Subject: [anonsec] Proposal: we specify how to do both self-signed certs and universal non-secret

From: Atul.Sharma at nokia.com ([email-masked])
Date: Tue Nov 23 12:55:44 2004

I agree. Self-signed certs can be *one* way to accomplish the
goals of BTNS. But not the only way. Scoping out Self-signed certs
as a SHOULD and shared non-secret as a MUST, will be a more practical
approach to handle (non)adherence to PKI in IPsec implementations.

Atul

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of ext Paul Hoffman / VPNC
> Sent: Monday, November 22, 2004 6:52 PM
> To: [email-masked]
> Subject: [anonsec] Proposal: we specify how to do both 
> self-signed certs
> and universal non-secret
> 
> 
> Hi again. As I said in my previous message, I see the problem that 
> self-signed certs solve, and I agree that it is real. It will be 
> rare, but it is real.
> 
> However, I think that hitching our horse to just self-signed certs is 
> guaranteed to get us fewer implementations than we would want because 
> many IPsec stacks don't even have cert handling in them, and those 
> that do rarely interoperate. Getting the universal non-secret 
> authentication (bound to the upper layer with the DH publics) will be 
> *much* easier to get implemented.
> 
> So my proposal is that we specify both, with the universal non-secret 
> as a MUST (for greatest interop) and the self-signed certs as a 
> SHOULD (because of the rekeying problem). We tightly scope both of 
> them, and each has its own VendorID that comes in message 1 and 2 so 
> the other party knows what to do when it gets to authentication time. 
> The tight scoping and early warning on self-signed certs would allow 
> the receiver's code to use a completely different path for processing 
> than the normal cert path, thus avoiding all of the PKI4IPSEC kruft.
> 
> Thoughts?
> 
> --Paul Hoffman, Director
> --VPN Consortium
> _______________________________________________
>

---

From: sommerfeld at sun.com (Bill Sommerfeld)
Date: Tue Nov 23 13:13:42 2004

> approach to handle (non)adherence to PKI in IPsec implementations.

shared non-secret is an atrocity.