Re: 65 - jari's editorial issues

Jari Arkko wrote:

> >>3.1.  Basic Operation
> >>
> >2nd para: it would be useful to state early that ike exchange
> >initiator decides the addresses to use for that exchange. Right
> >now you only talk about IPsec addresses. I know this is part of
> >ikev2, but the reader may not have the background to understand
> >this.
> >  
> >
>    MOBIKE solves this problem by taking a simple approach: the party
>    that initiated the IKE_SA ...
> 
> =>
> 
>    MOBIKE solves this problem by taking a simple approach
>    Firstly, for every IKE exchange, the initiator of that exchange
>    decides which addresses to use for IKE itself. Secondly, the
>    party that initiated the IKE_SA ...

How about just adding "This approach applies to the addresses 
in the IPsec SAs; in the IKE_SA case, the exchange initiator can 
decide  which addresses are used." to the end of that paragraph?

> >>4.8.  NAT Prohibition
> >>
> >This section would benefit from a message flow example.
> >
> >>   The attackers in this threat can be either outsiders or 
> >>   even one of
> >>   the IKEv2 peers.  In usual VPN usage scenarios, attacks 
> >>   by the peers
> >>   can be easily dealt with if the authentication performed in the
> >>   initial IKEv2 negotiation can be traced to persons who 
> >>   can be held
> >>   responsible for the attack.  This may not be the case in all
> >>   scenarios, particularly with opportunistic approaches to 
> >>    security.
> >>  
> >>
> >s/persons/persons or devices/?

Hmm... IMHO "held responsible" is something that mostly applies
to people, and using it with devices doesn't sound too good to me..

BR,
Pasi