RE: Thoughts on identity attacks

["Andrew Krywaniuk" <andrew.krywaniuk@alcatel.com>]

Hi Paul,

I think the passive attack is the most important. Against an active attack,
it would be nice for the initiator's id to be protected in in road-warrior
cases and the responder's id to be protected otherwise.

I don't agree with obfuscating the certificate contents as a means of
identity protection. The data in the certificate is there for a reason (at
least some of it).

William brought up a good point at the IETF, which is that even a cert
request for a specific CA can leak important information. A hacker could go
around looking for cert requests from a specific CA in order to target
employees from a specific company.

BTW, If you're wondering why your original posting didn't get many answers,
it's probably due to its length. For whatever reason, long/dense messages
tend to get fewer responses.

Andrew
-------------------------------------------
There are no rules, only regulations. Luckily,
history has shown that with time, hard work,
and lots of love, anyone can be a technocrat.