Subject: RE: CGA issues

From: "Soliman Hesham" <[email-masked]>
Date: Mon, 10 May 2004 06:45:39 -0400

> > => I don't see the value of adding the prefix for SEND.
 > > However, if the intention is to define CGAs for general
 > > purpose security wherever address ownership is an issue
 > > then I do see a value of adding the prefix. This was discussed
 > > in the context of using CGAs to secure MIPv6 signalling.
 > 
 > So how does this help MIP?

=> Sorry for confusing you with this, I had a solution
in mind but after thinking about it a bit more I
don't think it works. So forget this part.

 > > There is no point in having one address for ND security and another
 > > for MIPv6 and another for multi6 ;)
 > > So we might need to somehow find the lowest common denominator
 > > here in order to use CGAs in a generic manner.
 > 
 > Actually the objectives and requirements are slightly 
 > different so it's 
 > not completely without merit to consider having different 
 > mechanisms. 
 > But a unified one would be much, much, MUCH better.

=> I haven't followed multi6 in detail but from a security
point of view the problem seems very similar, if not the 
same. The question is how to fit it into the non-existent
multi6 framework ;)

 > 
 > For instance, for multi6 it is useful to be able to look up an 
 > identifier value to learn the associated locator values. 
 > Obviously this 
 > is going to be very hard, if not impossible, in a flat 59 bit space. 
 > That's why I proposed doing something that's otherwise quite 
 > similar to 
 > what's in the CGA draft using a site key rather than a host key, so 
 > that the number of values in the flat identifier space is 
 > limited to a 
 > number that isn't very different from the number of 
 > delegations in the 
 > largest DNS zones that exist today.

=> ok. I suppose it all depends on the solution details
for multi6. Without that it's difficult to know how well
CGAs will fit as is.

 > 
 > BTW, what's the implementation status of SEND/CGA?

=> No idea.

Hesham

========================================================
This email may contain confidential and privileged material for the sole
use of the intended recipient.  Any review or distribution by others is 
strictly prohibited.  If you are not the intended recipient please contact
the sender and delete all copies.
========================================================

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------