Subject: [secdir] secdir Review of draft-ietf-pana-preauth-08

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Wed, 20 Jan 2010 11:36:49 -0800

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors.  Document editors and WG chairs should treat these as
comments just like any other last call comments.  I apologize for the
late review.  

I did not find any major issues with the document.  The security
considerations section does describe the additional DOS threat
associated with the operation of the protocol.  I think the potential
mitigations could be described better.  1) it seems that the stateless
PCI should be moved up in the section since it is related to the last
sentence of the first paragraph. 2) it's not clear that "authorized" is
the best word to use here since authentication has not completed yet.
It might be better to say "It is recommended that messages are only
accepted from PACs originating from well known IP networks for a given
PAA."  It's not really clear how effective or practical this restriction
would be, but I'm not very familiar with PANA deployments.  

Cheers,

Joe

---

From: "Alper Yegin" <[email-masked]>
Date: Wed, 20 Jan 2010 21:57:05 -0800

Thank you Joe.

Let me re-massage the security considerations section using your comments:

6. Security Considerations

   This specification is based on the PANA protocol and it exhibits the
   same security properties, except for one important difference: Pre-
   authenticating PaCs are not physically connected to an access network
   associated with the PAA, but they are connected to some other network
   somewhere else on the Internet.  This distinction can create greater
   DoS vulnerability for systems using PANA pre-authentication if
   appropriate measures are not taken.  An unprotected PAA can be forced
   to create state by an attacker PaC which merely sends PCI messages.

   [RFC5191] describes how PAA can stay stateless while
   responding to incoming PCIs.  PAAs using pre-authentication SHOULD be
   following those guidelines (see [RFC5191] Section 4.1).

   Furthermore, it is recommended that PANA pre-authentication messages are
only
   accepted from PACs originating from well-known IP networks (e.g.,
physically 
   adjacent networks) for a given PAA. These IP networks can be used with a
   white-list implemented either on the firewall protecting the perimeter
around
   the PAA, or on the PAA itself. This prevention measure SHOULD be used
whenever 
   it can be practically applied to a given deployment.

> -----Original Message-----
> From: Joseph Salowey (jsalowey) [mailto:[email-masked]]
> Sent: Wednesday, January 20, 2010 11:37 AM
> To: [email-masked]; [email-masked]; draft-ietf-pana-
> [email-masked]; [email-masked]
> Subject: secdir Review of draft-ietf-pana-preauth-08
>

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Thu, 21 Jan 2010 08:22:18 -0800

Thanks Alper,

This looks better.

Cheers,

Joe

> From: Alper Yegin [mailto:[email-masked]]
> Sent: Wednesday, January 20, 2010 9:57 PM
> To: Joseph Salowey (jsalowey); [email-masked]; [email-masked];
draft-ietf-
> [email-masked]; [email-masked]
> Subject: RE: secdir Review of draft-ietf-pana-preauth-08
> 
> Thank you Joe.
> 
>    Furthermore, it is recommended that PANA pre-authentication
messages
> are
>    adjacent networks) for a given PAA. These IP networks can be used
with
> a