<without hats> At 5:30 PM +0200 3/3/09, Tero Kivinen wrote: >pasi.ero...@nokia.com writes: >> I have one somewhat substantial concern with the document: it needs to >> be much clearer about what information is updated by the received >> REDIRECT messages, and what is not. > >Never really thought that issue. I myself assumed that both GWs are >identical, i.e. they return same ID, and use same authentication data >(i.e. if PSK, both use same PSK, if certs, both authenticate against >same trust anchor and use same identity in cert, but not necessarely >same private key).
I think both views are reasonable, but the document must be much clearer about which is being discussed. If it is the former, the doc should also explicitly say that the latter is an acceptable setup. > > One possible answer would be that REDIRECT is interpreted just as data >> received from DNS, so all the gateways (redirecting among each other) >> would send same IDr value. > >I think this is the easiest way to make sure redirect is secure. I initially didn't agree with this idea, but I can see how it would make the security properties much easier to define. However, I don't think that was the intention of the current document. --Paul Hoffman, Director --VPN Consortium _______________________________________________ IPsec mailing list IPsec@ietf.org https://www.ietf.org/mailman/listinfo/ipsec
