Subject: Re: PANA FAQ

From: "Alper E. YEGIN" <[email-masked]>
Date: Tue, 11 Jun 2002 19:29:48 -0700

> > This shows that even an authorized client can launch an attack and we
might
> > not be able to track its identity in a pre-paid card environment. But
> > operators
> > who are concerned about this type of attacks can choose to not accept
> > pre-paid cards, or enforce traceable purchase methods are used (e.g., by
> > credit card, or via an existing account, etc.).
>
> I'm well aware that local rules can be applied as a stop-gap. But such
> rules seem to prevent things users might legitimately expect to work
> from working - i.e. this is some form of non-interoperability.

But this is not a problem introduced by PANA, or by the
"ND should take place after PANA" suggestion.

Doing ND after PANA doesn't make the system less secure.
It's easier (not always possible, like in your pre-paid card example)
to secure ND if it takes place after PANA, because of the initial
bootstraping via PANA.

>
> > If we allow ND after PANA, we have a chance to make it more secure
> > because PANA can be used to bootstrap a trust relation between the
client
> > and the network. Once a client is authorized, securing ND is the subject
of
> > SEND bof. I'm not sure if there is a chance to secure ND before a client
> > is authenticated/authorized to access the network.
>
> The CGA-based techniques don't require any infrastructure. Thus they
> can be used to secure ND between two hosts before any authorization
> by any 3rd party.
> So I think there is an existence proof even if the details aren't worked
out.

Yes, CGA based techniques can be a candidate, but details might be
important. For example, do they work for IPv4?

alper