[secdir] Security Review for draft-ohba-pana-relay-02.txt

[Margaret Wasserman <[e-mail]>]

Hi Security Directorate Folks,

I am shepherding draft-ohba-pana-relay-02.txt for publication as a  
Proposed Standard RFC, and I would like to get a Security Directorate  
review for this document as soon as possible.  The document can be  
found here:

https://datatracker.ietf.org/doc/draft-ohba-pana-relay/

IMO, there is (at least) one way in which the introduction of a relay  
changes the security model for PANA.  In the original PANA protocol,  
the PANA Authentication Agent (PAA) determines the source IP Address  
and source UDP Port number of the PANA Client (PaC) by looking in the  
headers of the request, and responds to that IP Address/Port.   
However, in the case where a relay is being used, the client IP  
Address/Port are included in an option in the relay message.  Requests  
are sent from the relay and responses are sent to the relay, using the  
IP Address/Port in the headers, but the client (using information from  
the option) is authenticated.  I understand that this changes the  
security properties of the PANA exchange, but I am not sure if it  
changes them in a way that matters for the PANA protocol.

So, I could use help here from someone who understands EAP (and  
ideally, PANA) well enough to understand how/if a relay can safely be  
used in a PANA environment.

This is not a WG document, as the PANA WG is closed.  Review comments  
should be sent to me, to Ralph Droms (cc:ed), to the authors ([e-mail] 
, [e-mail], [e-mail], [e-mail] 
, [e-mail]), and to the (still operational, but now  
unofficial) PANA mailing list ([e-mail]).

Thanks,
Margaret