[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Confirm decision on identity handling.

To: EKR <ekr@rtfm.com>
Subject: Re: Confirm decision on identity handling.
From: Paul Hoffman / VPNC <paul.hoffman@vpnc.org>
Date: Thu, 15 May 2003 08:43:06 -0700
Cc: Gregory Lebovitz <Gregory@netscreen.com>, "Scott G. Kelly" <scott@airespace.com>, ipsec@lists.tislabs.com
In-Reply-To: <kjaddorzxc.fsf@romeo.rtfm.com>
References: <541402FFDC56DA499E7E13329ABFEA87E66D8E@SARATOGA.netscreen.com><kj65oc8iw2.fsf@romeo.rtfm.com> <p0521061bbae95ab471b9@[63.202.92.152]><kjel30s0wc.fsf@romeo.rtfm.com> <p0521061dbae95e654f37@[63.202.92.152]><kjaddorzxc.fsf@romeo.rtfm.com>
Sender: owner-ipsec@lists.tislabs.com

At 8:29 AM -0700 5/15/03, Eric Rescorla wrote:
>  > You could have a security policy that ignored the identity in the cert
>>  ("allow an SA with these restrictions to anyone who has a cert from
>>  XYZRoot"), or one that was identity-based ("let chris@example.com make
>>  an SA").
>But you would presumably want to have some restrictions
>on the IP addresses they were allowed to front for, right?

Sure.

--Paul Hoffman, Director
--VPN Consortium

References:
- RE: Confirm decision on identity handling.
  - From: Gregory Lebovitz <Gregory@netscreen.com>
- Re: Confirm decision on identity handling.
  - From: Eric Rescorla <ekr@rtfm.com>
- Re: Confirm decision on identity handling.
  - From: Paul Hoffman / VPNC <paul.hoffman@vpnc.org>
- Re: Confirm decision on identity handling.
  - From: Eric Rescorla <ekr@rtfm.com>
- Re: Confirm decision on identity handling.
  - From: Paul Hoffman / VPNC <paul.hoffman@vpnc.org>
- Re: Confirm decision on identity handling.
  - From: Eric Rescorla <ekr@rtfm.com>

Prev by Date: Re: Confirm decision on identity handling.
Next by Date: RE: feedback on algorithms-00
Prev by thread: Re: Confirm decision on identity handling.
Next by thread: Re: Confirm decision on identity handling.
Index(es):
- Date
- Thread