Re: [anonsec] Comments on connection latching draft

[Michael Richardson <[e-mail]>]

Nicolas Williams wrote:
> On Thu, Dec 06, 2007 at 06:38:36PM -0500, Sam Hartman wrote:
>> What is the purpose of the connection states?  I see them enumerated but never used.
> 
> To help describe the process by which latches are created and torn down.
> 
>> Why must implementations make available nat state?  I'm unconvinced
>> that is well enough defined to actually be useful.

> I think this is Michael's requirement.
> 
>>    o  Any IPsec channel created with a given peer while another
>>       distinct, established IPsec channel exists with the same source
>>       and destination addresses SHOULD be bound to the same peer.
>>
>>
>> How does this interact with nats?
> 
> Hmmm, badly :)

If as you say, it's my requirement, let me remember why.
I thought that we had ruled NAT interaction as out-of-scope.

BTW: real world case where channel binding is necessary:


http://www.schneier.com/blog/archives/2007/12/defeating_the_s.html
...
   This works because the two security systems are decoupled. And the shoe
   screening machine is so crowded and chaotic, and so poorly manned, that no
   one notices the switch.




_______________________________________________