Re: issue 45 - clarifications to security considerations

>Hmm.. here's my take (add this to the end of the section):
>
>   The duration of the attack can also be limited if the victim
>   reports the unwanted traffic to the originating IPsec tunnel
>   endpoint using ICMP error messages or INVALID_SPI
>   notifications. As described in [IKEv2] Section 2.21, this SHOULD
>   trigger a liveness test, which also doubles as a return
>   routability check if the COOKIE2 notification is included.
>
>And while we're at it, we could also make the 3rd paragraph
>(the one referring to [Aura02] and transport layer acks) 
>more accurate:
>
>   If the attack is launched by an outsider, the traffic flow would
>   normally stop soon due to the lack of responses (such as
>   transport layer acknowledgements). However, if the original
>   recipient of the flow is malicious, it could maintain the traffic
>   flow for an extended period of time, since it often would be able
>   to send the required acknowledgements (see [Aura02] for more
>   discussion).
>
>Does this look ok?
>  
>
Yes. Thanks.

--Jari