Subject: [anonsec] BTNS updates

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Sat, 24 Jun 2006 12:40:03 -0500

On Mon, Mar 20, 2006 at 12:47:12AM -0600, Michael Richardson wrote:
>     >> If there are two connections between peers, such as, in some
>     >> cases, two NFS mounts, but certainly if I used channel binding
>     >> for two SSH connections for which I had a (probably-non-btns)
>     >> /32<->/32 tunnel, would both instances see the same binding data?
> 
>     Nicolas> Most often, yes, but not necessarily.
> 
>   Okay. I am concerned about this. I have a nagging feeling that the
> channel binding should be made unique between users, but I'm not sure
> how to do this without introducing new {IKE,IKEv2} notifies. 

If the nodes are multi-user nodes then local security is necessary to
protect one user from another on the same node.

Having two channels with the same end-points and channel bindings, but
used by different users should not pose any security problems as long as
local security is maintained -- neither user should be allowed to
interfere with or eavesdrop on the other's channel.

Nico
--