Subject: RE: [Mip6] Security Considerations section ofdraft-ietf-mip6-nemo-v4traversal-00.txt

From: "Soliman, Hesham" <[email-masked]>
Date: Tue, 25 Oct 2005 15:25:09 -0400

> >> Do you think this text is sufficient?  Don't you think that using 
 > >> IPv4 IPsec makes more sense?
 > > 
 > > => There is no such thing as "IPv4 IPsec". Yes I do think it's 
 > > sufficient.
 > 
 > Ok, I don't.  IPv4 IPsec is IPsec for IPv4.

=> So please explain why or suggest improvements.

 > Well, most deployed NATs won't attack anyone, while most MiTMs will.
 > 
 > > NAT detection is about detecting a MITM. Of course, that MITM could
 > > be a NAT or an attacker.
 > 
 > There should be some mechanisms of distinguishing a 
 > temporary MiTM from
 > a NAT being there for years with same IPv4 public address.

=> I'd love to know how to do that.

 > > But no one has a way of knowing that today.
 > 
 > I'm not suggesting to invent something nobody did.  Just to 
 > say that the
 > mechanism proposed in the draft is obviously insecure.  If 
 > enhancements
 > are not proposed then the threats should be acknowledged though.

=> That we can do. It's probably best to reference RFC 3519 as it
has a more detailed analysis of the threats and an IAB statement
about the negative impacts of NAT traversal.

Hesham

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 25 Oct 2005 21:57:58 +0200

Soliman, Hesham wrote:
>>>> Do you think this text is sufficient?  Don't you think that
>>>> using IPv4 IPsec makes more sense?
>>> 

Here's why: an MN connecting to a v4-only network could use MIP4 and
IPsec to maintain permanent reachability at an IPv4 Home Address.  Does
this make sense?  Should I suggest text about it?

>>> NAT detection is about detecting a MITM. Of course, that MITM
>>> could be a NAT or an attacker.
>> 
>> There should be some mechanisms of distinguishing a temporary MiTM
>> from a NAT being there for years with same IPv4 public address.
> 

Probe it daily and draw conclusions after 6 months.

>> I'm not suggesting to invent something nobody did.  Just to say
>> that the mechanism proposed in the draft is obviously insecure.  If
>>  enhancements are not proposed then the threats should be
>> acknowledged though.
> 
> => That we can do. It's probably best to reference RFC 3519 as it has
> a more detailed analysis of the threats and an IAB statement about
> the negative impacts of NAT traversal.

Yes, please reference RFC 3519.

Alex