Re: [pcp] I-D Action: draft-ietf-pcp-authentication-05.txt

Offline, Dan and I were discussing the following problem with PCP authentication:

If there is an active attacker on-path b/w the PCP client and PCP server then it can strip-off the stronger HMAC algorithms and thus force the client to pick the weakest one amongst the set of algorithms offered by the PCP Server.  One possible way of solving the problem is the client after authentication successful sends list of algorithms it received from the PCP server with authentication tag (integrity protection) back to the server just like it's done in TLS Finished message http://tools.ietf.org/html/rfc5246#section-7.4.9. 

This way server can validate if any active attacker has modified the list of algorithms it had sent. 
Let us know if you think this attack should be addressed or not in the draft.

-Tiru

> -----Original Message-----
> From: pcp [mailto:pcp-bounces@ietf.org] On Behalf Of internet-
> drafts@ietf.org
> Sent: Saturday, August 23, 2014 2:21 PM
> To: i-d-announce@ietf.org
> Cc: pcp@ietf.org
> Subject: [pcp] I-D Action: draft-ietf-pcp-authentication-05.txt
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>  This draft is a work item of the Port Control Protocol Working Group of the
> IETF.
> 
>         Title           : Port Control Protocol (PCP) Authentication Mechanism
>         Authors         : Margaret Wasserman
>                           Sam Hartman
>                           Dacheng Zhang
> 	Filename        : draft-ietf-pcp-authentication-05.txt
> 	Pages           : 26
> 	Date            : 2014-08-23
> 
> Abstract:
>    An IPv4 or IPv6 host can use the Port Control Protocol (PCP) to
>    flexibly manage the IP address and port mapping information on
>    Network Address Translators (NATs) or firewalls, to facilitate
>    communications with remote hosts.  However, the un-controlled
>    generation or deletion of IP address mappings on such network devices
>    may cause security risks and should be avoided.  In some cases the
>    client may need to prove that it is authorized to modify, create or
>    delete PCP mappings.  This document proposes an in-band
>    authentication mechanism for PCP that can be used in those cases.
>    The Extensible Authentication Protocol (EAP) is used to perform
>    authentication between PCP devices.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-pcp-authentication/
> 
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-ietf-pcp-authentication-05
> 
> A diff from the previous version is available at:
> http://www.ietf.org/rfcdiff?url2=draft-ietf-pcp-authentication-05
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> pcp mailing list
> pcp@ietf.org
> https://www.ietf.org/mailman/listinfo/pcp