Subject: [anonsec] btns-ipsec-apireq.txt

From: yaronf at checkpoint.com (Yaron Sheffer)
Date: Sun, 16 Apr 2006 18:33:02 +0300

One nit and one question:

1. In the Terminology section, should be: it does *not* imply any specific
API...

2. The "WHO" section is missing the most obvious identity information, which
is the IKE ID payloads (or SubjectAltName attributes) when these are
available, i.e. in the non-anonymous case. Is this omission intentional?

Thanks,
	Yaron

---

From: mcr at sandelman.ottawa.on.ca (Michael Richardson)
Date: Sat, 22 Apr 2006 10:06:17 -0400

>>>>> "Yaron" == Yaron Sheffer <yaronf at checkpoint.com> writes:

    Yaron> One nit and one question: 1. In the Terminology section, should
    Yaron> be: it does *not* imply any specific API...

  Thanks.

    Yaron> 2. The "WHO" section is missing the most obvious identity
    Yaron> information, which is the IKE ID payloads (or SubjectAltName
    Yaron> attributes) when these are available, i.e. in the non-anonymous
    Yaron> case. Is this omission intentional?

  Yes. 
  I specifically do not want to teach application how to parse DNs, FQDNs,
Kerberos principles, etc. Also note that in the first revision of the
requirements, we are focused on the responding system, not the initiating
system. 

  We wanted the identifiers to have an opaque format that could be trivially
compared. (In the API that envision, these would actually be pointers, which
would equal() whenever they are eq(), but one would still need to use the
proper IsIdentifyEqual() function)

  For auditing purposes, there should be a way to get a string from the
opaque identifier. By making it unidirectional, we do not require that the
mapping be reversable. So, if you have a nice human readable, printable
form of the DN, you can display that. It might be perfect for the input side.

  For the case of certificates, if one takes a page from the HIP API,
then the application doesn't really care/know --- it just loads a file that
the user provided. 

  I notice that I'm now on multimobsec-api at ietf.org, and I want to know
if I should be CC'ing that list as well. Does this indicate that Sam thinks
that perhaps this work should be in a new WG?

 (  https://www1.ietf.org/mailman/listinfo/multimobsec-api for those that
didn't get subscribed )

- -- 
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] mcr at xelerance.com      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

    "The Microsoft _Get the Facts CD_ does not work on Linux." - orospakr