Re: [secdir] Review of draft-ietf-behave-v6v4-xlate-20

[Tero Kivinen <[e-mail]>]

Xing Li writes:
> Thank you very much for the comments. With the help of the behave 
> chairs, we have updated the security session of xlate draft, the text reads

New version of security considerations section looks good for me.

> 7. Security Considerations
> 
> The use of stateless IP/ICMP translators does not introduce any new
> security issues beyond the security issues that are already present
> in the IPv4 and IPv6 protocols and in the routing protocols that are
> used to make the packets reach the translator.
> 
> There are potential issues that might arise by deriving an IPv4
> address from an IPv6 address - particularly addresses like broadcast
> or loopback addresses and the non IPv4-translatable IPv6 addresses,
> etc. The [I-D.ietf-behave-address-format] addresses these issues.
> 
> As with network address translation of IPv4 to IPv4, the IPsec
> Authentication Header [RFC4302] cannot be used across an IPv6 to IPv4
> translator.
> 
> As with network address translation of IPv4 to IPv4, packets with
> tunnel mode ESP can be translated since tunnel mode ESP does not
> depend on header fields prior to the ESP header. Similarly,
> transport mode ESP will fail with IPv6 to IPv4 translation unless
> checksum neutral addresses are used. In both cases, the IPsec ESP
> endpoints will normally detect the presence of the translator and
> encapsulate ESP in UDP packets [RFC3948].
-- 
[e-mail]