IETF Logo Mail Archive

Re: [pcp] Comparison of PCP authentication

"Zhangdacheng (Dacheng)" <zhangdacheng@huawei.com> Tue, 07 August 2012 03:52 UTC

Return-Path: <zhangdacheng@huawei.com>
X-Original-To: pcp@ietfa.amsl.com
Delivered-To: pcp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 20A2C21F86A7 for <pcp@ietfa.amsl.com>; Mon, 6 Aug 2012 20:52:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.942
X-Spam-Level:
X-Spam-Status: No, score=-4.942 tagged_above=-999 required=5 tests=[AWL=1.657, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e0-C6gIqjdHI for <pcp@ietfa.amsl.com>; Mon, 6 Aug 2012 20:52:57 -0700 (PDT)
Received: from dfwrgout.huawei.com (dfwrgout.huawei.com [206.16.17.72]) by ietfa.amsl.com (Postfix) with ESMTP id 6EFA021F86A4 for <pcp@ietf.org>; Mon, 6 Aug 2012 20:52:57 -0700 (PDT)
Received: from 172.18.9.243 (EHLO dfweml202-edg.china.huawei.com) ([172.18.9.243]) by dfwrg02-dlp.huawei.com (MOS 4.2.3-GA FastPath) with ESMTP id AIO77089; Mon, 06 Aug 2012 19:52:57 -0800 (PST)
Received: from DFWEML407-HUB.china.huawei.com (10.193.5.132) by dfweml202-edg.china.huawei.com (172.18.9.108) with Microsoft SMTP Server (TLS) id 14.1.323.3; Mon, 6 Aug 2012 20:50:31 -0700
Received: from SZXEML402-HUB.china.huawei.com (10.82.67.32) by dfweml407-hub.china.huawei.com (10.193.5.132) with Microsoft SMTP Server (TLS) id 14.1.323.3; Mon, 6 Aug 2012 20:50:30 -0700
Received: from SZXEML528-MBX.china.huawei.com ([169.254.4.120]) by szxeml402-hub.china.huawei.com ([::1]) with mapi id 14.01.0323.003; Tue, 7 Aug 2012 11:50:25 +0800
From: "Zhangdacheng (Dacheng)" <zhangdacheng@huawei.com>
To: Sam Hartman <hartmans@painless-security.com>, Margaret Wasserman <mrw@lilacglade.org>
Thread-Topic: [pcp] Comparison of PCP authentication
Thread-Index: AQHNdC241F5Ai0qa4kawmCOKzP6BvpdNsgiw
Date: Tue, 07 Aug 2012 03:50:24 +0000
Message-ID: <C72CBD9FE3CA604887B1B3F1D145D05E2CE64A4A@szxeml528-mbx.china.huawei.com>
References: <9B57C850BB53634CACEC56EF4853FF653B6EC381@TK5EX14MBXW604.wingroup.windeploy.ntdev.microsoft.com> <7FE144CF-00E3-4451-8CBE-A6A684DB7CC4@yegin.org> <067d01cd73fd$765a6c50$630f44f0$@com> <D6D2DEED-C35A-45AB-8B72-96195C308DB9@yegin.org> <57FF0F8E-1B86-410F-8B6B-C4893A28222F@lilacglade.org> <075301cd7419$19557dd0$4c007970$@com> <A8A3C2BF-6966-4043-ABF1-363EDA3BB7F8@lilacglade.org> <tslzk67shwh.fsf@mit.edu>
In-Reply-To: <tslzk67shwh.fsf@mit.edu>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.111.99.49]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-CFilter-Loop: Reflected
Cc: "pcp@ietf.org" <pcp@ietf.org>
Subject: Re: [pcp] Comparison of PCP authentication
X-BeenThere: pcp@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: PCP wg discussion list <pcp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pcp>, <mailto:pcp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/pcp>
List-Post: <mailto:pcp@ietf.org>
List-Help: <mailto:pcp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pcp>, <mailto:pcp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Aug 2012 03:52:58 -0000

> -----Original Message-----
> From: pcp-bounces@ietf.org [mailto:pcp-bounces@ietf.org] On Behalf Of Sam
> Hartman
> Sent: Tuesday, August 07, 2012 7:47 AM
> To: Margaret Wasserman
> Cc: pcp@ietf.org
> Subject: Re: [pcp] Comparison of PCP authentication
> 
> I actually don't think you can gain much value from encapsulation.
> The issue is that you'll need to resend the PCP request once you have a
> key available.
> 
> At least in the case where the client wants authentication, you cannot
> save a half round trip through encapsulation.

I think in the same way. We used to mention this in the authentication draft. There is a concern of this approach. If a server have to maintain addition information before the success of authentication, the server may be more vulnerable to DOS attack. Attackers can send fake authentication requests appending PCP requests in order to consume the server's memory resources.
> _______________________________________________
> pcp mailing list
> pcp@ietf.org
> https://www.ietf.org/mailman/listinfo/pcp

v2.23.0 | Report a Bug | By Email