On Tue, Sep 22, 2009 at 01:02:40AM -0400, Christopher Morrow wrote: > which www.mozilla.com did you visit? (substitute microsoft.com for > updates or bank-of-boston.com for banks..)
It doesn’t matter as long as they are all really mozilla.com. If
www.mozilla.com is a server farm behind a load balancer with each
instance having a different certificate with the same DN, does it
matter. Indeed having someone who is *not* mozilla.com have a
certificate that claims it is, is a problem!
[Note: It would be interesting to test my example above and see what
the browsers do, given its a “corner” case we don’t see in the real
internet, there may well be bugs, but that is besides the point]
What I can assert is that we have people with client side X.509
certificates (different ones, for different computers with different
keys) go to the same website all the time without problem... and have
for 12+ years!
> Yes, there should be more/better authentication from server to client
> (and vice versa) but today as a client you don't know... anyway this
> isn't super helpful in the route-object world, I don't think.
Actually as a client you *do* know. The problem with *knowing* which
website you are going to isn’t one of certificate hierarchy
issues. The problem has to do with fooling the ignorant user into
thinking that paypal.com.broken.into.domain.com is really PayPal etc.
Hopefully RPKI won’t have these problems because we are dealing with
route ranges and AS numbers which are interpreted by code, no humans.
> Sure, IANA was a simple guess on my part, a pseudo-RIR seems fine to
> me. Was the legacy space holder problem the only problem you had with
> the RPKI as it's been discussed? (and a psuedo-RIR would satisfy your
> concerns I think, right?)
This is an important case, but not the only one. For example today
what happens if a route registry decides to raise its price by a
factor of 1,000. People will turn on it (and they know this). But what
happens when they raise the rate by a factor of 1,000 just for some
customers (who they perceive as having deep pockets) and use RPKI to
enforce this mandate. Sure, you can go to court.... and the legal
process will grind... while you are not routed. Now this is a
contrived example, so please don’t start criticizing it. The point is
that when you change the balance of power between parties you open the
door for various forms of abuse.
-Jeff
--
========================================================================
Jeffrey I. Schiller
MIT Network Manager
Information Services and Technology
Massachusetts Institute of Technology
77 Massachusetts Avenue Room W92-190
Cambridge, MA 02139-4307
617.253.0161 - Voice
[email protected]
========================================================================
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
