Subject: [NSIS] addressing / discovery

From: Tschofenig Hannes <[email-masked]>
Date: Tue, 25 Feb 2003 14:15:53 +0100

hi all

the terminology used in our previous discussion lead to some confusion.
hence i will try it again:

a) avoid the combination of signaling message delivery and discovery
messages

if it is a true discovery message then it is very difficult to secure the
content of the signaling messages. the purpose of discovery is to find the
next NSIS node. if you do not know this next peer then you cannot provide
iron-clad security protection for it. 

existing security protocols such as IPsec, TLS, Kerberos, etc. cannot be
used. 

b) end-to-end addressing of signaling messages

if signaling messages are addressed end-to-end (although the next peer is
known) the usage of existing security mechanism is prevented to a large
extend (e.g. IPsec). in context of ipsec handling i described the reason
some time ago. for tls usage the reason is obvious. 

conclusion:
- separate signaling message delivery from discovery
- allow existing security protocols to be used (i.e. peer-to-peer addressing
of signaling messages)

ciao
hannes
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis