Subject: RE: [Mobike] issue 3: nat traversal

From: Tschofenig Hannes <[email-masked]>
Date: Wed, 8 Dec 2004 11:33:34 +0100

hi mohan, 

thanks for your feedback. 

please see my comment below: 

~snip~  
> Okay. Do we want to add the qualifier that MOBIKE needs to 
> work in a "secure" fashion when moving behind a NAT  ? 
> (unlike IKEv2 which also supports NAT traversal but 
> susceptible to 3rd party bombing attacks). 

what is a "secure" nat traversal solution for you? 

> 
> > Its true that the we have a restriction that we should not modify
> > IKEv2 NAT traversal. My advice is not to focus too much on this 
> > question. Lets do what it makes technical sense. I do not 
> think any of 
> > the current proposals modify NAT-T, even if we can perhaps 
> provide a 
> > new stage in the protocol when it is turned on (not just in the 
> > initial contact). So lets not worry about this part.
> > 
> Note that none of the current proposals support NAT traversal. 
> From what i have read, they only have a prevention mechanism.
> 
i got a different impression. see for example, 
- <draft-eronen-mobike-simple-00.txt> 
- <draft-eronen-mobike-mopo-01.txt> 

ciao
hannes

> -mohan
> 
> > --Jari
> > _______________________________________________
> > Mobike mailing list
> > [email-masked]
> > https://www.machshav.com/mailman/listinfo.cgi/mobike
> 
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 8 Dec 2004 10:08:15 -0800

> what is a "secure" nat traversal solution for you? 
The one that does not have the 3rd party bombing attack :-)
To put in a different way, MOBIKE's security should not
be altered, when moving behind a NAT. As we are
at the design stage, it might make sense to understand
what sort of NAT traversal solution we are going to
have. 

> - <draft-eronen-mobike-simple-00.txt> 

This one trivially supports it by the virtue of using IKEv2 NAT-T.

> - <draft-eronen-mobike-mopo-01.txt> 
I have to read this again. But last time i read it, it was not still not
completely secure. Perhaps, it is sufficient. But i am not sure
we have a consensus on what level of security we want.

-mohan

---

From: Jari Arkko <[email-masked]>
Date: Thu, 09 Dec 2004 10:58:05 +0200

> what sort of NAT traversal solution we are going to

Right. And I want MOBIKE to be secure in this fashion.
However, if we move behind a NAT, and our configuration
allows such move, I think we pretty much have to downgrade
the security to what NAT-T offers. Or do you see a way
around that?

--Jari

---

From: Francis Dupont <[email-masked]>
Date: Thu, 09 Dec 2004 13:43:31 +0100

=> to avoid the intrinsic security issue (i.e., the 3rd party
bombing attack) of NAT traversal is very hard, and IMHO impossible
without modifying NATs and/or NAT traversal.

   > > From what i have read, they only have a prevention mechanism.

=> NAT prevention is important for security as I explained in a previous
message, and it "solves" the NAT traversal problem too.
IMHO we should only give the choice between NAT traversal and MOBIKE,
i.e., MOBIKE should only detect the "just move behind a NAT" case,
and should *not* try to handle it (i.e., the case will be considered
as misconfiguration).

Regards

[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 9 Dec 2004 15:40:06 -0800

> the security to what NAT-T offers. Or do you see a way
There may be a way around that. The node that moved behind the
NAT should include the NAT public address in the address
change message sent to the other end. Then the other end can
know what to expect in the IP headers. This is what i presented
in IETF 60. There are two ssues here (Perhaps there are more).

1) How does the end node discover the public address securely ? 
2) If the public address is known, how does the node communicate this
    to the other end securely ?

I am wondering whether these two things can be seen separately.

Let us assume that the NAT discovered the public address securely
(either physical security or DHCP security etc.). If not, the attacker
can attack anything he wants, not just MOBIKE.

In some environments (1) may be easy e.g. i know what public address 
my NAT uses at home. Or perhaps DHCP can be used to
convey this information in a secure way. Perhaps there are
others which i am not aware of. Would it make sense to provide a
mechanism in MOBIKE to carry the NAT public address assuming
it was discovered outside ? If the address is not discovered securely,
then it boils down to the same level of security as the current IKEv2
NAT-T.

-mohan