does mobike support end-to-end use of tunnel mode?

Hi,

Erik read our protocol spec recently, and he had
questions about the use of addresses in the protocol.
Specifically, he was worried about "time shifting"
or "address stealing" attacks where a host uses
first address A in one place and then later B in
another place. The question is what happens when
some other host that comes later to the first place
and gets the same address A as the first host. Will
two hosts be able to communicate with the same peer?
What will happen with ongoing sessions of the first
host?

I explained that in MOBIKE the outer addresses
as such don't matter; they are just the tunnel
endpoints (although Appendix A describes a
case where an implementation can get this
wrong). What matters is the inner addresses --
its those addresses that are used to match what
packets go to what peer. Getting the address
allocations right is essentially for the security
of the system. This is indeed the case even without
MOBIKE in base IKEv2 VPN usage*.

However, Erik asked whether the document makes
it clear that it only supports the scenario where
at least one of the peers is a gateway that ensures
the address allocations are correct. And I was unable
to answer that. Are we making it clear enough? Also,
is it possible to use MOBIKE in host-to-host tunnel
mode? If so, how? And have the security considerations
relating to such usage been described?

Thoughts, anyone? Erik, feel free to post more detailed
questions and concerns...

--Jari

*) But I was unable to find a statement either in
RFC 4306 or the clarifications document about
address allocation authorization issues.