Subject: Re: [CGA-EXT] Router Certificate in SEND

From: "Jean-Michel Combes" <[email-masked]>
Date: Wed, 18 Jun 2008 19:31:27 +0200

Hi Francis,

thanks for your reply.

2008/5/31, Francis Dupont <[email-masked]>:
>  In your previous mail you wrote:
>
>    => I have the strong feeling the authors/SEND WG didn't take the fact
>    that the key pair MUST be the same for the CGA generation and the
>    Authorization Router Certificates
>
>
> => this is not true, there is no such MUST (so for reasons you mentioned
>  it is recommended to use different key pairs).

OK.

>
>
>    Potential approaches may be (BTW, I didn't check whether that works or not):
>    - to modify RSA Signature in adding flag to precise whether the
>    signature is linked to CGA key or cert key and to add two RSA Sig
>    options (one linked to CGA and one linked to the cert) in the RA
>    instead of only one like today
>
>
> => BTW there is a key tag which gives the linked key. It is not useful
>  to CGA sign RAs as they don't validate a neighbor

Agree but a RA updates the Default Router List and so a malicious
router may want to play with the "the router is dead" attack.

>  (i.e., if the router
>  doesn't own the CGA the NS/NA exchange will fail).

But when is the NS/NA exchange?
(1) After the RS/RA (+CPS/CPS)
(2) At the same time?

What I don't understand is what is the security link between the LL
address of a router (which is used to identify it and to update the
Default Router List) and the Router Authorization Certificate when a
CGA option is not used ... :s

>
>
>    - to add a RSA Signature option in CPA messages: the RSA Sig option in
>    the RA is linked to the CGA address, the one in the CPA messages is
>    linked to the Router Authorization Certificate
>
>
> => there is no need to protect the certificate chain transport...

Agree in the case where the key used to sign the RA is the one linked
to the cert.
But what happens when the RA is also protected by the CGA option (and
so the RSA Signature option uses the CGA key)?

>
>
>    - to add the router's Link Local address in the Router Authorization
>    Certificate and the node should have to check it too.
>
>
> => this is like the use of a not-CGA by the router: can be done but
>  not in the scope of the RFC.

Agree.

>    - others solutions?
>  => reread the RFC (:-)?

This is what I am doing :)

Best regards.

JMC.

>
>  Thanks
>
>
>  [email-masked]
>
_______________________________________________
CGA-EXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/cga-ext