Subject: RE: [NSIS] Key management - Nat involvement

From: [email-masked]
Date: Wed, 13 Nov 2002 11:16:51 +0200

Hi Hannes,

> why do you think that a nat might be able to get the key material of a
> different nat?
> 
> sender <--------> Nat1 <------------> Nat2 <-----------> receiver
> 
> if peer-to-peer security is used then  a signaling message is secured
> between sender and nat1 and again secured between the two nats. if you only
> use peer-to-peer security then the sender trusts the nodes along the path to
> work in the expected way. a corrupted nat might for example create a wrong
> nat binding and you would not be able to detect it. but this results from
> the way how signaling protocols work.

So, the Security Area has gone on record that this sort of transitive
trust is inherently insecure, as the sender has know knowledge of the 
entities along the path, therefore is in no possition to assess the
security risk.  As a corrupted or compromised node could inflict much
damage, as the sender assumes that signaling is secured.

Therefore, we cannot reply on peer-to-peer security, but have to be able to
have an end-to-end mechanism.  

John
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Wed, 13 Nov 2002 11:10:40 +0100

hi john.

my question to a requirement for end-to-end security is :
is this a
- "would be nice to have"
- "must be there"
- "the protocol should support it if the security associations (for the two
end hosts) are available?"

ciao
hannes

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Wednesday, November 13, 2002 10:17 AM
> To: [email-masked]; [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: RE: [NSIS] Key management - Nat involvement
>
>
> Hi Hannes,
>