"Nicolas" == Nicolas Williams <Nicolas(_dot_)Williams(_at_)sun(_dot_)com>
writes:
Nicolas> Also, I think my draft's definition of "end-point channel
Nicolas> bidning" needs to be tightened just a bit: not only must
Nicolas> the end-point IDs be cryptographically bound into the
Nicolas> channel, it must also be the case that the IDs
Nicolas> meaningfully identify the channel end-points -- that is,
Nicolas> that one nodes cannot assert the same ID as another
Nicolas> without sharing credentials with it. I think my text
Nicolas> implies this but does not make it sufficiently explicit.
Be careful. A DN given a trust anchor seems like a find end-point
identifier. However two nodes can share the same DN without sharing
the same credential. Under 3280 rules either the CA issued a
certificate it should not have issued or the two nodes are the same
subject. That's strong enough for the channel binding to be useful
even though the nodes may not share a credential.
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/ietf