[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: SOI QUESTIONS: 2.1 Identity protection questions?



On Thu, Jun 20, 2002 at 02:58:08PM +0300, Ari Huttunen wrote: I'm a
> bit uneasy with this. Having this capability opens up a security
> risk, either by someone forging this 'reversal' packet, or by some
> very popular server turning that 'reversal' feature on. It also
> implies a user-interface option for the client: allow/disallow
> 'reversal'. No user's going to understand that option.

Well, I was thinking config-option where "reversal" was off by default.  

One of the interesting questions which is hiding here is what sort of
validation and authorization checks "client" on the cert chain?  Will
it be the https/SSL-style checks where there is a set of "trusted
roots" for which the browser will ask no questions, and the name
embedded in the certificate must be a DNS name (hidden inside the
e-mail name component of the x.509 cert) which must match what the
client thought it was connecting to?  Or will it be something else?

> A better way to protect a responder's identity is to assign that responder
> some pseudo-identity that's no use for the attacker. A pseudo-identity will
> protect the identity against valid inititators also.

How are you assuming the the pseudo-identity would be constructed?  If
we're assuming certificates, will it just be a self-signed
certificate?  In any case, the above question about how should the
initiator decide whether or not to trust this certificate becomes
highly relevant.  Even if it is issued by some CA (at $29.95 a pop)
with some bogus name, so that its pedigree can be checked, the name in
the certificate needs to be relevant enough so that the initiator will
accept the name.  (One of the other problems here is that in the case
of a home server behind a cable modem, the user may not have a valid
ip address or dns server name.)

						- Ted