Subject: [ANCP] Security issues

From: Tom Taylor <[email-masked]>
Date: Sat, 01 Jan 2011 22:23:31 -0500

I'm almost done the revision of the base protocol document, just 
expanding the Security Considerations section. So far I have concluded:

1.The protocol is extremely vulnerable to attacks on the underlying TCP 
session. Loss of the TCP session appears to imply that the adjacency has 
to be reestablished, and generally, unless one wants to live 
dangerously, that all the AN state has to be cleared down and 
reestablished. I'm still studying the issue, but we probably need to 
prescribe use of either IPSEC or the TCP Authentication Option [RFC 
5925] as well as TLS. One uses RFC 5925 in preference to IPSEC for 
operational reasons which probably don't apply, or because it is 
important to protect individual TCP connections with separate keys, 
which may apply. Can we envision multiple TCP connections over the same 
link between the AN and NAS? I assume user traffic would be on separate 
links, but would there be management operations (SNMP, whatever) over 
the same link as ANCP, requiring separate authentication keys?

2. We recommend a per-line rate-limiting mechanism for the sending of 
Port Up/Port Down messages. How about making that a general limit on 
message rates for individual lines to limit the IGMP-based DoS attacks 
identified in RFC 5713 and any similar attacks people could come up with?

Tom Taylor