RE: Adding revised identities to IKEv2

[Tero Kivinen <kivinen@ssh.fi>]

Max Pritikin writes:
> Your previous statement,
> >>> The other end doesn't really need a certificate it needs a public key
> and it needs it to be trusted somehow.
>               ^^^^^^^
> is the difference. The particular certificate matters because the 'somehow'
> is to use the binding and identifying information in the certificate to
> determine the appropriate policy.

Certificate is not the only way the public key can be trusted. For
example you could preconfigure the public key to the system (i.e the
sgw have database of all public keys and what they are authorized to
do with those keys). Or it might be internally use pgp-keys, dns
record or ...
-- 
kivinen@ssh.fi
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/