Re: [secdir] pana-relay security considerations

["Alper Yegin" <[e-mail]>]

> > The PaC picks an ephemeral port when sending the PANA packet.
> Src:any, dst:
> > 716. And the response from the PAA reverses the ports.
> 
>   OK.
> 
> > The most PRE can do is to check if source port is 716.
> >
> > If the PRE knows that it received the packet from a trusted source
> (by means
> > of DTLS, physical security, IPsec, etc.), then the PRE should not
> > normally(*) have to perform another level of check on the packets.
> 
>   And if not?  Anyone can pretend to be the PAA, and send any data to
> any port on the PaC.  

PRE would authenticate and authorize the other end-point who claims to be a
legit PAA before accepting any packets from it. So, it's not  "anyone".


> If this data MUST be a well-formed PANA packet,
> the security issues are minimal.  But I don't see that requirement
> clearly in the document.

This is the DPI aspect. 

What should we check for well-formation? Many if not all fields in the PANA
header may be updated by future releases of the spec (extensions, etc.). so
checking on them would force the PRE to get upgraded (with a revised version
of PANA-relay spec each time) when PaC/PAA gets upgraded. This is very
undesirable. 


I think we shall stick to relying on PAA-PRE security.

Alper

> 
>   Alan DeKok.