Re: [Sip] comments on draft-kupwade-sip-iba-00

["James M. Polk" <jmpolk at cisco.com>]

At 11:41 PM 2/26/2008, Eric Rescorla wrote:
> > I must say I didn't understand how revocation works. From the
> > description of the algorithm it seemed untenable. The verifier never
> > needs to obtain a cert and the public key is generated statically from
> > the identity. Once they have the private key, the sender can always sign
> > with it, so I don't see how revocation is possible.
>
>The way this is done is with what's effectively short-lived
>identities (you could do the same thing with short-lived
>certificates) you treat the time as part of the identity.
>E.g., you might be "jdrosen at cisco.com:March-April, 2008". So,
>the user needs to periodically refresh his private key to match
>the new identity. If the key has been revoked you don't issue
>new keys.

naive question

what burden does this put on a peer (or all peers) to (conceivably) 
have to constantly discover JDR's public key, for example (because 
they don't know how long the private key is good for)?

Or is this problem known/expected or solved easily already?


>-Ekr

_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors at cs.columbia.edu for questions on current sip
Use sipping at ietf.org for new developments on the application of sip