Subject: RE: [mobile-ip] draft-levkowetz-mobileip-nat-tunnel-00.txt security

From: "Sami Vaarala" <[email-masked]>
Date: Tue, 30 Apr 2002 14:32:43 +0300

Hi Francis,

> -----Original Message-----
> From: Francis Dupont [mailto:[email-masked]]
> Sent: 30 April 2002 13:31
> To: Henrik Levkowetz
> Cc: Sami Vaarala; [email-masked]
> Subject: Re: [mobile-ip] draft-levkowetz-mobileip-nat-tunnel-00.txt
> security
> 
>  In your previous mail you wrote:
> 
>    	1. A paragraph that describes the mechanism - part of the
>    text I proposed a couple of mails back might do that if the part
>    about IPsec is removed
> 
> => I don't understand the part about IPsec: we have to explain
> that without IPsec an attacker can get the traffic and read it.

In order to hijack the mobility binding, the attacker must reside
on the path between the MN and the HA, and would thus be able to
read the traffic (regardless of NAT traversal).  I.e., the attack on
confidentiality is not NAT traversal specific?  Or did you have
some other concern?

Best regards,

-Sami

---

From: Francis Dupont <[email-masked]>
Date: Tue, 30 Apr 2002 13:58:13 +0200

=> now I can see your argument. I still believe mobility introduces
a difference because in order to redirect the traffic an attacker needs
only to hijack the BU. For instance it doesn't need to stay on the path
(where it could get everything with and without mobility).
 So I am still in favor to keep a short statement about IPsec in order
to encourage this counter-measure to this part of the threat.

Regards

[email-masked]

PS: if they are clear enough, I am nothing at all against long &
detailed security considerations.