Photuris

[rivest@theory.lcs.mit.edu (Ron Rivest)]

I'd like to raise another issue that is being swept under the rug, but
which needs to be addressed by ipsec, and needs to be explicitly addressed
by Photuris:

******************************************************************************
** Who are the entities between whom a Security Association is established? **
** How are they named?                                                      **
******************************************************************************

IPSEC needs to provide EXPLICT answers to these questions.  The Photuris
spec needs to be based on these answers.  This cannot be swept under the
rug any longer.

* On page 2 of the Photuris draft, it is said that the Security Association
  is established between "two nodes".  What is a node??? (A machine with
  an IP address??)

* On page 45 of the Photuris draft, it is specified that the Certificate
  (when MD5 is the `Signature Choice') is an "email address".  Are we
  envisioning that the Security Association may link users?  (I imagine
  that some would like the answer to be "yes".)  Or was this intended 
  merely to be an IP address?

The problem:

  If I try to establish a Security Association with a specific user, or
  a specific process, on another machine, then I need some way to specify
  who I wish to talk to in my initial Key_Request.  

  With Photuris as it is, the Responder is not identified by the Photuris
  initiator to any finer granularity than the IP address to which the
  Photuris packets are sent.  

  If the intent is to support Security Associations between entities at
  some other level of granularity, then the initiator needs to be able
  to name who (or which process, whatever) at that IP address he desires
  to communicate with.

**  The Key_Request message needs to be expanded to name the            **
**  party with whom I wish to establish a Security Association, if this **
**  is to be identified in some way that is different or more specific  **
**  than merely the IP address of the responder.                        **

As it stands, Photuris apparently only supports the establishment of 
Security Associations between entities named by IP addresses. Is this
what is intended?

---

• Prev by Date: algorithm-independent
• Next by Date: Nodes and Users
• Prev by thread: Re: Photuris
• Next by thread: please post
• Index(es):
  • Main
  • Thread