Subject: RE: CGA Issue #7: Strengthening Section 7.4 (Ted Hardie)

From: "Tuomas Aura" <[email-masked]>
Date: Tue, 6 Apr 2004 01:05:55 -0700

Personally, I think that there is some merit to using the word
"authentication" for CGA-signed messages sent from the CGA.
However, there is absolutely no need to use the controversial 
word in the draft. Here is my simplified version of the text:

  In any protocol that uses other identifiers, such as DNS names, 
  CGA signatures alone are not a sufficient security mechanism. 
  There must also be a secure way of mapping the other identifiers 
  to IPv6 addresses. If the goal is not to verify claims about IPv6 
  addresses, CGA signatures are probably not the right solution.

Elsewhere in the paper, I've make the following edits:
  "CGA-based authentication" --> "CGA-based security"
  "CGA-based authentication" --> "CGA signatures"
  "authenticated SEND messages" --> "signed SEND messages"

Tuomas

James Kempf wrote:
> I agree, with the provision that CGAs don't provide authentication,
they
> prove authorization. Hence I'd suggest the following rewording:
> 
>     In any protocol that aims to use other identifiers,
>     CGA-based authorization alone is not sufficient to protect
>     the application. There must also be a secure mechanism for
>     mapping higher-layer identifiers, such as DNS names, to
>     IP addresses. If the primary goal is not to deterimine the
>     authorization to make claims about an IPv6 address, CGA-based
>     authorization is probably not the right solution.
> 
> and changing "authentication" to "authorization" in the rest of the
> paragraph.

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: "James Kempf" <[email-masked]>
Date: Tue, 6 Apr 2004 09:05:20 -0700

Ok this looks fine. 

        jak

---

From: Jari Arkko <[email-masked]>
Date: Tue, 06 Apr 2004 20:29:36 +0300

>   "authenticated SEND messages" --> "signed SEND messages"

Looks good to me.

--Jari

---

From: Pekka Nikander <[email-masked]>
Date: Thu, 8 Apr 2004 12:32:51 +0300

>   "authenticated SEND messages" --> "signed SEND messages"

Looks good to me, too.

--Pekka