Re: Issue 60: Addresses in IKE_SA_INIT/AUTH

Tero Kivinen wrote:

>I have really started to hate different variations in the protocol.
>  
>
I hate that too, but is there something we can do in this
specific issue about that? Are you saying that your option
would not create a new variant?

>>Here's a suggested addition to the Security Considerations,
>>Section 6.5, after the fourth paragraph:
>>
>>The use of NO_NATS_ALLOWED will also disclose the
>>internal address to the peer, in case NAT was in the path.
>>However, this has relevance only if the node is configured to first
>>try with NO_NATS_ALLOWED and only then fallback to
>>the use of NAT traversal if that fails.
>>    
>>
>
>NO_NATS_ALLOWED discloses the internal address to the WORLD, not to
>the peer.
>  
>
Hm. I missed this. Why does it reveal the address to the world?
Because its sent in a too early IKE message that is not yet
encrypted?

--Jari