Subject: RE: [Pana] DI issue in multi-hop PANA

From: [email-masked]
Date: Mon, 14 Feb 2005 13:06:09 +0200

I agree with this reasoning. This would mean that we remove the lower-layer
device identifier check from sec 5.5.

- Dan

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On 
> Behalf Of ext Yoshihiro Ohba
> Sent: 13 February, 2005 23:16
> To: [email-masked]
> Subject: [Pana] DI issue in multi-hop PANA
> 
> 
> The PANA specification provides an optional feature of device
> identifier validation in which the device identifier carried in the
> payload of a PANA message is compared with that is carried in the MAC
> or IP header that encapsulates the PANA message.
> 
> This device identifier validation is used for preventing a class of
> service theft or DoS attack launched by an attacker PaC putting some
> other's device identifier in the payload of a PANA message while still
> using its own device identifier in the encapsulating MAC or IP header.
> Note that this device identifier validation does not prevent all
> possible service theft or DoS attacks even in the single-hop PANA
> case.  Also, this device identifier validation makes a PANA
> implementation OS dependent especially when a link-layer address is
> used as the device identifier.
> 
> This device identifier validation does not work and should not be
> performed in multi-hop PANA environments for the following reasons:
> 
>   o When a link-layer address is used as the device identifier, the
>   PAA does not see the link-layer address of the PaC in the
>   encapsulating link-layer header of a PANA message that carries the
>   device identifier in the payload.
> 
>   o When an IP address is used as the device identifier, if the device
>   identifier carried in the payload of a PANA message is different
>   from that of the encapsulating link-layer header of the PANA
>   message, the PAA cannot tell whether the difference is due to a NAT
>   router on the path between the PaC and PAA or a man-in-the middle
>   attack.
> 
> Considering the balance between effectiveness and complexity, it might
> be better to remove the device identifier validation from the PANA
> specification for all cases.
> 
> On the other hand, we should keep the device identifier of a PaC as
> PANA session attributes (i.e., a Device-Id AVP should still be carried
> in a PBA when a PBR contains one or more Device-Id AVP(s) of EP(s)).
> The PaC device identifier is still required for (a) non-cryptographic
> per-packet filtering and (b) cryptographic per-packet filtering with a
> secure association protocol that uses the device identifier (instead
> of a device-independent identifier) as its SA identification.
> 
> 
> Regards,
> 
> Yoshihiro Ohba
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Tschofenig Hannes <[email-masked]>
Date: Tue, 15 Feb 2005 16:50:01 +0100

hi yoshi, 

i agree with your observation. 

ciao
hannes

---

From: [email-masked]
Date: Wed, 23 Feb 2005 12:50:24 +0200

Here is a very simple proposed text change (removal actually):

  Change from (5.5. Message Validity Check):

  "When a Device-Id AVP is included, the AVP is valid if the device
  identifier type contained in the AVP is supported (check performed
  by both the PaC and the PAA) and is the requested one (check
  performed by the PAA only) and the device identifier value contained
  in the AVP matches the value extracted from the lower-layer
  encapsulation header corresponding to the device identifier type
  contained in the AVP (check performed by the PAA only). Note that a
  Device-Id AVP carries the device identifier of the PaC in messages
  from the PaC to the PAA and the device identifier(s) of the EP(s) in
  messages from the PAA to the PaC."

  To:

  "When a Device-Id AVP is included, the AVP is valid if the device
  identifier type contained in the AVP is supported (check performed
  by both the PaC and the PAA) and is the requested one (check
  performed by the PAA only). Note that a Device-Id AVP carries the
  device identifier of the PaC in messages from the PaC to the PAA and
  the device identifier(s) of the EP(s) in messages from the PAA to
  the PaC."

Br,
- Dan

> Behalf Of ext [email-masked]
> Sent: 14 February, 2005 13:06
> To: [email-masked]; [email-masked]
> Subject: RE: [Pana] DI issue in multi-hop PANA
> 
>