Re: [secdir] Token (was RE: Secdir review of draft-ohba-pana-relay)

[Alan DeKok <[e-mail]>]

Alper Yegin wrote:
> Arbitrary traffic cannot pass the validation on the PaC, as the sequence
> numbers need to match. And there is also state machine match needed. PaC's
> is in certain state and would not react to any arbitrary message unless the
> message is expected in the current state.

  If the traffic is sent to the PANA port used by the PaC.  The traffic
*can* be sent to other ports.  As it stands today, the draft doesn't
appear to prevent this.

  The idea of the token is to add limited state to the PRE.  It will
only send messages that are (a) valid PANA messages, (b) to the IP of a
PaC, and (c) to the port used by the PaC used to send PANA messages.

  Using DTLS in between the PRE and PAA would achieve the same effect.
The possibility of a rogue PAA is removed, so no token is required.

  Alan DeKok.