On Mon, Sep 21, 2009 at 11:57 PM, Jeffrey I. Schiller <[email protected]> wrote: > On Mon, Sep 21, 2009 at 06:49:26PM -0400, Christopher Morrow wrote: >> sure, and as it happens you can also have more than one certificate >> for mozilla.com .... which is 'bad'. > > Exactly how is this bad? Sure for S/MIME encryption you need to know
which www.mozilla.com did you visit? (substitute microsoft.com for updates or bank-of-boston.com for banks..) Yes, there should be more/better authentication from server to client (and vice versa) but today as a client you don't know... anyway this isn't super helpful in the route-object world, I don't think. > which certificate to encrypt a message for (though you could do it for > all of them if the number was reasonable). However for authentication > you can have many certificates with the same DN. It works just fine. I > should know, I run the PKI for MIT and on the client side people have > one certificate per computer in general (because getting one on each > computer is easier then having them figure out how to export the > certificate as a pkcs12 object and import it to the other > browser). Yes, we use X.509 certificates for client authentication. hurray :) >> I'm not sure that's the case, since I can go to startssl.com and get a >> cert for free that's good for 1yr and doesn't raise exceptions in +98% >> of the user base... or I can go to verisign get the same thing for >> 1k$. I'm also not sure that the web-ca world tracks at all well with >> the routing-ca world. > > Your statement proves my point about competition. If it weren’t for > competition you would not have the option of getting one for free, or > even cheap! yes, example-fail :( sorry about that. I'm still not sure that the DNS world makes a good example for routing. >> Is some of the concern here legacy space being pulled under 'RSA' by >> hook/crook? Could that be 'fixed' by IANA issuing certs to legacy >> address holders as that's likely the closest thing to the NIC that >> exists today and doesn't REALLY have the ability to enforce RSA-like >> restrictions as an RIR would? > > Or we can just have a pseudo-RIR for the legacy space (pseudo because > it doesn’t allocate any new space, just keeps track of the old). Sure, IANA was a simple guess on my part, a pseudo-RIR seems fine to me. Was the legacy space holder problem the only problem you had with the RPKI as it's been discussed? (and a psuedo-RIR would satisfy your concerns I think, right?) -Chris > -Jeff > > -- > ======================================================================== > Jeffrey I. Schiller > MIT Network Manager > Information Services and Technology > Massachusetts Institute of Technology > 77 Massachusetts Avenue Room W92-190 > Cambridge, MA 02139-4307 > 617.253.0161 - Voice > [email protected] > ======================================================================== > _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
