Re: [EME] Traversing HIP-aware NATs and Firewalls: Problem Statement andRequirements

another minor thing:

>> Sorry if this is a stupid question, but am I right in assuming that 
>> with hip
>> nat/fw traversal, the middleboxes can authenticate the HIP setup, but 
>> not
>> data packets themselves (which after all are vanilla IPSec packets)
>>   
> That's true unless you use
> * digitally sign each packet
> * Establish IPsec tunnels recursively, or
> * use something similar to the stuff suggested in 
> http://www.ambient-networks.org/docs/Advanced_HIP_based_Firewall_Traversal.pdf 
>
>
> But again, there is the question why you actually need this 
> functionality.

Btw, you don't need to verify the data traffic when you are concerned 
that someone injects traffic that will be processed by the end point. If 
an adversary would do that then the packet would be discarded at the end 
point since it would not pass IPsec processing.

Ciao
Hannes

_______________________________________________
EME mailing list
EME@irtf.org
https://www1.ietf.org/mailman/listinfo/eme