[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: DNS? was Key Management
In message <199608142356.QAA08155@toad.com>, John Gilmore writes:
>
> However, IPSEC only authenticates to IP addresses. There's no further
> identification in the IPSEC packets. Even if usernames or hostnames
> are used in generating keys, there's no well-defined way to get that
> information back to an application; all it has is getpeername().
Since when? It was my understanding that IPsec authenticated to the nebulous
concept of a "key owner", which could be a single user, a host, or even a
set of hosts (say, behind a crypto-gateway?).
As for authorization, the most common use I see for IPsec, in the short
term, is to secure 'standard' A&A techniques (such as OTP, challenge
response cards, etc.) from network-layer based attacks. After all, if I can
trust that a TCP session has not been tampered with, then I can make
stronger trust decisions about OTP or token based authentication of the user
at the end of the tunnel, right?
--
Harald Koch
chk@border.com
References: