Subject: RE: [Pana] Re: review pana spec

From: "Alper Yegin" <[email-masked]>
Date: Fri, 1 Dec 2006 17:44:13 +0200

> "
> 11.8.  IP Address Spoofing
> 
>    Without use of SEND (SEcure Neighbor Discovery [RFC 3971], there is
>    no way to prove the ownership of the IP address presented by
>    the PaC.  Hence an attacker can launch a redirect attack by
>    spoofing a victim's IP address.  It is RECOMMENDED to use SEND to
>    avoid such an attack.
> "

I think it is best if we simply acknowledge the problem and state that the
solution is outside the scope of PANA. Trying to solve that, or make
recommendations, is not our business.

I'd recommend:

   PANA does not provide any means to prove ownership of the IP address 
   presented by the PaC. Hence, an authorized PaC can launch a redirect 
   attack by spoofing a victim's IP address. This problem and its 
   solution are outside the scope of PANA.

Alper

> 
> Regards,
> Yoshihiro Ohba
> 
> 
> >
> >
> >
> > -mohan
> >
> >
> >
> >
> >
> >
> >
> >
> > > -----Original Message-----
> > > From: Yoshihiro Ohba [mailto:[email-masked]]
> > > Sent: Sunday, November 19, 2006 10:39 AM
> > > To: [email-masked]
> > > Subject: [Pana] Preliminary pana-pana draft (13a)
> > >
> > > is available at:
> > >
> > > http://www.panasec.org/docs/editing/pana-spec.html
> > >
> > > (Now we get 17 pages reduction.)
> > >
> > > Please do sanity check to make sure that all resolutions discussed in
> > > IETF67 and over mailing list are reflected appropriately.  Diff from
> > > revision 12 is also available.
> > >
> > > As soon as sanity check is done, I will submit a new revision (13)
> > > which is to be used for IETF last call.
> > >
> > > Regards,
> > > Yoshihiro Ohba
> > >
> > > _______________________________________________
> > > Pana mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/pana
> >
> >
> >
> >
> >
> > _______________________________________________
> > Pana mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/pana
> >
> >
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 1 Dec 2006 17:48:40 +0200

> 5.6.  PaC Updating its IP Address
> 
>    A PaC's IP address used for PANA can change in certain situations,
>    e.g., when the PaC moves from one IP link to another within the
>    same PAA's realm.  Other situations may be described in deployment-
>    specific PANA applicability documents.  In order to maintain the

I'd recommend deleting the last sentence ("Other situations...."). It does
not provide any useful information.

>    PANA session, the PAA needs to be notified about the change of PaC
>    address.  In order to maintain the PANA session, the PAA needs to
>    be notified about the change of the IP address of the PaC.

Last sentence repeated.

> 
>    After the PaC has changed its IP address used for PANA, it MUST
>    send a PANA-Update-Request message to the PAA.  The PAA MUST update
>    the PANA session with the new PaC address carried in the Source
>    Address field of the IP header and return a PANA-Update-Answer
>    message.  If there is an established PANA SA, both
>    PANA-Update-Request and PANA-Update-Answer messages MUST be
>    protected with an AUTH AVP.
> "

Alper

---

From: Mohan Parthasarathy <[email-masked]>
Date: Fri, 1 Dec 2006 11:24:50 -0800 (PST)

I have no problem with Alper's suggested text.

-mohan

----- Original Message ----
From: Alper Yegin <[email-masked]>
To: Yoshihiro Ohba <[email-masked]>; Mohan Parthasarathy <[email-masked]>
Cc: [email-masked]
Sent: Friday, December 1, 2006 7:44:13 AM
Subject: RE: [Pana] Re: review pana spec

I'd recommend:

Alper