[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: SOI: identity protection and DOS
If PKInferstructure consumes lost of resources and still
need 'self-cert' that rely on out-of-band distribution channel that is the
same as
that of the 'pre-shared' key,
than take out cert and PKI will skim much more :-)
--- David
----- Original Message -----
From: "Steven M. Bellovin" <smb@research.att.com>
To: "Henry Spencer" <henry@spsystems.net>
Cc: "david chen" <ietf_davidchen@hotmail.com>; <ipsec@lists.tislabs.com>
Sent: Wednesday, November 28, 2001 9:08 AM
Subject: Re: SOI: identity protection and DOS
> In message <Pine.BSI.3.91.1011128081445.25421C-100000@spsystems.net>,
Henry Spe
> ncer writes:
> >On Wed, 28 Nov 2001, david chen wrote:
> >> I try to say that
> >> if self-signed certs depend on the out-of-band 'secured channel' that
> >> is used the same as pre-shared key for its key management,
> >> then why not just use pre-shared key? and save the trouble for
> >> public/private keys.
> >> Don't see the advantage of using 'self-cert' over 'pre-shared' in this
case.
> >
> >At least three advantages:
> >
> >1) Self-certs need not be kept secret to be usable. So the channel used
> >to verify them must be authenticated but need not be private, they need
> >not be stored in secure storage, etc.
> >
> >2) No requirement to have a separate self-cert for each connection; one
> >per host suffices.
> >
> >3) Uses much the same mechanism as PKI certificates, so there is no need
> >to have a different variant of the protocol (different analysis and
> >verification, different code, etc.) for them.
>
>
> 4) We don't need a key exchange protocol capable of coping with both
> certificates and shared secrets.
>
> --Steve Bellovin, http://www.research.att.com/~smb
> Full text of "Firewalls" book now at http://www.wilyhacker.com
>
>
>
References: