Subject: RE: [Seamoby] Review of draft-ietf-seamoby-card-protocol-01.txt

From: [email-masked]
Date: Thu, 6 Mar 2003 13:09:21 -0500

Hi James,

>Servers are used all the time for PKI. There is an article in 
>this month's ACM
>Communications about how servers are used for PKI. They are 
>used to configure
>routers, IPsec gateways, etc. Typically, LDAP is the protocol. 
>A DoS attack is
>easy to foil: put a rule in the firewall that disallows any 
>external traffic to
>the server. Also, don't advertise the address of the server 
>outside the access
>router.

In the context of the DT document, a possible DoS attack does not
even consider attacks from outside of the domain directed towards the
server as such, but inherently through the protocol operation involving the
server. Namely, a malicious MN is contaminating the cache entries of the AP 
through falsified L2-L3 mapping requests, i.e., through the cache population
mechanism that is the basis of the server approach. Firewalls won't help here!

>
>From an enterprise/ISP standpoint, tying CARD configuration to 
>a server in a
>standardized way might help to speed deployment. 

Hmm, wouldn't deployment even more speed up if we didn't have a server
at all?? The question is not whether or not a server would hinder deployment
but whether or not a server is necessary at all. I still don't see a convincing 
argument for this. The DT draft does not give one, and the current discussion
hasn't either.

Dirk
_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: "James Kempf" <[email-masked]>
Date: Thu, 6 Mar 2003 10:44:52 -0800

> mechanism that is the basis of the server approach. Firewalls won't help here!

The AR should *never* propagate any MN supplied information back to the server.
The server should contain a map of what are the valid, authorized AP to AR
mappings, as installed by the sysadmin.

The rest of my note describes how to deal with weeding out bogus MN supplied
information (timeouts, weighting information supplied by multiple MNs more
highly than by a single one, etc).

> argument for this. The DT draft does not give one, and the current discussion

Nope. If I am a sysadmin, I want my routers to know they can trust the
information supplied by an MN. I, as a sysadmin, know what APs I've installed.
The router should not trust any information provided by the MN unless it is
validated by the map in the server.

            jak

---

From: "James Kempf" <[email-masked]>
Date: Thu, 6 Mar 2003 10:44:52 -0800

jak