Subject: [pcp] questions about the DNS Security under simple threat model

From: vic yan <[email-masked]>
Date: Wed, 3 Jul 2013 01:38:02 +0800

Dear authors，
       I have some questions about the DNS Security under the simple threat
model in section 18.1 of RFC6887 .
      As described in the simple threat model, the PCP clients are secure
against off-path attackers who can spoof the PCP server's IP address.   In
PCP, a client can discover the PCP server's address via a DNS query of
PCP Server Domain Name in DHCPv6 option [I-D.ieft-pcp-dhcp]. But this
client may encount Pharming by a DNS attacker.
      I'm wondering whether the data origin authentication and data
integrity to the DNS is within the scope of the above simple thread
model? And if the three conditions described in section 18.1 of [RFC6887]
are satisfied, can PCP clients be secure against the Pharming of PCP Server
without deploying DNSsec?

       I look forward to a reply at your earliest convenience. Thanks in
advance.

Yours sincerely,
Lei Yan

---

From: Dan Wing <[email-masked]>
Date: Tue, 2 Jul 2013 12:28:40 -0700

On Jul 2, 2013, at 10:38 AM, vic yan <[email-masked]> wrote:

> Dear authors，
>        I have some questions about the DNS Security under the simple threat model in section 18.1 of RFC6887 .
>       As described in the simple threat model, the PCP clients are secure against off-path attackers who can spoof the PCP server's IP address.   In PCP, a client can discover the PCP server's address via a DNS query of PCP Server Domain Name in DHCPv6 option [I-D.ieft-pcp-dhcp].

RFC6887 describes one mechanism to communicate to the PCP server -- use the default router's IP address.  The default router's IP address is most typically learned via DHCPv4, DHCPv6, or IPv6 Route Advertisement.  Those three mechanisms are typically un-protected, although there are mechanisms to protect them but are not implemented in common OSs and are even less often deployed (e.g., DHCP Authentication RFC3118).  draft-ietf-pcp-dhcp describes a DHCP option to indicate a different PCP server, which is not the default router.  That DHCP information would need to be protected in the same way that other DHCP options are provided to the client (e.g., NTP server, default router, SIP proxy, and so on), through protections such as DHCP Guard.

> But this client may encount Pharming by a DNS attacker. 
>       I'm wondering whether the data origin authentication and data integrity to the DNS is within the scope of the above simple thread model? And if the three conditions described in section 18.1 of [RFC6887] are satisfied, can PCP clients be secure against the Pharming of PCP Server without deploying DNSsec?

I don't think those protections are sufficient if the attacker is attacking DNS and you would need DNSSEC to protect against such a DNS attack.

>  
>        I look forward to a reply at your earliest convenience. Thanks in advance.

-d