Subject: Re: [RPSEC] Potential requirements

From: [email-masked]
Date: Wed, 13 Nov 2002 07:53:24 -0500 (EST)

>Just because a device signs something as actually originating
>from the device itself, it doesn't prove the device is authorized
>to transmit that reachability information.

Actually, I'm pretty familiar with the RFC 2154 :-)

You missed the part about the router's public key being signed by
some trusted entity in a public key lsa that includes info on
what roles the router is allowed to use (ABR, ASBR, etc.) and what
network addresses it is allowed to advertise.  The PKLSA also authorizes
the router to produce LSA's with that router ID, obviously.

So exactly the authorization info you are requesting is already
in the RFC and was one of the major points of the RFC.

I'm glad you agree with the need for authorization of routing
information.

--Sandy
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Wed, 13 Nov 2002 07:56:05 -0500 (EST)

> Actually, I'm pretty familiar with the RFC 2154 :-)

I know. :-)

> I'm glad you agree with the need for authorization of routing

Definitely, I'm just trying to make certain that we draw that
out, and that it's addressed in varioud docs we work on here,
since it (kindof) looked like we were loosing the distinction
between authorization and authentication.

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone