Re: [pcp] I-D Action: draft-ietf-pcp-authentication-05.txt

> -----Original Message-----
> From: Zhangdacheng (Dacheng) [mailto:zhangdacheng@huawei.com]
> Sent: Monday, September 15, 2014 7:02 AM
> To: Tirumaleswar Reddy (tireddy); pcp@ietf.org
> Subject: RE: [pcp] I-D Action: draft-ietf-pcp-authentication-05.txt
> 
> Hi, I think we could consider this attack in our solution. In addition, I like this
> idea since it solves the problem without introducing a big change.

Yup, let's fix this attack in the next revision.

-Tiru

> 
> > -----Original Message-----
> > From: pcp [mailto:pcp-bounces@ietf.org] On Behalf Of Tirumaleswar
> > Reddy
> > (tireddy)
> > Sent: Thursday, September 11, 2014 10:40 PM
> > To: pcp@ietf.org
> > Subject: Re: [pcp] I-D Action: draft-ietf-pcp-authentication-05.txt
> >
> > Offline, Dan and I were discussing the following problem with PCP
> > authentication:
> >
> > If there is an active attacker on-path b/w the PCP client and PCP
> > server then it can strip-off the stronger HMAC algorithms and thus
> > force the client to pick the weakest one amongst the set of algorithms
> > offered by the PCP Server.  One possible way of solving the problem is
> > the client after authentication successful sends list of algorithms it
> > received from the PCP server with authentication tag (integrity
> > protection) back to the server just like it's done in TLS Finished message
> http://tools.ietf.org/html/rfc5246#section-7.4.9.
> >
> > This way server can validate if any active attacker has modified the
> > list of algorithms it had sent.
> > Let us know if you think this attack should be addressed or not in the draft.
> >
> > -Tiru
> >
> > > -----Original Message-----
> > > From: pcp [mailto:pcp-bounces@ietf.org] On Behalf Of internet-
> > > drafts@ietf.org
> > > Sent: Saturday, August 23, 2014 2:21 PM
> > > To: i-d-announce@ietf.org
> > > Cc: pcp@ietf.org
> > > Subject: [pcp] I-D Action: draft-ietf-pcp-authentication-05.txt
> > >
> > >
> > > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> > >  This draft is a work item of the Port Control Protocol Working
> > > Group of the IETF.
> > >
> > >         Title           : Port Control Protocol (PCP) Authentication
> > Mechanism
> > >         Authors         : Margaret Wasserman
> > >                           Sam Hartman
> > >                           Dacheng Zhang
> > > 	Filename        : draft-ietf-pcp-authentication-05.txt
> > > 	Pages           : 26
> > > 	Date            : 2014-08-23
> > >
> > > Abstract:
> > >    An IPv4 or IPv6 host can use the Port Control Protocol (PCP) to
> > >    flexibly manage the IP address and port mapping information on
> > >    Network Address Translators (NATs) or firewalls, to facilitate
> > >    communications with remote hosts.  However, the un-controlled
> > >    generation or deletion of IP address mappings on such network devices
> > >    may cause security risks and should be avoided.  In some cases the
> > >    client may need to prove that it is authorized to modify, create or
> > >    delete PCP mappings.  This document proposes an in-band
> > >    authentication mechanism for PCP that can be used in those cases.
> > >    The Extensible Authentication Protocol (EAP) is used to perform
> > >    authentication between PCP devices.
> > >
> > >
> > > The IETF datatracker status page for this draft is:
> > > https://datatracker.ietf.org/doc/draft-ietf-pcp-authentication/
> > >
> > > There's also a htmlized version available at:
> > > http://tools.ietf.org/html/draft-ietf-pcp-authentication-05
> > >
> > > A diff from the previous version is available at:
> > > http://www.ietf.org/rfcdiff?url2=draft-ietf-pcp-authentication-05
> > >
> > >
> > > Please note that it may take a couple of minutes from the time of
> > > submission until the htmlized version and diff are available at
> tools.ietf.org.
> > >
> > > Internet-Drafts are also available by anonymous FTP at:
> > > ftp://ftp.ietf.org/internet-drafts/
> > >
> > > _______________________________________________
> > > pcp mailing list
> > > pcp@ietf.org
> > > https://www.ietf.org/mailman/listinfo/pcp
> >
> > _______________________________________________
> > pcp mailing list
> > pcp@ietf.org
> > https://www.ietf.org/mailman/listinfo/pcp