Subject: Re: [pcp] I-D Action: draft-ietf-pcp-authentication-06.txt

From: "Prashanth Patil (praspati)" <[email-masked]>
Date: Tue, 4 Nov 2014 11:47:43 +0000

I think it'll be easier to do a more thorough review if some of the sections were reorganized. Too much text in some sections without flow (especially Section 3.1).

Section 3.1, Session Initiation

The section is difficult to parse. There is a lot of duplicate text in paragraphs that describe the process, it can be simplified. Sequence of steps after AUTHENTICATION-REQUIRED is the same irrespective of the initiator. This can be made common. It is repeated in paragraphs 3&4.

I'd suggest having sub-sections for client and server initiated auth sessions. A simple figure illustrating message exchanges should be useful.

For server initiated sessions, what if the message is lost? This is not discussed.

Paragraph 5, how long will a server wait after sending PA-server message.

Paragraph 5, What is "pre-specified period"? I think we should make a recommendation.

Paragraph 6. The purpose of traffic key is not clear.

You're referring to Sections 7.x throughout the draft. Change it to 6.x

Section 6.1 can also be reorganized. Mechanism to generate a digest is straightforward but the text makes it is confusing. Please clearly separate out generation of digests for PA message and common PCP message.

Section 6.2, what is a common pcp packet? :)

Section 6.2 Could we list out steps for validation. The text is difficult to parse e.g. "Then, the device generates a digest for the packet (including the PCP header and Authentication Tag Option) with the transport key and the MAC algorithm found in the first step." What is the first step?

Section 6.5, Sequence numbers for common PCP messages. This doesn’t seem necessary for auth, unless Ive missed something. Sequence numbers for PCP auth messages should suffice.

-Prashanth

On 10/13/14 3:07 PM, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Port Control Protocol Working Group of the IETF.

        Title           : Port Control Protocol (PCP) Authentication Mechanism
        Authors         : Margaret Wasserman
                          Sam Hartman
                          Dacheng Zhang
                          Tirumaleswar Reddy
Filename        : draft-ietf-pcp-authentication-06.txt
Pages           : 26
Date            : 2014-10-13

Abstract:
   An IPv4 or IPv6 host can use the Port Control Protocol (PCP) to
   flexibly manage the IP address and port mapping information on
   Network Address Translators (NATs) or firewalls, to facilitate
   communication with remote hosts.  However, the un-controlled
   generation or deletion of IP address mappings on such network devices
   may cause security risks and should be avoided.  In some cases the
   client may need to prove that it is authorized to modify, create or
   delete PCP mappings.  This document proposes an in-band
   authentication mechanism for PCP that can be used in those cases.
   The Extensible Authentication Protocol (EAP) is used to perform
   authentication between PCP devices.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-pcp-authentication/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-pcp-authentication-06

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-pcp-authentication-06

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
pcp mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/pcp

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Tue, 4 Nov 2014 17:10:52 +0000

Hi Prashanth,

Please see inline [TR]

From: pcp [mailto:[email-masked]] On Behalf Of Prashanth Patil (praspati)
Sent: Tuesday, November 04, 2014 5:18 PM
To: [email-masked]
Subject: Re: [pcp] I-D Action: draft-ietf-pcp-authentication-06.txt

[TR]Fixed and added sample figures.

[TR] It's discussed in section 6.3 

[TR] PCP-server message retransmission policy is also discussed in http://tools.ietf.org/html/draft-ietf-pcp-authentication-06#section-6.3  

[TR] Agreed, added recommendation.

[TR] Fixed (It is supposed to be transport key).

[TR] Fixed.

[TR] Okay, spit generation of digests for PA and common PCP messages into separate bullets. 

[TR]  Fixed, replaced with "common PCP message"

[TR] Removed "found in the first step" , it's not required.

Section 6.5, Sequence numbers for common PCP messages. This doesn't seem necessary for auth, unless Ive missed something. Sequence numbers for PCP auth messages should suffice.

[TR] Sequence number for common PCP messages is used to prevent replay attacks.

Cheers,
-Tiru

-Prashanth

On 10/13/14 3:07 PM, "[email-masked]" <[email-masked]> wrote:

Abstract:

[email-masked]