Subject: Re: [Int-area] Name based sockets

From: Brian E Carpenter <[email-masked]>
Date: Mon, 02 Aug 2010 16:34:11 +1200

Hi,

One obvious comment is that the lack of a security analysis is very
noticeable. I can certainly imagine on-path attackers having fun by changing
the piggybacked names in the initial phase, and of course the dynamic
DNS update proposed in the mobility scenario must be secure.

I think we need a pretty serious review by the shim6 experts, but that should
happen on the shim6 list IMHO. Actually, I don't see how NBS can work usefully
in practice without something like REAP to detect connectivity failures.

Did you consider HIP identities or HITs as another namespace to be supported?

This solution doesn't deal with all the issues of third-party referrals,
as far as I can see. That's a more complex discussion which we will try
to pick up in draft-carpenter-referral-ps.

Finally you don't refer to Christian Vogt's work. Sadly there is no I-D
on that, but there is a good writeup:
http://christianvogt.mailup.net/pub/vogt-2009-name-based-sockets.pdf

   Brian

On 2010-07-27 05:47, Javier Ubillos wrote:
> Name Based Sockets
> Draft: http://www.ietf.org/id/draft-ubillos-name-based-sockets-01.txt
> Presentation:
> http://www.sics.se/~jav/ietf78/namebasedsockets-IETF78-apps.pdf
> 
> Consider it a real "request for comments", because I do want comments.
> 
> Please note, that we inpractice presented two distinct things.
> A. Name based sockets.
> B. An improvement to shim6 (which is only possible using names)
> 
> I'll try to briefly address some of the questions I remmember:
> 
> * There are already solutions for all these problems
> Yes, they are, and we want to help to deploy all those cool things.
> 
> * We should not require changes to applications
> I'm not convinced, however, there are already several solutions that do
> do this with surrogate/pseudo IPs.
> Actually, nothing says that we couldn't do both.
> Name based sockets is just an API to pre-existing cool solutions.
> 
> * What is a name?
> My spontaneous answer is that a name is eiter just a session identifier,
> or that it both that and an identifier for a particular ... something.
> 
> 
> That's all I remmember offhand...
> 
> // Javier
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Int-area mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/int-area