Subject: Re: PANA FAQ

From: "Alper E. YEGIN" <[email-masked]>
Date: Thu, 6 Jun 2002 10:56:43 -0700

> > For DAD, an unauthenticated client must be able to send/receive
> > NS and NA. A malicious node can respond to every NS and
> > claim the IPv6 address, therefore deny the service for a legitimate
> > client which is trying to get a link-local address before PANA.
> 
> But those threats are presumably a concern both before the client
> has authenticated and *after* the client has authenticated.
> (Just because the client is authenticated therefor deemed capable
> of paying the bills, doesn't mean it should be easily be able to
> DoS the other paying users of the network.)

Definitely.

But I think there is a significant difference between whether such an
attack is launched by an already authenticated (therefore known)
client, vs by an anonymous attacker which we cannot identify.

> 
> So I think we need the SEcureND (watch for BoF in Yokohama) independently
> of PANA.

Agreed.

alper

---

From: "James Kempf" <[email-masked]>
Date: Thu, 6 Jun 2002 20:42:57 -0700

> client, vs by an anonymous attacker which we cannot identify.

The case of an authenticated host disrupting traffic would involve
subverting ND (or ARP on IPv4).
The issue of preventing DoS attacks by subverting ND will be discussed
in the SEND BOF in Yokohama.

However, there is a kind of chicken and egg problem here regarding PANA.
One of the possible ways to secure ND might involve distributing keys
using the authentication protocol. If authentication requires ND, then
this is not possible.

There are other ways of doing the key distribution, or one could use L2
authentication.

            jak