Subject: Re: CGA...

From: <[email-masked]>
Date: Fri, 21 Mar 2003 18:44:36 +0200

> How are we getting the hosts to trust the router advertisements without
> involving any authentication?

Well, when I said that authentication may not be so useful
for ND I meant primarily the neighbor (not router) discovery
part. In there, it may not be very useful for you to know
that I am [email-masked], because that doesn't help you
deciding that I would somehow be allowed to defend a particular
IP address or an IID in DAD, for instance. As long as you
know that I am allowed to *do* something, you don't need to
know *who* I am.

For router discovery we currently use a cert based approach
where authentication is involved. It seems more like a mandatory
side-effect of the used scheme rather than a fundamental
requirement, however. And it is not enough: we also need to
know that foobar.operator.com really is allowed to be a *router*
for the given operator, not just e.g. a web server, CPE box
completely outside the control of the operator, etc. In fact,
this seems to be an issue in draft-send-ipsec-00.txt; it probably
should define some sort of certificate extension to authorize
the use of the certificate for claiming right to be a router...

Jari

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Bill Sommerfeld <[email-masked]>
Date: Fri, 21 Mar 2003 12:12:58 -0500

> As long as you

Well, arguably, the router discovery approach we've proposed is, in a
sense, a use of "authorization certificates" rather than
"authentication certificates".

> it probably should define some sort of certificate extension to
> authorize the use of the certificate for claiming right to be a
> router...

It's far from clear that we need to use x.509/pkix format
certificates, as they carry along a lot of baggage which doesn't solve
the problem we're interested in.

And, in any event, I owe the WG a writeup on how to use DNSSEC-format
signed blobs for this purpose..

						- Bill

---

From: "James Kempf" <[email-masked]>
Date: Thu, 21 Aug 2003 10:26:49 -0700

----- > It's far from clear that we need to use x.509/pkix format
> signed blobs for this purpose..

Having a smaller certificate size would be really useful to help reduce problems
with fragmentation. On the local link, this isn't a problem because the path MTU
discovery should be pretty accurate, but in tunnels, for example from a Mobile
IP Home Agent, it could be a problem.

            jak

---

From: Alper Yegin <[email-masked]>
Date: Fri, 21 Mar 2003 11:01:25 -0800

> part. 

Thanks for the clarification.

> In there, it may not be very useful for you to know

"it may not be needed" is more accurate I believe.

> know that I am allowed to *do* something, you don't need to

If the mechanisms used can prevent you from abusing your authorization, then
yes, we don't care who you are. This is especially good model for privacy.

Let me give a counter example. When a client is authorized to gain network
access, we still want to know who they are. This is because although they
are authorized to send and receive IP packets, they are not authorized to
send router advertisements [send problem!]. Since there is the possibility
of this authorization abuse, we want to authenticate them as well so that we
can identify them if they don't behave. [there are obvious other reasons for
authenticating clients for network access....]

> the use of the certificate for claiming right to be a router...

Sounds like additional requirement on the certs.

alper