Re: HIT and ACLs (was Re: [Int-area] Progress on draft-laganier-ipv6-khi-01.txt

> There is a section in the IRTF NSRG report that describes this issue:
> 
>    "Additionally, HIP raises an issue regarding other uses for
>    aggregation of IP addresses.  Today, they are not only aggregated for
>    purposes of reduced routing, but also for reduced administration.  A
>    typical access list used on the Internet will have some sort of a
>    mask, indicating that a group of hosts from the same subnet may
>    access some resource.  Because the value of a HIT is a hash in part,
>    only the administratively assigned value can be aggregated,
>    introducing an allocation limitation and authorization concerns."
> 
> But in practice today, there is a similar lack of aggregation in ssh
> key-based access controls.  I think it depends on what you are
> trying to accomplish with the ACL.  If you really want to write ACL
> policies based on address prefixes, then continue to do so, but if
> you want to do it based on host identifiers, then I agree that
> either they would need to be enumerated or there would need to be
> some structure added for aggregation (as well as some means to
> authenticate that the host is authorized to use those structured id
> bits).

But a bare HIT which happens to have some prefix does not imply that
it was created with the permission of the authority that controls the
reverse mapping for that prefix.  Seems like you need to do an on-line
lookup or have a full blown certificate anyway.  In that case, there's
no value (that I can see) in having a prefix.

(Should this be on the hip-rg mailing list instead of int-area?)

			-Tim Shepard
			 shep@alum.mit.edu

_______________________________________________
Int-area mailing list
Int-area@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/int-area