Subject: [Pana] DI issue in multi-hop PANA

From: Yoshihiro Ohba <[email-masked]>
Date: Sun, 13 Feb 2005 16:15:53 -0500

The PANA specification provides an optional feature of device
identifier validation in which the device identifier carried in the
payload of a PANA message is compared with that is carried in the MAC
or IP header that encapsulates the PANA message.

This device identifier validation is used for preventing a class of
service theft or DoS attack launched by an attacker PaC putting some
other's device identifier in the payload of a PANA message while still
using its own device identifier in the encapsulating MAC or IP header.
Note that this device identifier validation does not prevent all
possible service theft or DoS attacks even in the single-hop PANA
case.  Also, this device identifier validation makes a PANA
implementation OS dependent especially when a link-layer address is
used as the device identifier.

This device identifier validation does not work and should not be
performed in multi-hop PANA environments for the following reasons:

  o When a link-layer address is used as the device identifier, the
  PAA does not see the link-layer address of the PaC in the
  encapsulating link-layer header of a PANA message that carries the
  device identifier in the payload.

  o When an IP address is used as the device identifier, if the device
  identifier carried in the payload of a PANA message is different
  from that of the encapsulating link-layer header of the PANA
  message, the PAA cannot tell whether the difference is due to a NAT
  router on the path between the PaC and PAA or a man-in-the middle
  attack.

Considering the balance between effectiveness and complexity, it might
be better to remove the device identifier validation from the PANA
specification for all cases.

On the other hand, we should keep the device identifier of a PaC as
PANA session attributes (i.e., a Device-Id AVP should still be carried
in a PBA when a PBR contains one or more Device-Id AVP(s) of EP(s)).
The PaC device identifier is still required for (a) non-cryptographic
per-packet filtering and (b) cryptographic per-packet filtering with a
secure association protocol that uses the device identifier (instead
of a device-independent identifier) as its SA identification.

Regards,

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Mon, 14 Feb 2005 12:08:00 -0800

This makes sense to me. 

With the DI verification, I think the protocol design had entered a
problem space that is outside the scope. While not adequately solving
the problem, it created some complications, as in the case of multi-hop
PANA, and also with implementations. It is better we take away that
verification from the design.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of
> Yoshihiro Ohba
> Sent: Sunday, February 13, 2005 1:16 PM
> To: [email-masked]
> Subject: [Pana] DI issue in multi-hop PANA
>