Re: 65 - jari's editorial issues

[email protected] wrote:

>>   MOBIKE solves this problem by taking a simple approach: the party
>>   that initiated the IKE_SA ...
>>
>>=>
>>
>>   MOBIKE solves this problem by taking a simple approach
>>   Firstly, for every IKE exchange, the initiator of that exchange
>>   decides which addresses to use for IKE itself. Secondly, the
>>   party that initiated the IKE_SA ...
>>    
>>
>
>How about just adding "This approach applies to the addresses 
>in the IPsec SAs; in the IKE_SA case, the exchange initiator can 
>decide  which addresses are used." to the end of that paragraph?
>  
>
Sure.

>>>>4.8.  NAT Prohibition
>>>>
>>>>        
>>>>
>>>This section would benefit from a message flow example.
>>>
>>>      
>>>
>>>>  The attackers in this threat can be either outsiders or 
>>>>  even one of
>>>>  the IKEv2 peers.  In usual VPN usage scenarios, attacks 
>>>>  by the peers
>>>>  can be easily dealt with if the authentication performed in the
>>>>  initial IKEv2 negotiation can be traced to persons who 
>>>>  can be held
>>>>  responsible for the attack.  This may not be the case in all
>>>>  scenarios, particularly with opportunistic approaches to 
>>>>   security.
>>>> 
>>>>
>>>>        
>>>>
>>>s/persons/persons or devices/?
>>>      
>>>
>
>Hmm... IMHO "held responsible" is something that mostly applies
>to people, and using it with devices doesn't sound too good to me..
>  
>
True. OTOH, the most likely case is that the person
isn't really responsible, but his device has some
malware. I'm not sure I have a better text suggestion
for you. Let it be.

--Jari