Re: [karp] Comments to draft-chunduri-karp-kmp-router-fingerprints-01.txt

[Uma Chunduri <[e-mail]>]

Hi Tero,

Thanks for the comments.
Response In-line [Uma]:

====

 
In section 3.1 the draft says:

-- [Snip]

   This document does not mandate support for any other authentication
   methods, although such methods MAY be employed.

[Uma]: Agree. I missed this part.

I.e. it is completely possible to use just raw public keys, and store the actual fingerprint of public key to the PAD and use that when verifying the other ends authentication credentials. I would actually assume all implementations supporting raw public keys does something like that already.
I.e. the pad contains that other peer should authenticate himself using the public key that has hash of xxxx, and when the peer connects and identifies itself through ID payload and sends raw public key inside the certificate payload, the implementation will calculate hash of that public key and verify that it matches the one stored on the PAD. If they match, then peer is authenticated.

[Uma]: As I indicated in the meeting we will change the text to reflect this.  


BTW, to revoke the compromized key you simply need to remove the hash from the PAD, which do require you to update the PAD of all possible routers where this one router was talking to. Quite often those configurations are already pushed to routers by some kind of managament tool, so it is completly possibly to do this kind of things quite easily.

[Uma]: Absolutely. We thought this and you mentioned this quite correct here. Thank you.