Re: Identifiers

[Eliot Lear <lear@cisco.com>]

Marcelo & all,

It sounds like Brian started pretty darn close to where I would be:

> My assumption is certainly that we can trust the first address pair,
> to exactly the extent that we can trust it in a non-multihomed case.
> Is that a wrong assumption?

I think a good solution in this space would not weaken the authenticity 
of any existing identifiers.  And this is why I liked NOID.  You want 
strong security?  The claim is that it will work with DNSSEC for 
verification.

Beyond that, if you have an existing line of communication between you 
and a host, wouldn't PBKs provide a secure means by which one could 
privately pass additional information?  If it does, it provides some 
really nice generality for the above.  For instance, if you use some 
very secure mechanism to establish connectivity then PBKs could provide 
continued assurance.  And if you were out in the open, PBKs provide less 
assurance (e.g., you still end up with potential MITM attacks).

Regards,

Eliot