Re: Issue: When to do return-routability tests (#6)

Thanks for your comments! One follow-up below:

>> Also, we need to decide what level of protection the tests
>> should provide. It seems that we have the following options:
>>
>> - None, no tests.
>>
>> - A party willing to answer is on the path to the claimed
>>   address. This is the basic form of return routability
>>   test.
>>
>> - There is an answer from the tested address, and that
>>   answer was authenticated (including the address) to be
>>   from our peer.
> 
> 
> We were considering another option (in early May): That an empty 
> informational exchange for RR verification might not work and that we 
> should introduce a nonce for liveness of the test.  I still like that 
> option.

Yes.

This is a related issue, but partly different too. I agree that
empty informational exchanges are not sufficient for an RR
test, and a nonce is needed. Basically, an empty informational
exchange just proves that the answer came from the peer, but
not that it came from the address we wanted to test. I guess
you could amend my list above as follows;

  - None, no tests.

  - A party willing to answer is on the path to the claimed
    address. This is the basic form of return routability
    test.

  - There is an answer from the tested address, and that
    answer was authenticated (including the address) to be
    from our peer.

  - There was an authenticated answer from the peer, but
    it is not guaranteed to be from the tested address
    or path to it (because the peer can construct a
    response without seeing the request).

The last option corresponds to making an empty informational
exchange. I think the first and the last options are not
practical options; its either the second or the third
option that we should adopt.

--Jari