Subject: Delegation chains starting from a CGA

From: "Tuomas Aura" <[email-masked]>
Date: Fri, 22 Aug 2003 02:37:14 -0700

For proxy ND, it would be useful to be able to start
a delegation chain from a CGA. That is, the public
key that was used to generate the address would issue 
a certificate (or the first certificate in a chain)
that authorizes another public key to sign ND messages
for it.

I think the only change required to the spec is a flag
("Proxy flag") in the Signature Option to indicate that 
the there is a delegation chain to be discovered that 
starts from the CGA public key. 

Tuomas

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Greg Daley <[email-masked]>
Date: Mon, 25 Aug 2003 10:51:38 +1000

Hi Tuomas,

> starts from the CGA public key. 

I think that so long as we have a reason to trust the
MAC address provided by the proxying router, then
this is OK.

As an aside, is it safe to assume that proxy
devices are routers?

If it is, we should be able to send a DCS to the
router, with a common root of the solicited address.
(of course, we'd then have to have some sort of ND cache
entry for that device).

If there's no existing ND state (for example, if the router
is non-RA advertising for a link, or doesn't set SLLAO in RA),
we'd need to perform NS/NA (for the proxier) and then
the DCS/DCA exchanges.

This seems to be a lot of signalling when we don't actually
trust the proxy advertisement.  Not that this is a killer,
if it is carefully controlled.

Did you have something else in mind?

Greg Daley