Re: Confirm decision on identity handling.

[Eric Rescorla <ekr@rtfm.com>]

Michael Thomas <mat@cisco.com> writes:

> Eric Rescorla writes:
>  > Michael Thomas <mat@cisco.com> writes:
>  > > Or something like this. Note that this doesn't
>  > > have anything to do with the *IKE* identity, it's
>  > > completely a property of the SA and its filters
>  > > that were derived from the policy which matched
>  > > for the mode and identity. It does, however,
>  > > enforce the property that you desired above,
>  > > especially when combined with the fact that you
>  > > need several round trips which establish that that
>  > > entity is, in fact, reachable at the outgoing
>  > > address.
>  > You must be joking.
>  > 
>  > What, you've never heard of active attacks? IP spoofing?
> 
> Yeah, yeah, and the application starting the TCP
> connection got that IP address from DNS which
> isn't secure either.
What, you've never heard of DNSSEC?

>  > Much of the purpose of the exercise is to protect ourselves
>  > from people who can arbitrarily manipulate the IP packet
>  > delivery service.
> 
> IPsec is an authenticated ACL traversal mechanism
> not a miracle worker. It raises the bar
> substantially, but there's a security/convenience
> tradeoff that needs to be allowed. Tying
> identities to routing tags has a substantial
> number of drawbacks and leads us down some rather
> unfortunate paths taken to its logical ends. Like,
> oh say, ICAAN doling out IP address ownership
> certificates. Ick. We also need to account for
> deployability and unintended consequences.
Strangely enough, this has worked just fine for TLS.


-Ekr

-- 
[Eric Rescorla                                   ekr@rtfm.com]
                http://www.rtfm.com/