Re: [pcp] PANA misconceptions (was Re: CONSENSUS CALL on PCP security)

[Rafa Marin Lopez <[e-mail]>]

Hi Ben: 

Apart from Alper's clarifications (I agree with them), I would like to add a few notes as well.


>> * PANA, as we understand it, is not mobile-friendly. It requires the PCP client to *always* have an authenticated session active and that is wasteful on mobile clients when the authentication rekey interval is much shorter than the mapping lifetime. Margaret Wasserman captured this in slides 13 and 14 of her presentation http://www.ietf.org/proceedings/85/slides/slides-85-pcp-17.pdf. We believe the *client* should decide when to authenticate (because it needs to create or refresh a mapping) because that lets the client optimize its use of the network and reduce its power consumption. 

[Rafa] This is incorrect. The PCP client could authenticate and immediately close PANA session (see PANA-Termination-Request/Answer) and still keeping the key generated for PCP. Second, in PANA, the client can decide when to authenticate (sending a PCI message).


>> 
>> We understand that a PCP server may need to send a message to the client when no authenticated session is active. If no authenticated session is active then we prefer the server send an UN-authenticated "call home" message directing the client to authenticate and then the server can send its messages over the authenticated channel. We recognize an attacker can induce the client to connect to the server by forging an unauthenticated "call home" message. But, having done that, the client can ignore subsequent forged call home messages because it will already have an authenticated session. Worse case, an attacker can't make EAP-in-PCP consume any more client resources than PANA does because PANA requires the client to always have an authenticated session available.

[Rafa] Again, this is incorrect. See my comment above about PANA-Termination-Request/Answer.

>> 
>> * PANA requires more server side resources. The authentication protocol should efficiently support 100,000's of clients on a large PCP server. Why should the server continuously maintain authenticated sessions with *every* client? Clients using 24 hour mapping lifetimes can be served by short authentication key lifetime like, for example, 5 minutes. Let the client connect, authenticate, program the mappings, and then let the authenticated session expire. Rinse and repeat in 24 hours,. Client-driven authentication via EAP-in-PCP requires less resources on the server because the server can discard the authenticated session state once the key lifetime expires.

[Rafa] Also incorrect. PANA termination does the job.

>> 
>> There was some discussion that PANA is preferable to EAP-in-PCP because it supports "liveness testing". We don't believe liveness testing is useful when the server resources consumed, per client, are PCP mappings. Checking the liveness of 100,000 clients is much more resource intensive on the server than just keeping the client's mappings around until they expire naturally at the end of their lifetime. In short, we believe EAP-in-PCP will scale better on the server than PANA.

[Rafa] Liveness testing is something not mandatory in PANA. 

>> 
>> * We believe the decision to use EAP-in-PCP vs. PANA is a choice between designing and implementing an EAP-in-PCP transport that is tailored for PCP versus adapting an existing protocol (PANA) to fit the needs of PCP.  We don't think implementing an EAP-in-PCP transport is difficult so we prefer it over PANA. EAP-in-PCP provides a clean slate that's unencumbered by the design decisions and assumptions of an existing protocol (PANA). 

[Rafa] You may agree with me that this pure speculation. However, as founder of OpenPANA project (http://sourceforge.net/projects/openpana/) I can speak on facts. We have been able to implement a PANA client in a sensor node and to install PAA in a small wireless router. I have given, a couple of times in this list, implementation information about lines of source code. 

Moreover, we have made the effort and presented in this WG the results of PCP-PANA integration with two different open source PANA implementations (OpenPANA and CPANA):

http://www.ietf.org/proceedings/86/slides/slides-86-pcp-17

However, I am still waiting for seeing anything like this in EAP-in-PCP.

Best Regards.


>> 
>> -Ben McCann
>> 
>> 
>> 
>> _______________________________________________
>> pcp mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/pcp
> 
> _______________________________________________
> pcp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pcp

-------------------------------------------------------
Rafael Marin Lopez, PhD
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: [phone] Fax: [phone] e-mail: [e-mail]
-------------------------------------------------------