Re: Confirm decision on identity handling.

[Paul Hoffman / VPNC <paul.hoffman@vpnc.org>]

At 11:19 PM -0400 5/18/03, Michael Richardson wrote:
>     VPNC> You could have a security policy that ignored the identity in the
>     VPNC> cert ("allow an SA with these restrictions to anyone who has a cert
>     VPNC> from XYZRoot"), or one that was identity-based ("let
>     VPNC> chris@example.com make an SA").
>
>     >> What would be the point of using an ID payload if you didn't
>     >> care what was in it?
>
>     VPNC> There isn't one.
>
>   The parties involved are not the same. You guys keep flipping between
>"VPN" and "two random parties" in your discussion.

Sorry, but that's not true at all. I have consistently been talking 
about VPNs. (No surprise there.) In this thread, it seems like you're 
the one who is consistently speaking about "two random parties". (No 
surprise there, either.)

As shown above, a VPN with certificates where the receiving party 
doesn't know or care about the specific identity of the sending party 
can still let the sending be part of a VPN on the receiving party's 
system. These are not random parties.

--Paul Hoffman, Director
--VPN Consortium