Subject: RE: [Mipshop] HMIPv6 improvements in new list of MIPSHOP itemsfornewcharter

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 13 May 2005 12:41:11 -0400

> => Please note that no one is suggesting PKI.
 > Is there anything I can read about the difficulty of using 
 > certs on hosts?
 > Does anyone know of literature about this?
 > 
 > jak>> Again, this is more deployment experience than 
 > literature. The most
 > successfully deployed security protocol in the Internet is 
 > TLS, which does
 > not require host certificates. 

=> And when there is no host certs there is no mutual authentication!
This is how TLS is deployed today for web apps...

   We designed SEND specifically to avoid
 > requiring host certificates, based on this. And, IKEv2 included EAP
 > authentication in response to a collection of nonstandard 
 > vendor-specific
 > modifications in IKEv1 that used un/pw auth which were 
 > included in products
 > to avoid requiring deployment of PKI for configuring hosts with
 > certificates. Jari gave a presentation at MOBOPTS in Minneapolis, see
 > http://www3.ietf.org/proceedings/05mar/slides/MobOpts-1/sld1.
htm, in which
he talked about the problems of requiring host certificate deployment for
securing handover protocols.

jak>> Actually, I think this might make a good paper, along the lines of
Chapter 26 in Kaufman, Perlman and Speciner.

=> I must have an old version, mine is only 17 chapters. I'll follow
this up to get to the root of the problem. Jari's presentation is mainly
focused on authorisation, which is already handled in HMIP. I talked to
Jari about this a couple of months ago and he seemed to have a different
focus in the presentation from what you say above. I'll dig into this a bit
more cuz so far I'm not getting any sense of what this problem is about. Apart
from anecdotal evidence that it's difficult to configure..

            jak

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop