Subject: [Mip6] [issue20] Add reference to pki4ipsec

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 06 Apr 2005 22:13:02 +0000

New submission from Vijay Devarapalli <[email-masked]>:

Francis wrote:

Another issue is the total lack of implicit or explicit references to
the pki4ipsec work...

=> IMHO the most of the text is relevant, for instance 3.1.1
   o  the administrator intends the implementation to verify that the
      peer source address matches the IP address in the ID received, and
      that in the iPAddress field in the peer certificate's
      SubjectAltName extension.
...
   In addition, implementations MUST be capable of verifying that the
   address contained in the ID is the same as the peer source address,
   contained in the outer most IP header.  If ID is one of the IP
   address types, then implementations MUST perform this verification by
   default.  If this default is enabled, then a mismatch MUST be treated
   as an error and security association setup MUST be aborted.  This
   event SHOULD be auditable.  Implementations MAY provide a
   configuration option to (i.e.  local policy configuration can enable)
   skip that verification step, but that option MUST be off by default.
   We include the "option-to-skip-validation" in order to permit better
   interoperability, as today implementations vary greatly in how they
   behave on the topic of verification of source IP.

So in your draft section 5.2 the first option should not be recommended
(i.e., it should be used only when the two (and far better) others are
not available).

----------
category: Technical
draft: draft-ietf-mip6-ikev2-ipsec
messages: 68
nosy: vijay
priority: Must fix
status: Text proposed
title: Add reference to pki4ipsec

_________________________________________________
Mip6 issue tracker <[email-masked]>
<http://www.mip4.org/issues/tracker/mip6/issue20>
_________________________________________________

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6