Re: [saag] Fwd: I-D Action: draft-iab-identifier-comparison-05.txt

I read this document, and I am missing the issues around lifetime of identifiers. Arguably they do not affect the comparison procedures, but they do have an interesting impact on the choices of identifiers and their usage. The classic example is what happens when Bob Miller leaves the Example company, which then hires Bob Smith. Both, at different time, get control of the email address bob@example.com. Clearly they will get different certificates, public keys and the like. However, the new certificates will validate against old access control list, giving Bob Smith access to whatever was allocated previously to Bob Miller.

There are of course similar issues with IPv4 addresses being reallocated via DHCP.

________________________________________
From: saag-bounces@ietf.org [saag-bounces@ietf.org] on behalf of Russ Housley [housley@vigilsec.com]
Sent: Sunday, October 21, 2012 7:37 AM
To: IETF SAAG
Subject: [saag] Fwd: I-D Action: draft-iab-identifier-comparison-05.txt

This document is in the final stages.  If you have last minute comments, please send them to iab@iab.org very soon.

Russ

> From: internet-drafts@ietf.org
> Date: October 20, 2012 7:19:31 PM EDT
> To: i-d-announce@ietf.org
> Cc: iab@iab.org
> Subject: [IAB] I-D Action: draft-iab-identifier-comparison-05.txt
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Internet Architecture Board Working Group of the IETF.
>
>       Title           : Issues in Identifier Comparison for Security Purposes
>       Author(s)       : Dave Thaler
>       Filename        : draft-iab-identifier-comparison-05.txt
>       Pages           : 23
>       Date            : 2012-10-20
>
> Abstract:
>   Identifiers such as hostnames, URIs, and email addresses are often
>   used in security contexts to identify security principals and
>   resources.  In such contexts, an identifier supplied via some
>   protocol is often compared against some policy to make security
>   decisions such as whether the principal may access the resource, what
>   level of authentication or encryption is required, etc.  If the
>   parties involved in a security decision use different algorithms to
>   compare identifiers, then failure scenarios ranging from denial of
>   service to elevation of privilege can result.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-iab-identifier-comparison
>
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-iab-identifier-comparison-05
>
> A diff from the previous version is available at:
> http://www.ietf.org/rfcdiff?url2=draft-iab-identifier-comparison-05
>
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>

_______________________________________________
saag mailing list
saag@ietf.org
https://www.ietf.org/mailman/listinfo/saag