[mif-arch-dt] Proposed Security Considerations text for arch draft

[Suresh Krishnan <[e-mail]>]

9. Security Considerations

There are at least three different form of attacks [ARCH-DT:feel free to
add more] that can be performed using configuration sources that use
multiple provisioning domains.

* Tampering with configuration information provided

An attacker may attempt to modify the information provided inside the
PVD container option.  These attacks can easily be prevented by using
the message integrity features provided by the underlying protocol used
to carry the configuration information. e.g. SEND [RFC3971] would detect
any form of tampering with the RA contents and the DHCPv6 AUTH option
[RFC3315] that would detect any form of tampering with the DHCPv6
message contents. This attack can also be performed by a compromised
configuration source by modifying information inside a specific , in
which case the mitigations proposed in the next subsection may be helpful.

* Rogue configuration source

A compromised configuration source such as a router or a DHCPv6 server
may advertise information about PvDs that it is not authorized to
advertise. e.g. A coffee shop may advertise configuration information
purporting to be from an enterprise and may try to attract enterprise
related traffic. The only real way to avoid this is that the PvD related
configuration container contains embedded authentication and
authorization information from the owner of the PvD. Then, this attack
can be detected by the client by verifying the authentication and
authorization information provided inside the PVD container option after
verifying its trust towards the PvD owner (e.g. a certificate with a
well-known/common trust anchor).

* Replay attacks

A compromised configuration source or an on-link attacker may try to
capture advertised configuration information and replay it on a
different link or at a future point in time. This can be avoided by
including some replay protection mechanism such as a timestamp or a
nonce inside the PvD container to ensure freshness of the provided
information.