Re: issue 3: nat traversal

 > 
> please see my comment below: 
> 
> ~snip~  
> > Okay. Do we want to add the qualifier that MOBIKE needs to 
> > work in a "secure" fashion when moving behind a NAT  ? 
> > (unlike IKEv2 which also supports NAT traversal but 
> > susceptible to 3rd party bombing attacks). 
> 
> what is a "secure" nat traversal solution for you? 
> 
The one that does not have the 3rd party bombing attack :-)
To put in a different way, MOBIKE's security should not
be altered, when moving behind a NAT. As we are
at the design stage, it might make sense to understand
what sort of NAT traversal solution we are going to
have. 

> 
> > 
> > > Its true that the we have a restriction that we should not modify
> > > IKEv2 NAT traversal. My advice is not to focus too much on this 
> > > question. Lets do what it makes technical sense. I do not 
> > think any of 
> > > the current proposals modify NAT-T, even if we can perhaps 
> > provide a 
> > > new stage in the protocol when it is turned on (not just in the 
> > > initial contact). So lets not worry about this part.
> > > 
> > Note that none of the current proposals support NAT traversal. 
> > From what i have read, they only have a prevention mechanism.
> > 
> i got a different impression. see for example, 
> - <draft-eronen-mobike-simple-00.txt> 

This one trivially supports it by the virtue of using IKEv2 NAT-T.

> - <draft-eronen-mobike-mopo-01.txt> 
> 
I have to read this again. But last time i read it, it was not still not
completely secure. Perhaps, it is sufficient. But i am not sure
we have a consensus on what level of security we want.

-mohan

> ciao
> hannes
> 
> > -mohan
> > 
> > > --Jari
> > > _______________________________________________
> > > Mobike mailing list
> > > [email protected]
> > > https://www.machshav.com/mailman/listinfo.cgi/mobike
> > 
> _______________________________________________
> Mobike mailing list
> [email protected]
> https://www.machshav.com/mailman/listinfo.cgi/mobike