Subject: [anonsec] Why use self-signed certs at all?

From: Atul.Sharma at nokia.com ([email-masked])
Date: Mon Nov 22 07:33:40 2004

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of ext Stephen Kent
> Sent: Friday, November 19, 2004 5:45 PM
> To: Discussions of anonymous Internet security.
> Cc: [email-masked]
> Subject: RE: [anonsec] Why use self-signed certs at all?
> 
> 
> At 3:35 PM -0500 11/19/04, <[email-masked]> wrote:
> >  > -----Original Message-----
> >>  From: [email-masked] 
> [mailto:[email-masked]]On
> >>  Behalf Of ext Nicolas Williams
> >>  Sent: Friday, November 19, 2004 2:21 PM
> >>  To: Discussions of anonymous Internet security.
> >>  Subject: Re: [anonsec] Why use self-signed certs at all?
> >>
> >>
> >>  On Fri, Nov 19, 2004 at 02:11:59PM -0500, 
> [email-masked] wrote:
> >>  >
> >>  > I agree self signed certificates provide no more trust than
> >>  > a secret and increase the complexity.
> >>  >
> >>  > If the secrets have life-time then SAs can be 
> reestablished during
> >>  > its lifetime....same as during a cert's lifetime.
> >>  >
> >>  > Besides, I do not feel that a use of self-signed certs 
> forces BTNS
> >>  > into PKI4IPSEC realm. Self-signed certs is not PKI, so why force
> >>  > BTNS into a PKI-specific work? It sounds bizarre to me.
> >>
> >>  First, the proposal from Sam was to re-charter PKI4IPSEC, 
> so please
> >>  let's stop arguing over whether its charter fits BTNS or 
> not -- if we
> >>  agree to place BTNS there then the charter *will* fit it.
> >>
> >>  Some reasons: overlap of attendees, cost to the IETF of 
> spinning up a
> >>  new WG, risk of scheduling conflicts, etc...
> >
> >I would like to say a few things on that:
> >
> >* The cost to IETF did not seem to matter in creation of 
> PKI4IPSEC, when
> >   it could have been done under IPSEC working group. But 
> now it is an issue.
> 
> I think the IPsec WG held its last meeting before pki4ipsec started
> 

I see IKEv2 and 2401bis being worked on even after the IPsec WG
last meeting. I do not know if the WG is formally shutdown.

Why can not BTNS/Anonsec done similar to how things are/were being 
done for 2401bis and IKEv2?

IMO, BTNS is more about "unauthenticated IPsec", than (if you will)
"self-maintained PKI". The latter can be *one* way of acheiving
unauthenticated IPsec.

Atul

---

From: touch at ISI.EDU (Joe Touch)
Date: Mon Nov 22 07:48:15 2004

[email-masked] wrote:
...
> done for 2401bis and IKEv2?

<BOF chair hat on>

2401bis and IKEv2 were presented when the IPsec WG was meeting. 
Introducing new documents isn't possible after the WG stops meeting, but 
continuing the final phases (rounds of last call) is, as far as In 
understand IETF process ;-)

Joe

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 254 bytes
Desc: OpenPGP digital signature
Url : http://www.postel.org/pipermail/anonsec/attachments/20041122/9f11cf2e/signature.bin

---

From: kent at bbn.com (Stephen Kent)
Date: Mon Nov 22 08:45:35 2004

>last meeting. I do not know if the WG is formally shutdown.

work is still being completed, but there are no more meetings which 
is what I said in my message.

>done for 2401bis and IKEv2?

this analogy makes no sense to me. the final work on IKEv2 and 
2401bis  was done after the WG ceased to meet, but by the same people 
and on the same mailing list that was used before the WG stopped 
meeting.

>"self-maintained PKI". The latter can be *one* way of acheiving

When we have an agreed upon charter, we can state more clearly what 
BTNS is about, but yes, self-signed certs are just one approach.

Steve

---

From: hartmans-ietf at mit.edu (Sam Hartman)
Date: Mon Nov 22 13:55:37 2004

>>>>> "Joe" == Joe Touch <[email-masked]> writes:

    Joe> [email-masked] wrote:
    Joe> ...
    >> Why can not BTNS/Anonsec done similar to how things are/were
    >> being done for 2401bis and IKEv2?

    Joe> <BOF chair hat on>

    Joe> 2401bis and IKEv2 were presented when the IPsec WG was
    Joe> meeting. Introducing new documents isn't possible after the
    Joe> WG stops meeting, but continuing the final phases (rounds of
    Joe> last call) is, as far as In understand IETF process ;-)

Your understanding of IETF process is incorrect.  You can create a new
working group that never meets, takes on new work and gets that work
done.  I believe the NNTP extensions working group never meets but is
fairly productive.

As a practical matter meetings are useful, so we want the btns work to
progress in a forum where meetings are possible.