Re: [Isms] wg last call followup - sshtm

[Wes Hardaker <wjhns1 at hardakers.net>]

>>>>> On Thu, 5 Mar 2009 11:57:30 -0500, "David Harrington" <ietfdbh at comcast.net> said:

>> So in both cases (with or without the bob@ format), the NO does
DH> access
>> control against a locally known securityName that is bound to an SSH
>> transport address via local configuration and the engine has to make
>> sure that the SSH host is getting properly authenticated before
>> shipping the notification.

DH> OK. I do not think the draft states this adequately. 

DH> Should we add a version of this last paragraph in the security
DH> considerations? in the SSH introduction? maybe section 3.3 for
DH> notifications and proxy? 

I tried to put something like that in the security considerations
section for the document I posted yesterday.  Does it meet your needs?

DH> should we separate the notification case from the proxy case, since
DH> proxy does not do access control?

There are two separate cases:

Clients that does access control before sending (NOs only)
Those that don't                                (everything else)

I wouldn't spell out proxies generically since they're already lumped
into the other case.
-- 
Wes Hardaker
Sparta, Inc.