Subject: (NAT) Re: Interactions between IPSEC and NAT

From: [email-masked]
Date: Wed, 4 Feb 1998 18:55:07 -0500

We all lock our house every morning when we go to work, although we know
that any average thief will be able to break it.  So many of us pay $3000
to install the home security system, although we know that any average
thief will cut your power line to disable the security system before they
enter the house.  NAT is valuable to many people.  As a NAT user, a less
than perfect security is better than NO security at all.  Don't you lock
your front door every morning?

Cheng

----- Previous Message ----------------------------------------------------

To:     Dan Nessett <Dan_Nessett @tdc.3com.com>
cc:     ipsec @tis.com
        nat @livingston.com
From:   "Perry E. Metzger" <[email-masked]>  @ UGATE
Date:   Wednesday  February 4, 1998 03:59 PM
Subject:  Re: Interactions between IPSEC and NAT
---------------------------------------------------------------------------
       --------------------------------------------------------------------
       -----------------------------------------------

Dan Nessett writes:
> Anyone thought about this so that they can provide us with a nice clean
> answer :-) ?
Yes. If you want security, you can't use NAT, because by definition
the thing NAT is trying to do (peek in and/or alter your packets) is
what security is designed to prevent. Protocols like SSL have exactly
the same issue, btw. Any protocol that protects the contents of your
data will have the same issue.
This is not fixable -- any "fixes" someone could propose to this would
be so horrible as to make the entire point of security moot.
Perry

-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

---

From: "Perry E. Metzger" <[email-masked]>
Date: Thu, 05 Feb 1998 11:32:46 -0500

> your front door every morning?

Imagine that you have the choice between a $10 lock that works
perfectly and is highly secure, or a $1000 lock that requires that a
thief sneeze at it for it to open itself. Which would you choose?

IPsec is a simple yet very secure protocol.  You are proposing making
it complicated and costly in an effort to remove all the protection it
would provide. I am not sure that there is a point to that.

An IPsec with the ability to modify the packets in flight is like a
contraceptive that lets you get pregnant. "All the disadvantages of
condoms, with all the disadvantages of pregnancy and and AIDS
combined!" Why would anyone want such a thing?

Perry
-

---

From: Yakov Rekhter <[email-masked]>
Date: Thu, 05 Feb 98 08:48:27 PST

Perry,
 
> combined!" Why would anyone want such a thing?

Let me just say that some of the assumptions that IPsec was designed
with don't match reality. On the orthogonal, yet somewhat related
topic, it may be wise to remember that "reality has a way of adjusting 
those who think they can adjust it".

Yakov.
-

---

From: Raul Miller <[email-masked]>
Date: Thu, 5 Feb 1998 12:24:25 -0500

> > your front door every morning?

Multiplication isn't fast enough, I want to modify it so that I can
continue to use all my algorithms which are based on addition without
any modification... To someone that uses addition, a less than perfect
solution is better than NO solution at all. Don't you balance your
checkbook?

-- 
Raul, didn't bother sending this to ipsec...
-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

---

From: Bill Sommerfeld <[email-masked]>
Date: Thu, 05 Feb 1998 15:48:27 -0500

Yakov,

You seem to be characterizing this as a "ipsec vs. NAT" debate.

It's really a "security vs. NAT" debate.  

Over the past 10 years, I've worked on a number of different systems
with integrated crytographic security which, among other things, often
cryptographically protect IP addresses from modification... either at
the network layer, like ipsec, or above it in the application layer.

Every single one of these systems is broken by NAT.  Every single one.
This says quite a bit about the violence which NAT does to the goal of
securing the Internet.

				- Bill
-