[anonsec] btns at ietf66

[Nicolas.Williams at sun.com (Nicolas Williams)]

On Wed, Jun 28, 2006 at 06:07:31PM -0400, Michael Richardson wrote:
> Nico and I have formulated a clearer statement of a problem that BTNS
> will introduce to gateways that think that they have a workable global PKI.

More specifically, in the process of fleshing out detailed examples
including detailed PADs and SPDs we figured out how to describe the
IPsec wildcard PAD entry problem, and that multiple wildcard PAD entries
have more security considerations than a single wildcard PAD entry at
the end of a PAD.

The problem can be addressed in several ways, though it isn't fully
explored in the draft we submitted.

> It needs perhaps 15 minutes to explain, and I will try to write an email to
> the list outline the issue, and maybe some diagrams ahead of time.

Yes, we'll have some materials to present on this.

Nico
--