Re: [P2PSIP] Re: HIP pros and cons

[Ali Fessi <[e-mail]>]

Hi David,

David Barrett wrote:
> Just curious, if my laptop gets stolen, will P2PSIP provide any facility for
> me to prevent the thief from making and receiving calls in my name?

Once you have a certificate that you have received from the enrollment 
server, you can protect the private key that belongs to the certificate 
with a password on your local machine.

So nobody will be able to steal your identity (well, except with a 
dictionary attack on your password).

You don't need to contact one of the login servers here, except for 
verifying whether a peer certificate is in the revocation list. 
Certificate revocation is indeed a problem.


Cheers,
  Ali

> If so, how will that be done without a 24/7 realtime check to either a
> centralized or federated server?
> If we assume there's some kind of password, then that means there's some
> sort of password check.  If we assume we can ban clients, then we need to
> somehow record which clients are banned and check that.  If we can revoke
> certificates, then there's a certificate revocation list.
> 
> Is there any way to support this seemingly obvious requirement -- the
> requirement that I can prevent a thief from forever, undetectably
> impersonating me -- without some sort of central, realtime, 24/7 lookup?
> 
> Or is the answer "to be determined" or "not our problem; we punt this to
> another layer"?
> 
> -david


_______________________________________________
P2PSIP mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/p2psip