Re: [Pana] pana-relay security considerations

["Alper Yegin" <[e-mail]>]

> On Jan 10, 2011, at 7:06 AM, Alan DeKok wrote:
> >
> >> I think we shall stick to relying on PAA-PRE security.
> >
> >  Then it should be a MUST.

Security considerations section already says so:

	Some of the risks stemming from the aforementioned threats are 
	already handled by the EAP and PANA as described. The residual risks

	>>shall be<< mitigated using additional physical or cryptographic
security 
	in the network hosting the PREs and the PAAs.

> I originally thought that we needed some form of PRE-PAA security, and
> your comments have, IMO, suggested more reasons why this is needed.
> 
> In my opinion, a security mechanism for PRE-PAA authentication needs
> to be defined in this spec before we publish it.  

Continuing the modeling after DHCP, we could define use of IPsec (same way
RFC 3315 does).

> I think it should be
> optional to actually _use_ the security mechanism, though since there
> some situations (such as closed or otherwise secured networks) where
> this type of security isn't required operationally. 

Indeed.


>  The security
> considerations should make it clear what the risks are, and describe
> the situations in which it would be safe not to use the PRE-to-PAA
> security.
> 
> Alan, would that satisfy your concerns?  PANA folks, would that meet
> your needs?

Alper