Re: addresses and IKEv2

[Alex Alten <Alten@attbi.com>]

Steve,

Whom are you kidding?  Just because *you* don't change a DNS name bound
to a machine for 18 months doesn't mean that Yahoo doesn't on-the-fly
direct your HTTP post to one of 50 different servers depending on query
loads, etc.  When one designs a system one has to account for many
types of usage.  But at the same time you have to decide what to not
support.  For example should IPsec identify either a user or a host?
I would argue that only a host, and possibly a port, should be
identified, since IPsec is operating between the routing and transport
layers.

For you it may be simple to juggle multiple types of addresses (DNS, IP,
email, whatever). But to establish and manage IPsec sessions reliably
across millions of machines and tens of thousands of organizations, day
after day, year in and year out, with software written by hundred's of
protocol programmers in many companies and countries, is in practice a 
nightmare. It took 3 years for the industry to be able to interoperate
with 3DES, some firms had to go through certification half a dozen times.
Is that what you want the industry to go through again by requiring
multiple ways of addressing hosts? To be successful, IPsec needs a simple
way to retrieve the key that actually does the work of authenticating the
host.  Neither DNS nor IP address are designed to do this well, they do
their respective existing jobs only too well.

Neither an IP address nor a DNS name will work because they are too
ephemeral.  Binding them into a certificate is just a snapshot of a
transient address to host key binding. All it does is introduce more
complexity, with certs littered about containing outdated host addresses,
not to mention yet another interoperability headache with certificate
authorities, revocation lists, etc.

BTW, quit asking for a definition of "security".  You know damn well it's
self referential.  It's like asking for a definition of "money" or "time".

For that matter, so is the definition of an IPsec host "address".

- Alex


--

Alex Alten
Alten@ATTBI.com