crash. An
   attacker can pretend to be the PaC and start using the network.

  If the link is not shared, T6.4.1 is absent as there can only be one
  client on the link, and ingress filtering can prevent attacker's use of
  the authorized IP and MAC address on another link."
     
   If the link is shared, both the threats are present. If layer 2 provides  
   per-packet protection using pair-wise keys,  both the threats can be
   prevented.
          
   Requirement 7  
     
   PANA MUST securely bind the authenticated session to the device  
   identifier of the client, to prevent service theft. PANA MUST be able  
   to bootstrap a shared secret between the PaC and PAA which can be  
   further used to setup a security association between PaC and EP to  
   provide cryptographic protection against service theft.

Comments ?

-mohan

---

From: Alper Yegin <[email-masked]>
Date: Thu, 10 Jun 2004 09:52:00 -0700

Looks good to me.

>   the authorized IP and MAC address on another link."

Editorial: there is an extra " at the end of the paragraph.

Alper