Subject: [secdir] secdir review of draft-ietf-hip-native-nat-traversal

From: Carl Wallace <[email-masked]>
Date: Thu, 08 Mar 2018 20:26:21 -0500

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security area
directors. Document editors and WG chairs should treat these comments just
like any other last call comments.

This document specifies a new Network Address Translator (NAT) traversal
mode for the Host Identity Protocol (HIP). While I am not a HIP guy, it
seems ready for publication. It's well-written and the security
considerations section is thorough. The only bit that raised a question
was in section 4, which states "it should be noted that HIP version 2
[RFC7401 <https://tools.ietf.org/html/rfc7401>] instead of HIPv1 is
expected to be used with this NAT traversal mode". Earlier in the
document, it states the draft is based on HIPv2. Are there any
considerations worth noting in the cases where HIPv1 is used or should
section 4 be revised to require v2?

---

From: Miika Komu <[email-masked]>
Date: Tue, 20 Mar 2018 17:52:53 +0200

Hi Carl,

(apologies for the delay in the response)

> considerations section is thorough.

thanks!

> The only bit that raised a question
> [RFC7401<https://tools.ietf.org/html/rfc7401>] instead of HIPv1 is

there's nothing HIPv1/v2 specific in the draft really. It's more about 
that the HIPv1 is obsoleted by HIPv2 RFC. Nevertheless, I can encourage 
to stick to the latest specification by changing the text a bit:

Original: Also, it should be noted that HIP version 2 [RFC7401] instead 
of HIPv1 is expected to be used with this NAT traversal mode.

New: Also, it should be noted that HIP version 2 [RFC7401] MUST be used 
instead of HIPv1 with this NAT traversal mode.

Does this address your concern?