Re: [Call-home] draft now posted; BoF?

>>>>> On Tue, 27 Sep 2005 11:33:52 +0200, Eliot Lear <lear@cisco.com> said:

Eliot> In a practical sense, a service provider already provides a
Eliot> username and password to an end user.  It would seem
Eliot> impractical for the user to provide a username and password
Eliot> back to the service provider when an X.509 certificate would do
Eliot> the job.

The general issue with reversing a connection is that the order in
which you present credentials to the end other side often doesn't
work.  EG, if in a normal connection via netconf or snmp/isms you'd
get this:

    manager                 agent
    opens connection  -->                             [possibly negs encryption]
                      <--   sends host id cert
    verifies agent ID
    sends users/pass  -->    
                            verifies user/pass
                      <--   finishes open with a protocol ack

That, of course, is just an example.  The problem comes when you
reverse the connection you need to do things in the same order.  A
manager can't send their side of the credentials first when it's a
username/password since you'd be disclosing information before
verifying the other side can receive it.  Ok, you say, then just make
sure it happens in the same order and that the agent opens the
connection and immediately sends his own credentials?  Great in
theory, but the current protocols (SSH, TLS) don't do this.  They are
designed with a particular order of sending the credentials and they
all expect the model above.  Whether you can trigger them to do the
reverse is subject to a huge debate with their authors I'd think.

-- 
"In the bathtub of history the truth is harder to hold than the soap,
 and much more difficult to find."  -- Terry Pratchett

_______________________________________________
Call-home mailing list
Call-home@ietf.org
https://www1.ietf.org/mailman/listinfo/call-home