Re: [radext] Fwd: RE: Fwd: RE: Fwd: RE: Mail reguarding draft-ietf-radext-dynamic-discovery

[Alan DeKok <[e-mail]>]

Stefan Winter wrote:
> Good :-) It would be very simple and straightforward to write an I-D
> registering an integer attribute "Packet-TTL", with an integer value
> that is to be decremented.

  It may also be good to add a "Global-Packet-ID".  The idea would be
that it's a 64-bit or 128-bit opaque token, created by the client.  (Or
a proxy close to the client).  Other proxies would then never touch it.

  It could be cached by proxies for a period of time.  If a proxy sees
the same Global-Packet-ID in two different packets, it knows there's a
loop or retransmission via an alternate path.

> Yet another new DNS record would add much complexity to the draft; for
> little benefit. The TTL would solve this in one go.

  The TTL wouldn't solve the forward / reverse problem.  Using a reverse
IP would catch that.

>>   The document doesn't discuss reverse IP records or lookups.
> 
> It doesn't, because the authentication of the results learned is done by
> X.509 certificate inspection during connection time. I find that a much
> more reliable mechanism than reverse IP checks.

  That's true.

> (if an attacker can fake
> an A record, then it may also be able to fake a PTR record).

  I'm not sure I agree there.  I can fake an A record for my own domain.
 But I can't fake a reverse IP record for an IP which you control.

> Having it attempt /one/ TLS connection to the target doesn't consume
> much computing power. The discovering server could also keep a list of
> servers it has recently tried and found unacceptable; and save itself
> the effort of trying over and over again.

  What about the discovered server?  It would be subject to attacks by
third parties.

  i.e. realm A lists proxy B as it's server via DDNS.  It then publishes
an article saying "free net access by using user@realmA".  Everyone
wanting free net access contacts proxy B.  Repeat for 10,000 domains,
and Proxy B gets a DoS.

  This should ideally be discovered *before* a using high-cost
connection like TLS.  That's why a reverse lookup is useful.

  Now... this is RADIUS, and there aren't that many RADIUS proxies.  But
if the DDNS draft makes it easier, there will be more RADIUS proxies,
and more possibility for such an attack.

> This could be mentioned in Security Considerations, if you find it
> useful/important to have?

  Yes.

  Alan DeKok.