Re: Issue 41: Mandate NAT prevention if not doing NAT-T?

Hi,

>    In the MIPv4 context the traffic redirection is also transient.
>    When the MN rebinds, the redirection ends.
> 
> => no, it is only short. There is a huge difference between hacking
> some signaling messages and hacking the traffic flow.

Ok, this is a difference of terminology.  A couple of minutes worth
of redirection compared to the attacker's effort is transient to me :)

>    Now, if there is no equivalent mechanism in MOBIKE, the attack is
>    more serious, but from previous mails it seems that this aspect is
>    covered?
>    
> => it is not covered but the situation is different for MOBIKE as
> explained in previous messages. BTW it seems the current protocol
> document requires in fact a NAT detection so now there are many
> reasons to drop the "middle ground", i.e., make NAT traversal or
> NAT prevention mandatory.

Ok, this may be.  I haven't followed MOBIKE closely and was
commenting on the MIPv4 part which I thought to be misrepresented
as a serious problem.

-Sami