Subject: RE: The state of IPv6 multihoming development

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 30 Oct 2002 21:53:05 +0100

> > And you need a protocol to pass around the translation 
  > mappings to the
  > > other end so they can undo it. When the other end is a 
  > foreign network,
  > > why should they trust or accept the origin site?
  > 
  > If the level of trust is zero to begin with, there should 
  > be no problem
  > extending this "trust" so a third party.

=> Is this an argument for global PKI? Presumably
this protocol would work between arbitray sites?

  > 
  > However, there may be some unexpected cases. For instance, 
  > an untrusted
  > host tries to bind a trusted address to the connection and 
  > then inherits
  > the higher level of trust. I'm sure we can work all of this out when
  > there is something concrete on the table.

=> I don't think this will be a trivial task. 
Especially when you're aggregating the updates
to handle large prefixes (instead of updating 
each address at a time).

Hesham

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 30 Oct 2002 22:58:57 +0100 (CET)

On Wed, 30 Oct 2002, Hesham Soliman (EAB) wrote:

>   > be no problem extending this "trust" so a third party.

> this protocol would work between arbitray sites?

No, this is an argument for not building elaborate security mechanisms
when there is nothing to secure. If someone who I don't know visits my
web site or connects to my mail server, and then halfway through the
session the connection is transferred to another IP addres, why would I
care? The only time this is dangerous would be when I communicate with a
trusted host but if this trusted host tells me it has another address
then presumably, I should trust this information as well. Obviously
things are different when someone at an address I don't know tells me
she is a trusted host. Then she has to present credentials.

>   > I'm sure we can work all of this out when

> => I don't think this will be a trivial task.

No, but that doesn't mean we have to start with this part.  :-)

Iljitsch