Subject: [pcp] about draft-cui-pcp-subscriber-identification-00.txt

From: Francis Dupont <[email-masked]>
Date: Mon, 18 Oct 2010 16:31:00 +0200

I am not convinced by the 2.1 argument: with IPv6 source address
validation by definition it is not allowed to use 'bogus source address,
which satisfies the validation rules.'
Same for 2.2, IMHO there is an ambiguity between the host and the CPE
(B4 in case of DS-Lite) in the 'source address':
 - if the infrastructure between the CPE and the PCP server is correctly
  protected (note for DS-Lite this means ingress filtering and no access
  to third party) then it is not possible to impersonate a CPE
 - what can happen between the host and the CPE is different but local
  networks are supposed to be by default inside one trust domain and
  the IWF on the CPE can check the host address, for instance in
  miniupnpd configuration file sample (note this is *not* yet implemented):

# "secure" mode : when enabled, UPnP client are allowed to add mappings only
# to their IP.

 - 3.1 is not enough: if you have an AAA infrastructure then you should
  get mutual authentication (i.e., the AAA system should be enable to
  provide credentials to secure PCP).

  - for 3.2 I'd replace the random number by a state cookie
   (cf SCTP for a good example of this device)

  - I already recommended 3.3 (with TLS, IPsec won't give easily the
  identity of the requestor to the PCP server application) in the very
  hostile environment case.

  - I am against 3.4 because it is a new security protocol.

Regards

[email-masked]

---

From: Francis Dupont <[email-masked]>
Date: Tue, 19 Oct 2010 19:24:50 +0200

In your previous mail you wrote:

=> I had some issues replying to your message (which is in a
 strange (for me) character sets and encoded in base64).
 Perhaps I missed things...

The IPv6 source address validation is still in a research stage, it
seems would not put into widespread use soon.

=> this is about DS-Lite and as a DS-Lite implementor I can say the
 IPv6 source address validation is pretty easy: a B4 is identify by
 its IPv6 address so the PCP server has just to use the IPv6 source
 addresses of requests. As I explained the security relies on ingress
 filtering (i.e., source addresses are checked when packets enter into
 the infrastructure) and no access (so an attacker can't inject packets
 inside the infrastructure).
 But it is an easy case...

And as I know the IPv4 source address filter is also not widely
deployed in many cases.

=> if it is needed for security it should be simply required.

So the bogus source address attacking is still a problem.

=> what I argue is these problems have easy solutions in DS-Lite and
NAT444 cases (and perhaps more).

Regards