Subject: [Mobike] D106 design draft issue: nat-p

From: Tero Kivinen <[email-masked]>
Date: Tue, 3 Jan 2006 18:38:02 +0200

[issue list: http://www.kivinen.iki.fi/ietf/mobike-design-issues.html
 working copy of document:
 http://www.kivinen.iki.fi/ietf/draft-ietf-mobike-design-06.txt]

Jari Arkko writes:
> >   This gives extra
> >    protection against 3rd party bombing attacks (the attacker cannot
> >    divert the traffic to some 3rd party). 
> 
> 
> This seems inaccurate, or at least too strong. We have
> other mechanisms to prevent that, and the NAT-T based
> attack only works for on-path attackers. Just say
> "This avoids any possibility of on-path attackers modifying
> addresses in headers" and refer to Francis's pseudonat
> attack draft.

Why do you think that NAT-preventation does not protect against 3rd
party bombing attacks?

If we do put all IP addresses used inside the packets, and
cryptographically integrity protect them, and we enable NAT
preventation, which means we do not allow NATs, how can attacker
divert the traffic to some 3rd party?
-- 
[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Jari Arkko <[email-masked]>
Date: Thu, 26 Jan 2006 15:35:27 +0200

A man-in-the-middle can't, but one of the participants
still can. You could explain this, but the resulting
text would be longer than what I proposed.

--Jari

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 27 Jan 2006 15:41:46 +0200

> text would be longer than what I proposed.

Ok, changed to your text (but left out the reference, as the pseudonat
draft is expired last summer). 
-- 
[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Jari Arkko <[email-masked]>
Date: Fri, 27 Jan 2006 15:43:21 +0200

Ok