draft-ietf-v6ops-nap-00.txt & NAT security [2.2]

[alain@tycool.net (Alain Durand)]

I've been reading again section 2.2

2.2  Simple security due to stateful filter implementation

I think this section is a bit weak.

If someone install a NAT box at home, by default,
it will prevent incoming connections, and this
is widely percieved as a security function.

The point that trojan horses do exist and that the dynamic
mapping does not provide real security is true.
However, the classic counter arguments come in two flavor:
	- oh, but the NAT boxes are labeled security devices
	so it must be true.
	- "defense in depth" is what more knowledgebla people
	would answer.

So you expect to convince home user and IT department that
they should then give up on what they considered as
"state of the art security", you are facing an uphill
batttle and you will need much more than the current
text in section 2.2.

	- Alain.