Subject: Re: [Mobike] 65 - jari's editorial issues

From: <[email-masked]>
Date: Mon, 24 Oct 2005 13:22:33 +0300

Jari Arkko wrote:

> >>3.1.  Basic Operation
> >>
> >2nd para: it would be useful to state early that ike exchange
> >initiator decides the addresses to use for that exchange. Right
> >now you only talk about IPsec addresses. I know this is part of
> >ikev2, but the reader may not have the background to understand
> >this.
> >  
> >
>    MOBIKE solves this problem by taking a simple approach: the party
>    that initiated the IKE_SA ...
> 
> =>
> 
>    MOBIKE solves this problem by taking a simple approach
>    Firstly, for every IKE exchange, the initiator of that exchange
>    decides which addresses to use for IKE itself. Secondly, the
>    party that initiated the IKE_SA ...

How about just adding "This approach applies to the addresses 
in the IPsec SAs; in the IKE_SA case, the exchange initiator can 
decide  which addresses are used." to the end of that paragraph?

> >>4.8.  NAT Prohibition
> >>
> >This section would benefit from a message flow example.
> >
> >>   The attackers in this threat can be either outsiders or 
> >>   even one of
> >>   the IKEv2 peers.  In usual VPN usage scenarios, attacks 
> >>   by the peers
> >>   can be easily dealt with if the authentication performed in the
> >>   initial IKEv2 negotiation can be traced to persons who 
> >>   can be held
> >>   responsible for the attack.  This may not be the case in all
> >>   scenarios, particularly with opportunistic approaches to 
> >>    security.
> >>  
> >>
> >s/persons/persons or devices/?

Hmm... IMHO "held responsible" is something that mostly applies
to people, and using it with devices doesn't sound too good to me..

BR,
Pasi

_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Jari Arkko <[email-masked]>
Date: Mon, 24 Oct 2005 13:42:10 +0300

>decide  which addresses are used." to the end of that paragraph?
Sure.

>to people, and using it with devices doesn't sound too good to me..
True. OTOH, the most likely case is that the person
isn't really responsible, but his device has some
malware. I'm not sure I have a better text suggestion
for you. Let it be.

--Jari