Subject: RE: [mobile-ip] draft-levkowetz-mobileip-nat-tunnel-00.txt security

From: "Sami Vaarala" <[email-masked]>
Date: Thu, 2 May 2002 09:18:52 +0300

Hans,

> [Hans wrote]
>[snip]
> So yes, inform people of the new threats but I don't
> think we should recomend ipsec as some kind of saviour.
> Because it's not. He could eavesdrop before and he
> could do it now. So ipsec is > equally applicable to
> pure mobile ip and has very little to do with nat
> traversal extensions. And the dos case ipsec doesn't
> help at all.

This was exactly what I said (or what I was trying to
say previously):  the confidentiality problem is always
there with Mobile IP.  However, because the NAT traversal
mechanism allows you to hijack a session *without* staying
on the path permanently, the confidentiality problem thus
manifests itself in more situations.

IPsec may be used to address those new situations, but
will be useful in general to protect confidentiality of
user data traffic.

Would something along these lines sound reasonable?

-Sami

---

From: Francis Dupont <[email-masked]>
Date: Thu, 02 May 2002 10:19:19 +0200

=> we seems to be near perfectly in phase... Can someone
propose a statement to add in the security considerations?

Thanks

[email-masked]

---

From: "Henrik Levkowetz" <[email-masked]>
Date: Thu, 2 May 2002 11:51:39 +0200

Francis,

	Sami and I are doing a rewrite of parts of the security
considerations along these lines. We'll have a proposal for the
list in a couple of days.

	Regards,
		Henrik