Subject: CGA...

From: Alper Yegin <[email-masked]>
Date: Thu, 20 Mar 2003 16:45:34 -0800

I hope Francis does not mind me forwarding this message here....  I think
the following point is worth discussing on the SEND ML:

=> BTW I strongly disagree about this idea that CGAs provide any kind
of authentication.

I think, CGAs provide "proof of authorization to use an IPv6 address", but
yes, I agree, it doesn't "authenticate" host or anything. I think what SEND
needs is the former. Maybe I'm stating the obvious here, but I just wanted
to make sure we separate authentication and authorization in this context.

On the other hand, protecting the router advertisements part of SEND
involves both authentication and authorization of access routers.

alper

------ Forwarded Message
From: Francis Dupont <[email-masked]>
Date: Fri, 21 Mar 2003 01:20:51 +0100
To: Julien Laganier <[email-masked]>
Cc: Samita Chakrabarti <[email-masked]>,
[email-masked], [email-masked], [email-masked]
Subject: Re: [mobile-ip] Draft on IPv6 source address selection socket API

 In your previous mail you wrote:

   Le Vendredi 21 Mars 2003 00:39, Francis Dupont a écrit :

=> you should avoid French in this list (:-).

   It is expected that most applications should work fine without tuning the

=> this is exactly the assumption I strongly disagree with.

   source address selection algorithm. If an application cannot work fine
with 
   system-wide defaults, then the develloper should be aware of that, and
may 
   choose to use this API.
   
   I guess that what your point here is that end users may want to tune the
   behavior of many applications they use without modyfing them. I
   believe it is a different problem.
   
=> this is the problem we have to solve. Do you want to recompile your
mozilla in order to add a new parameter for home/care-of choice, for
instance to use the best option when you know where is a Web server...

   Moreover, defining this policy in the environment may not be sufficiently
   fine-grained for a lot of applications: A single application may want to
send 
   packets using both its CoA and HoA as a source address, or both its TMP
and 
   Public, etc.

=> the policy in the environment has the same capability than your proposal
when the environment can be changed from applications. And this is the
usual case.

   An example of that is an application that first use a TMP
   address, and after authentication switch to a PUB address. Same thing
with 
   CGA that allows ownership-authentication

=> BTW I strongly disagree about this idea that CGAs provide any kind
of authentication.

   but is not always supported by both
   peers, so you can revert to a non-CGA if authentication fails.
   
   However, your proposition of having an environment "thing" that tweak the
   source address selection for applications that does not use this API
sounds 
   good to me, but I believe this is not the scope of this document.
   
=> so write another more useful one? Seriously I believe that all the
tuning stuff, including your knobs, the policy table and other things like
the DNS search list (a global one makes no sense as quoted today), should
be in an environment "thing" with a standard way to manage it.

Thanks

[email-masked]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

------ End of Forwarded Message

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------