[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Choosing between IKEv2 and JFK
Michael Thomas <mat@cisco.com> writes:
> Huh? The certs are only there for identity. If I
> want to have two different SA's so I get differential
> queuing treatment, there's nothing that says that I
> need two different identities. I just change the
> traffic selectors. This isn't any different than
> RSVP flow selectors and queuing treatment.
No, in reality the certs are there for authorization. It's just that
people don'e understand the concept of capabilities, so we have this
ad-hoc "identity" cert and map it via some local lookup method to a
set of capabilities.
You receive an "identity" cert, validate the cert, validate that the
message is authentic using this cert, and then you lookup the
capabilities of this "identity" to validate the authorization for the
requested operation.
In terms of different flow selectors, it is perfectly reasonable to
say that each flow requires its own certificate specifying the
capability of that particular flow. Similarly, you could specify an
"identity" that is capable of both flows.
The problem with using identity for capability verification is that
there is no way of knowing _which_ capability actually applies to any
situation. You have to depend on the user requesting the appropriate
flow characteristics, but unless there is a real-world cost associated
with that choice, what incentive does the user have?
For example, if I could use my personal cert to specify a normal
connection or a high-QoS connection and the costs to me were the same,
why wouldn't I specify the high-QoS connection all the time? OTOH, if
there were clearly different certificates for teh two capabilities,
then you could restrict access to the different certs.
Basically, I'm saying that you are both right -- you are just coming
from very different viewpoints. However neither is wrong.
> Mike
-derek
--
Derek Atkins
Computer and Internet Security Consultant
derek@ihtfp.com www.ihtfp.com