Subject: [CGA-EXT] Supporting non-CGA addresses in SEND

From: Eric Levy-Abegnoli <[email-masked]>
Date: Tue, 4 Mar 2008 15:52:42 +0100

Hello,
please find here attached a set of proposed changes to RFC3971, to support 
non-CGA adresses.
Even though non-cga addresses are touched in several places in the current 
spec, there are also may holes, left "for future work".  This proposal intend 
to fill the holes. 
On the motivation front:  
- some devices need secure handcrafted addresses, so SEND should provide 
complete specification for securing these addresses in NDP. 
- CGA brings "only" address ownership proof, while sometimes, address 
authorization is needed.  
- CGA may not be considered secure enough (due to number of crypto bits 
availabale) and a stronger scheeme is needed.

As far as the mechanism to secure non-CGA addesses, it is already suggested in 
3971. The proposed scheme use certificates, exchanged thru CPS/CPA and trust 
anchor, exactly like in Authorization Delegation Discovery.

In order to come up the text below, I have chased every place where CGA was 
required, and added the alternative to use certificates. The changes decribe 
the flow necessary to authorize addresses and establish address ownership 
with certificate. It also describes an "Address Authorization Certificate" 
Profile, and indicates its relashionship with the Router Authorization 
Certificate Profile.

Review, and comments welcome
Thank!
Eric Levy-Abegnoli
_______________________________________________
CGA-EXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/cga-ext