Subject: Re: [IPsec] IPsec maintenance/extensions WG?

From: Ana Kukec <[email-masked]>
Date: Wed, 23 Apr 2008 11:40:30 +0200

He Steve,

Stephen Kent wrote:
>
> Can you describe how the proposed CGA approach is better than the
> ongoing work in BTNS. My understanding of the CGA proposal is that it
> would allow each peer to verify that the other was using a randomly
> asserted IPv6 address, as asserted in IPv6 packet headers.  This does
> not strike me as useful for access control, beyond what BTNS could do.

The main disadvantage of BTNS over CGA + IKEv2 is that BTNS lacks for a
way to avoid a leap of faith. BTNS takes benefit from the lack of
authentication, contrary to CGA + IKEv2. The idea of CGA + IKEv2 is to
ensure secure initial authentication, eg. a way to avoid a leap of faith.

Ana
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Wed, 23 Apr 2008 09:03:05 -0400

>ensure secure initial authentication, eg. a way to avoid a leap of faith.

Ana,

Thanks for the quick response.  I'm afraid I am puzzled by your 
answer; let me explain.

My understanding of the procedure is that first time a host uses a 
CGA in an IKE SA, the peer would not have any basis for mapping that 
CGA to another form of ID. Thus this seems like LoF to me. 
(Moreover, an initial motivation for CGAs was to enable a host to use 
different addresses, either serially over time or in parallel, e.g., 
to hinder traffic analysis. If one adopts that use model, a CGA is 
not a persistent ID, and thus would be worse than a BTNS-based LoF 
model.)

Steve