Subject: PANA and IP address configuration

From: "Alper E. YEGIN" <[email-masked]>
Date: Tue, 3 Dec 2002 17:16:49 -0800

Hello,

As we discussed during the PANA security threats presentation,
configuring an IP address on the client before it is
authenticated opens up certain types of attacks on the
network such as address depletion. Allowing PANA before
the client has an IP address mitigates the attacks, but
as Erik Nordmark pointed out it comes with a price 
(e.g., potentially preventing use of existing security 
mechanisms).

In the light of these discussions, one sensible approach is to
relax the requirement that PANA must be used only after 
IP address configuration, while pointing out the trade-off 
between these choices. We should not prevent a solution that 
can work both before and after IP address configuration on 
the client. As long as such a solution can satisy the 
requirements, it should be acceptible, and hopefully we can
say that it can mitigate the address depletion attacks.

Current requirements draft says:

   PANA does not perform any address assignment functions but
   MUST only be invoked after the client has a usable IP address.

Here is the proposed text replacement:

   Providing address assignment functionality is outside the scope 
   of PANA. PANA protocol design MAY require the PaC to configure 
   an IP address before using this protocol. Allocating an IP address
   to unauthenticated PaCs may enable security vulnerabilities, such as
   IP address depletion attacks on the access network. This threat may
   not be an issue for IPv6 because of the large address space, but it
   can effect IPv4 deployments. Such a threat can be mitigated by allowing
   the protocol to run without an IP address on the PaC (e.g., using
   unspecified source address), but this choice might limit the re-use
   of existing security mechanisms, and impose additional implementation
   complexity. This trade off should be taken into consideration in
   designing PANA. 

So, one proposal might choose to require an IP address be
configured on the PaC before PANA, and therefore possibly open to
address depletion attacks. Another proposal might work without 
IP address, but may have some protocol complexity (in addition to 
implementation complexity). Both proposals should be acceptible for 
consideration. And it would be ideal if we had identified a proposal 
that works the same way with or without an IP address. That means,
it could be just an implementation exercise to provide both modes of
operation.

Comments?

alper

---

From: Subir Das <[email-masked]>
Date: Thu, 05 Dec 2002 21:20:21 -0500

I am confused. The charter says:
"The WG will work with the assumption that a PANA client (PaC) is already
configured with
an IP address before using PANA."

Are we suggesting a change here too?

Subir

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Thu, 5 Dec 2002 18:52:15 -0800

> Are we suggesting a change here too?

Yes (eventually).

alper