Subject: [pcp] WG Call for Adoption: Updates to the PCP Specification

From: Dave Thaler <[email-masked]>
Date: Tue, 21 Jan 2014 01:31:56 +0000

Hello,

This email starts a 2-week consensus call on adopting "Updates to the PCP

Specification" as a WG item.

Title   : Updates to the PCP Specification

Authors : S. Cheshire and S. Perreault

Filename: draft-cheshire-pcp-unsupp-family-06

URL     : http://tools.ietf.org/html/draft-cheshire-pcp-unsupp-family-06

Please read the current revision and state on the mailing list your

opinion either for or against adoption.

The call for adoption ends 3rd February 2014.

Thanks,

Chairs

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Tue, 21 Jan 2014 09:24:35 +0000

I support adopting the draft.

Comments on the current version of the draft:
For section "Nonce Check Behavior" you may want to consider the following aspects:

a) When PCP authentication is used discuss the behavior of PCP server.

comment 1> I don't see any security threat that client re-boots, loses nonce,  authenticates again, Authenticated PCP client can find the existing mappings without remembering the nonce and can even renew or delete the existing mapping.

b) Section 3 discusses the problem about new host receiving the same IP address of old host leaving the network

comment2> This problem could also be resolved by PCP auth. PCP Server would find out that a different user has authenticated from the same IP address and hence can try to do re-authentication with the old user, if no response is received then PCP server can delete the existing mappings.

c) Section 5

comment 3> PCP authentication solves the problem of preventing a user from learning the existing mappings of a different user.
comment 4> The problem of bogus mappings could be resolved either by PCP authentication or IP Source guard.

-Tiru.
From: Dave Thaler [mailto:[email-masked]]
Sent: Tuesday, January 21, 2014 7:02 AM
To: [email-masked]
Subject: [pcp] WG Call for Adoption: Updates to the PCP Specification

Hello,

Thanks,

Chairs

---

From: Simon Perreault <[email-masked]>
Date: Tue, 21 Jan 2014 09:58:41 -0500

Le 2014-01-21 04:24, Tirumaleswar Reddy (tireddy) a écrit :
> comment 1> I don't see any security threat that client re-boots, loses
> nonce,  authenticates again, Authenticated PCP client can find the
> existing mappings without remembering the nonce and can even renew or
> delete the existing mapping.

I'm sorry, I don't understand what your point is. What are the changes 
that you are suggesting?

> comment2> This problem could also be resolved by PCP auth. PCP Server
> would find out that a different user has authenticated from the same IP
> address and hence can try to do re-authentication with the old user, if
> no response is received then PCP server can delete the existing mappings.

Correct, but IMHO auth is out of scope for this doc.

> c) Section 5
>
> comment 3> PCP authentication solves the problem of preventing a user
> from learning the existing mappings of a different user.
>

Both are correct, but IMHO both are also out of scope.

Simon
-- 
DTN made easy, lean, and smart --> http://postellation.viagenie.ca
NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
STUN/TURN server               --> http://numb.viagenie.ca

---

From: "Alfred E. Heggestad" <[email-masked]>
Date: Wed, 22 Jan 2014 12:33:38 +0100

> The call for adoption ends 3rd February 2014.

I support adopting this draft.

/alfred