Subject: RE: [RPSEC] Re: no TCP-MD5 replacement please

From: "Bora Akyol" <[email-masked]>
Date: Tue, 7 Feb 2006 14:06:47 -0800

> >With IPSec and IKE the keys could well be public-key 
> certificates valid 
> >for year(s)[1]. Expiry would be known *well* in advance and could be 
> >done well in advance as part of planned maintenance, without 
> >co-ordination.
> 
> I'm all in favor of that approach, although it does imply the 
> capability to process certs.
> 

If we decide to go the way of certs, I think we need to make sure
that we don't end up with a serious bootstrapping problem.

That is, 

1) Need network to validate cert
2) Need validated cert to get the network going
3) Go to step 1

I do not think the capability to process certs is especially
difficult to add to a box that is capable of running BGP.

For the bootstrap problem, I guess we could use a model similar to
SSL certs as they exist in browsers today.

There was quite a bit of talk about this a while back on this list, I
think.

Regards

Bora

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stephen Kent <[email-masked]>
Date: Wed, 8 Feb 2006 10:14:30 -0500

Bora,

Good observation re the potential circularity.

However, with appropriate caching it is not always necessary to use 
the net to access data for cert validation. Cert chains and OCSP 
responses or CRLs can be passed between peers, for example, to avoid 
the need to retrieve this data from repositories. With reasonable 
parameters for the required "freshness" for revocation status data, 
this should all be manageable.

Steve