On 2.3.2015, at 15.55, Mikael Abrahamsson <[email protected]> wrote: > On Mon, 2 Mar 2015, Margaret Wasserman wrote: >> I think Markus' comments on security are also very important to consider >> here, as some sort of integrated security mechanism between the routing >> protocol and HNCP might be strongly desired. > > Yes, I agree that HNCP has gained security that currently none of the routing > protocols have, and that this is important. > > Then one can always discuss what kind of information could go into each > protocol after bootstrap. Perhaps what we actually need is a new bootstrap > security protocol (not only for homenet), and that this is where the emphasis > should be.
Possibly. However, even if we had one, bootstrap protocol does not lead easily to widely shared PSKs, and that’s what routing protocols require. E.g. anima bootstrap stuff is focusing only on enrolling certificates. If I had a certificate, I am not sure how it helps with PSK IS-IS scheme. Babel + IKE + IPsec, on the other hand, could of course run with the certificate, but would not be link-state => hard to replicate state. Looking at fast adoption, perhaps OSPF would be preferable then, as it already runs over IP so the story would be just ’take TEH BOOTSTRAPPER, IKE, IPsec, OSPF’ and world is your oyster. No standardization required (beyond dst-src draft by Baker, just like IS-IS). Cheers, -Markus _______________________________________________ homenet mailing list [email protected] https://www.ietf.org/mailman/listinfo/homenet
