Subject: RE: CGA issues

From: "Soliman Hesham" <[email-masked]>
Date: Mon, 10 May 2004 02:07:44 -0400

> > Not necessarily. Lets assume that you and I have communicated
 > > for a while, and that I have used the address Y. You don't know
 > > that Y = prefix1 | hash(my public key | ...), but it is. Then
 > > I move to prefix2, and adopt the address X = prefix2 |
 > > hash(my public key | ...). I'll tell you about it by sending
 > > you the following information:
 > > 
 > >    - Y
 > >    - X
 > >    - my public key
 > >    - my signature
 > > 
 > > At this point you will become aware that even my previous address
 > > was a CGA. And you can verify that both addresses have come from
 > > the same public key (even if the addresses are completely 
 > different).
 > > And you can verify my signature. And no information had to be
 > > communicated before the rehoming event occurred.
 > 
 > Doesn't this require you share a trust anchor with everyone in the
 > Internet (the dreaded global PKI! :)?  Unless I'm missing something,
 > this has an entirely different set of assumptions than SEND currently
 > has?

=> Not really. This is the same problem that send solves: Address
ownership. You want to prove (to the correspondent) that you are 
the same node even though the address changed. 
What Jari described will do just that. No need for PKI.

Hesham

 > 
 > -- 
 > Pekka Savola                 "You each name yourselves king, yet the
 > Netcore Oy                    kingdom bleeds."
 > Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
 > 
 > --------------------------------------------------------------------
 > To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
 > body to <[email-masked]>.
 > Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
 > --------------------------------------------------------------------
 > 

========================================================
This email may contain confidential and privileged material for the sole
use of the intended recipient.  Any review or distribution by others is 
strictly prohibited.  If you are not the intended recipient please contact
the sender and delete all copies.
========================================================

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Mon, 10 May 2004 09:29:14 +0300 (EEST)

> What Jari described will do just that. No need for PKI.

Yes -- sorry for confusing.

As Jari said, you can prove that both addresses came from the same
public key; you still cannot trust the public key because you don't
know who it belongs to. (I.e., this only solves address ownership when
you want to prove that the addresses were generated by the same node,
but nothing more.)

But in verification of this kind of "my address changed changed, I'm
now reachable at [here]" -messages this is sufficient as you don't
even want to authenticate or identify the user, just to be sure it's
the addresses belong to the same guy.