Subject: Re: [pcp] WG Call for Adoption: Updates to the PCP Specification

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Wed, 22 Jan 2014 03:49:54 +0000

Hi Simon,

Please see inline

> -----Original Message-----
> From: Simon Perreault [mailto:[email-masked]]
> Sent: Tuesday, January 21, 2014 8:29 PM
> To: [email-masked]
> Subject: Re: [pcp] WG Call for Adoption: Updates to the PCP Specification
> 
> Le 2014-01-21 04:24, Tirumaleswar Reddy (tireddy) a écrit :
> > For section "Nonce Check Behavior" you may want to consider the
> > following aspects:
> >
> > a) When PCP authentication is used discuss the behavior of PCP server.
> >
> > comment 1> I don't see any security threat that client re-boots, loses
> > nonce,  authenticates again, Authenticated PCP client can find the
> > existing mappings without remembering the nonce and can even renew or
> > delete the existing mapping.
> 
> I'm sorry, I don't understand what your point is. What are the changes that
> you are suggesting ?

I am suggesting that if PCP authentication is used then a authenticated PCP client can delete or renew the mapping even if it has lost the mapping because of reboot.

> 
> > b) Section 3 discusses the problem about new host receiving the same
> > IP address of old host leaving the network
> >
> > comment2> This problem could also be resolved by PCP auth. PCP Server
> > would find out that a different user has authenticated from the same
> > IP address and hence can try to do re-authentication with the old
> > user, if no response is received then PCP server can delete the existing
> mappings.
> 
> Correct, but IMHO auth is out of scope for this doc.
> 
> > c) Section 5
> >
> > comment 3> PCP authentication solves the problem of preventing a user
> > from learning the existing mappings of a different user.
> >
> > comment 4> The problem of bogus mappings could be resolved either by
> > PCP authentication or IP Source guard.
> 
> Both are correct, but IMHO both are also out of scope.

Any specific reason why PCP auth is out of scope ? 

-Tiru. 

> 
> Simon
> --
> DTN made easy, lean, and smart --> http://postellation.viagenie.ca
> NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
> STUN/TURN server               --> http://numb.viagenie.ca

---

From: Simon Perreault <[email-masked]>
Date: Wed, 22 Jan 2014 09:22:03 -0500

> Any specific reason why PCP auth is out of scope ?

Well, I suppose we could prefix section 3 with something like "if you 
use PCP auth then all the problems we're fixing in this section disappear".

That's what I mean by out of scope: if you use PCP auth, then you don't 
experience the problem we're trying to fix.

Simon

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Wed, 22 Jan 2014 16:20:31 +0000

> Sent: Wednesday, January 22, 2014 7:52 PM
> To: Tirumaleswar Reddy (tireddy); [email-masked]
> Well, I suppose we could prefix section 3 with something like "if you use PCP
> auth then all the problems we're fixing in this section disappear".

Yup, the above line in section 3 will look good.

Thanks,
-Tiru.