Re: [secdir] secdir Review of draft-ietf-pana-preauth-08

["Joseph Salowey (jsalowey)" <[e-mail]>]

Thanks Alper,

This looks better.

Cheers,

Joe

> -----Original Message-----
> From: Alper Yegin [mailto:[e-mail]]
> Sent: Wednesday, January 20, 2010 9:57 PM
> To: Joseph Salowey (jsalowey); [e-mail]; [e-mail];
draft-ietf-
> [e-mail]; [e-mail]
> Subject: RE: secdir Review of draft-ietf-pana-preauth-08
> 
> Thank you Joe.
> 
> Let me re-massage the security considerations section using your
comments:
> 
> 6. Security Considerations
> 
>    This specification is based on the PANA protocol and it exhibits
the
>    same security properties, except for one important difference: Pre-
>    authenticating PaCs are not physically connected to an access
network
>    associated with the PAA, but they are connected to some other
network
>    somewhere else on the Internet.  This distinction can create
greater
>    DoS vulnerability for systems using PANA pre-authentication if
>    appropriate measures are not taken.  An unprotected PAA can be
forced
>    to create state by an attacker PaC which merely sends PCI messages.
> 
>    [RFC5191] describes how PAA can stay stateless while
>    responding to incoming PCIs.  PAAs using pre-authentication SHOULD
be
>    following those guidelines (see [RFC5191] Section 4.1).
> 
>    Furthermore, it is recommended that PANA pre-authentication
messages
> are
> only
>    accepted from PACs originating from well-known IP networks (e.g.,
> physically
>    adjacent networks) for a given PAA. These IP networks can be used
with
> a
>    white-list implemented either on the firewall protecting the
perimeter
> around
>    the PAA, or on the PAA itself. This prevention measure SHOULD be
used
> whenever
>    it can be practically applied to a given deployment.
> 
> 
> 
> 
> 
> 
> > -----Original Message-----
> > From: Joseph Salowey (jsalowey) [mailto:[e-mail]]
> > Sent: Wednesday, January 20, 2010 11:37 AM
> > To: [e-mail]; [e-mail]; draft-ietf-pana-
> > [e-mail]; [e-mail]
> > Subject: secdir Review of draft-ietf-pana-preauth-08
> >
> > I have reviewed this document as part of the security directorate's
> > ongoing effort to review all IETF documents being processed by the
> > IESG.
> > These comments were written primarily for the benefit of the
security
> > area directors.  Document editors and WG chairs should treat these
as
> > comments just like any other last call comments.  I apologize for
the
> > late review.
> >
> > I did not find any major issues with the document.  The security
> > considerations section does describe the additional DOS threat
> > associated with the operation of the protocol.  I think the
potential
> > mitigations could be described better.  1) it seems that the
stateless
> > PCI should be moved up in the section since it is related to the
last
> > sentence of the first paragraph. 2) it's not clear that "authorized"
is
> > the best word to use here since authentication has not completed
yet.
> > It might be better to say "It is recommended that messages are only
> > accepted from PACs originating from well known IP networks for a
given
> > PAA."  It's not really clear how effective or practical this
> > restriction
> > would be, but I'm not very familiar with PANA deployments.
> >
> > Cheers,
> >
> > Joe
>