Re: [Sip] comments on draft-kupwade-sip-iba-00

[Dean Willis <dean.willis at softarmor.com>]

Eric Rescorla wrote:

> In any case, I'm not sure why we're having this discusion since
> all the same trust issues apply to IBE schemes. The only respect
> in which they don't apply to IBE schemes is if you have a single
> global KG, but of course you could have a single global CA,
> too. It's just that nobody wants to do either.

A global or semi-global KG makes excellent sense in large domains,
especially where there are significant resource constraints.

Consider, for example, the 3GPP world of GSM phones. A KG hierarchy
rooted at the GSMA with each operator then having a subordinate KG could
make a lot of sense. We could get end-to-end security with significantly
fewer bits being transmitted than if users had to send copies of their
certificates along with every message.

Similar characteristics apply in peer-to-peer cases. The enrollment
process could include a KG interaction. The resulting identity could be
used with IBS for node identification in the overlay as well as message
source verification ("identity" in and RFC 4474 context). This helps
prevent a number of the easy attacks on P2P infrastructure. And of
course, IBE could provide for message privacy as well as integrity
across the untrusted peers that will be serving as proxies.

--
Dean
_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors at cs.columbia.edu for questions on current sip
Use sipping at ietf.org for new developments on the application of sip