Re: [ANCP] Privacy issue in draft-ietf-ancp-mc-extensions-12

"Francois Le Faucheur (flefauch)" <> Mon, 02 December 2013 09:11 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 2107F1AE387 for <>; Mon, 2 Dec 2013 01:11:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -9.502
X-Spam-Status: No, score=-9.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ydG4kxtaUb9q for <>; Mon, 2 Dec 2013 01:11:35 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 806131AE23C for <>; Mon, 2 Dec 2013 01:11:06 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=2161; q=dns/txt; s=iport; t=1385975464; x=1387185064; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=2KRoRsOiJAU6bIwCrt1/ljl/tB0Q97vDlD1aomlIs1I=; b=N3n+vOtC8a2ccp6dxAce6H9pqpK0h1UPZuAAK4vsHEBeoH5DrU14ObMl TzkX6GtQgCE2qTUX01Ivwv9e24I7Fcsb7ycR+Xs1sY5CupGRLG+MFEEm9 k4fkSpp9xjWBwUSYHSgNDyIKLmZY3FD2mx5D2dxvPvxUSTAqdEATd5+Tg w=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-AV: E=Sophos;i="4.93,809,1378857600"; d="scan'208";a="3575705"
Received: from ([]) by with ESMTP; 02 Dec 2013 09:11:04 +0000
Received: from ( []) by (8.14.5/8.14.5) with ESMTP id rB29B4e2016683 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 2 Dec 2013 09:11:04 GMT
Received: from ([]) by ([]) with mapi id 14.03.0123.003; Mon, 2 Dec 2013 03:11:03 -0600
From: "Francois Le Faucheur (flefauch)" <>
To: Tom Taylor <>
Thread-Topic: [ANCP] Privacy issue in draft-ietf-ancp-mc-extensions-12
Thread-Index: AQHO7tb0SgZ58E8jaUem8VSz3VS2I5pBA78A
Date: Mon, 2 Dec 2013 09:11:02 +0000
Message-ID: <>
References: <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
Content-Type: text/plain; charset="us-ascii"
Content-ID: <>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "" <>
Subject: Re: [ANCP] Privacy issue in draft-ietf-ancp-mc-extensions-12
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Access Node Control Protocol working group mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 02 Dec 2013 09:11:43 -0000

Hello Tom,

I think these TLVs bring some value:
The ANCP Multicast Admission Control message supports the "Conditional Access and Admission Control Use Case". When conditional access is to be performed on a per device basis (as opposed to per DSL line basis), the message needs to provide the NAS with a way to identify the device.

In general (and more or less by definition) the NAS has a lot of visibility on each DSL line (certainly for unicast), so I assume the privacy concern is not so much about communicating the info to the NAS but has more to do with the risk of a monitoring attack of the ANCP protocol. Right?

How about an alternative approach where we keep these TLVs in the document and keep them as optional, but add a note that says that:
	* including those TLVs in the message is only useful when the NAS is to perform per-device "Conditional Access and Admission Control"
	* including those TLVs in the message results in an increased privacy concern because it exposes on the wire the corresponding privacy information about which IP/MAC is accessing which multicast channel, which could be exploited by a monitoring attack on the ANCP protocol.
	* these TLVs SHOULD NOT be included when per-device "Conditional Access and Admission Control" by the NAS is not used

Makes sense?


On 1 Dec 2013, at 21:50, Tom Taylor <>

> In his review of draft-ietf-ancp-mc-extensions-12, our AD pointed out that the optional presence of the Request-Source-IP or Request-Source-MAC TLV in the ANCP Multicast Admission Control message posed privacy issues. Looking through the ANCP requirements in RFC 5851 and TR-101, I could find no requirement that these be reported.
> I proposed that these TLVs be dropped from the message and from the document. I will assume that I have consent for this change if I do not hear arguments against it by the end of Wednesday, December 18.
> Tom Taylor
> _______________________________________________
> ANCP mailing list