Subject: Re: [Mobike] issue 34 proposal

From: "Stephane Beaulieu (stephane)" <[email-masked]>
Date: Tue, 27 Sep 2005 13:29:06 -0400

> 
> >Just to clarify...
> >
> >If one does detect NAT change at ESP layer, what does one do?
> >
> >Do we do a return routability check on the new address 
> before updating 
> >it's SADB?  It would seem logical, but just want to make 
> sure we're on 
> >the same page.
> >  
> >
> and Mohan wrote:
> 
> >Eventually, you want to recover faster too, right ? If it is 
> going to 
> >take a roundtrip extra compared to IKEv2 NAT-T before you 
> can use the 
> >address, how slower it is compared with the explicit update ?
> >  
> >
> I would note that the return routability text is already 
> being performed based on policy (as agreed upon in earlier 
> issues). So it isn't clear to me that we need to have an answer here.
> 

I think I missed this part of the discussion, but it seems like an
appropriate thing to do.  However, if a known attack is possible, we
might want to add this as a SHOULD or at least document it as a security
consideration.

Stephane.

> --Jari
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Francis Dupont <[email-masked]>
Date: Tue, 27 Sep 2005 21:59:55 +0200

> issues). So it isn't clear to me that we need to have an answer here.
   
   I think I missed this part of the discussion,

=> to summary for the explicit update (Mobike one) the default policy
is to perform a RR check (equivalent of a SHOULD but clearer about
the cases the RR check is not needed). There was always a consensus,
the discussion was about the wording (clearer, simpler and more accurate).

   but it seems like an
   
=> as Jari explained this is already in the document.

Regards

[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Jari Arkko <[email-masked]>
Date: Tue, 27 Sep 2005 23:40:17 +0300

>might want to add this as a SHOULD or at least document it as a security
Its on by default, I think.

--Jari