Re: [secdir] [saag] Interest in draft-dong-savi-cga-header-03.txt; possibility of a five minute slot at saag?

[Stephen Kent <[e-mail]>]

At 4:14 AM -0400 7/29/10, Sam Hartman wrote:
>  >>>>> "Stephen" == Stephen Kent <[e-mail]> writes:
>
>     Stephen> I agree that the primary motivation for CGAs arose in the
>     Stephen> SeND context, and that privacy is an independent
>     Stephen> feature. But, the context in which CGAs were intended to
>     Stephen> provide an ability to establish a binding to an IPv6
>     Stephen> address was local. When one moves beyond this local
>     Stephen> context, and one advocates having more distant nodes
>     Stephen> challenge a host, this creates privacy questions.
>
>I think we've been looking at CGAs that have non-local scope for a
>while.  Section 7.4 of RFC 3972 seems to anticipate CGAs used with other
>protocols.  It's my understanding that shim6 supports both HBAs and CGAs
>for non-local contexts.  I also believe the MIP6 context for CGA use is
>non-local.

I don't know about MIP6, but when I read the second paragraph of 
section 7.4 in the CGA RFC, I get a different impression. The fact 
that the paragraph begins with "Finally, a strong cautionary note has 
to be made about using CGA signatures for purposes other than SEND." 
suggests to me that the authors anticipated that others might want to 
use CGAs elsewhere. They provided a list of comments about why CGAs 
were designed for and well-suited to the SeND context (which is 
local), and warnings about the limitations that arise if one tries to 
use CGAs elsewhere.

Steve