Subject: [Pana] NEW: [issue55] Client cookie useful

From: [email-masked]
Date: Thu, 5 Feb 2004 11:41:24 +0200

TmV3IHN1Ym1pc3Npb24gZnJvbSBEYW4gRm9yc2JlcmcgPGRhbi5mb3JzYmVyZ0Bub2tpYS5jb20+Og0KDQpGcm9tIEphcmkgQXJra286DQo+ICAgICAgLSAiQ2xpZW50IGNvb2tpZSB1c2VmdWw/Ig0KPiANCj4gICAgICAgIFdvdWxkIGl0IGJlIHVzZWZ1bCBmb3IgdGhlIGNsaWVudCB0byBwcm92aWRlIGl0cyBvd24gY29va2llIGFzDQo+ICAgICAgICB3ZWxsLCBzdWNoIHRoYXQgZm9yIHNvbGljaXRlZCBQU1JzLCB0aGUgY2xpZW50J3MgY29va2llIHdvdWxkDQo+ICAgICAgICBiZSBjb3BpZWQgYmFjay4gVGhpcyB3b3VsZCBjb3N0IHZlcnkgbGl0dGxlLCBidXQgcHJvdGVjdCB0aGUNCj4gICAgICAgIGNsaWVudCBhZ2FpbnN0IGJsaW5kIFBBQSBzcG9vZmluZyBhdHRlbXB0cy4NCg0KQWxwZXIgWWVnaW46DQpPSywgd2Ugc2hhbGwgb3BlbiBhbiBpc3N1ZSBhbmQgdHJhY2sgdGhpcy4NCg0KLS0tLS0tLS0tLQ0KY2F0ZWdvcnk6IFRlY2huaWNhbA0KZG9jdW1lbnQ6IGRyYWZ0LWlldGYtcGFuYS1wYW5hLXh4LnR4dA0KbWVzc2FnZXM6IDE5NQ0Kbm9zeTogZGZvcnNiZXINCnByaW9yaXR5OiBTaG91bGQgRml4DQpzdGF0dXM6IFBlbmRpbmcNCnRpdGxlOiBDbGllbnQgY29va2llIHVzZWZ1bA0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClBBTkEgSXNzdWVzIDxwYW5hX2lzc3Vlc0BkYW5mb3JzYmVyZy5pbmZvPg0KPGh0dHA6Ly9kYW5mb3JzYmVyZy5pbmZvOjgwODAvcGFuYS1pc3N1ZXMvaXNzdWU1NT4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo=_______________________________________________Pana mailing [email-masked]://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Fri, 06 Feb 2004 18:00:22 -0800

>> From Jari Arkko:
>>      - "Client cookie useful?"
>> 
>>        Would it be useful for the client to provide its own cookie as
>>        well, such that for solicited PSRs, the client's cookie would
>>        be copied back. This would cost very little, but protect the
>>        client against blind PAA spoofing attempts.

The type of DoS attacks between the PaCs and PAAs are not symmetrical.
Unless protected against it, a PAA would engage in PANA with any PaC that
initiates a session. On the other hand, a PaC would only engage in PANA with
one PAA at a time for accessing the network it is attached on an interface.
Therefore, the same DoS attack does not exist on the PaC.

Also, if this means adding a cookie to PDI (PANA-PAA-Discover), I don't
think this helps, because this is the first message sent and it is
multicasted. Any node can respond to it, as many times as it likes. There is
no return routability in this. If we want to shift the cookie exchange to
later where unicast traffic begins between the PaC and PAA, I think this is
too late as PaC can readily be victimized by the PAA stalling.

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Fri, 06 Feb 2004 18:00:22 -0800

Alper