Subject: [pcp] about PCP (in)security

From: Francis Dupont <[email-masked]>
Date: Fri, 22 Apr 2011 14:42:43 +0200

I am afraid the current specs don't correctly assume
the fact PCP no longer applies to residential gateways
as NAT-PMP does, but is intended to be used with CGNs
which have some critical security constraints
(something clear now the definition of a CGN is based on
security considerations).

There are IMHO two ways to solve this problem:
 - to get all the security sensible requirements in
  the BEHAVE CGN requirements document and refers to it.
  This has some obvious drawbacks, in particular this
  creates a normative reference to a document which is far
  to be published if it will be one day.

 - the other solution is to duplicate the work and
  to put these requirements in the PCP base specs.
  Of course this is not fine: these requirements are
  not in general specific to PCP, it is a duplicated
  and out of scope work, etc.

PCP WG chairs want to follow a third way: do nothing.
I send this message to express my formal disapproval to
this (non) solution.

Regards

[email-masked]