[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: New IPSec Monitoring MIB draft

Lewis McCarthy writes:
> > Yes, you can have multiple certificates, but at the end you only have
> > ONE end user public key you use in the authentication take from the
> > certificate. There isn't a reason to include the whole path, only the
> > end user certificate used in the authentication is really interesting.
> This last point isn't obvious to me. In view of the work on trust metrics
> for certification paths, I imagine that examining the whole path might be
> useful. Since the overall authentication relies upon the entire path, I'm
> not sure why you would single out the terminal cert for inclusion in the MIB.

Mostly, because that information can be quite large, and getting it
can be quite hard. Also the management statition etc can do the same
path validation procedures than the ike did if it wants.

One thing we might want to add is to add table of trusted
CA-certificates in the MIB, so the management station etc can do that
path finding itself.

I just don't see currently any reason to include all of the
certificates used in the authentication, and including them doesn't
provide any usefull information that is not available already.
-- 
kivinen@iki.fi                               Work : +358-9-4354 3218
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/
Follow-Ups: