On 7 jul 2009, at 22:21, Dave Thaler wrote:
CGAs are only useful when they're assigned to a host, not in the
address space of protocol A that represents the address space of
protocol B.
Disagree. I'm not sure it's a big deal, but I disagree it has
0 worth. CGAs are useful to prevent spoofing. If a translator
chooses to use a CGA to represent an IPv4 host, then spoofing
it is _extremely_ difficult.
A CGA ties a public key to an address. This is useful if you have
people sending you packets with a source address that may or may not
belong to them. In the NAT64 case that would mean that a fake NAT64
tries to spoof the source addresses (that encode IPv4 addresses) of
the real NAT64. But since the IPv6 host sets up the session in the
first place, all of this is taken care of (for a low level of
security) by return routability. Sessions can also be protected by SSL
through the NAT64 directly to the IPv4 destination or with IPsec
between the host and the NAT64. Both of these are much more useful
than CGA if a high level of security is required. But I don't see how
it would be, at some point you have to assume that if you give people
packets they will take care of them.
