Re: Advantages and disadvantages of using CB64 type of identifiers

[Erik Nordmark <Erik.Nordmark@sun.com>]

> i mean, if the iid is used by apps to provide some form of 
> authentication/authorization, having a public key that matches with the 
> iid may enable to impersonate the real owner of the iid, right?
> and since the iids are crypto, one may assume that apps may want to use 
> to authentication, i guess.
> But this may depend on the details, i guess.

If the upper layers, the application itself, TLS, and IPsec,
*only* use the AID as the identifier (and not a certificate name with a PKI,
or a longer hash of the same public key that was used to generate the CGA)
then this would be a concern.

But I suspect that even opportunistic IPsec would rely on having e.g. the
full public keys in the DNS or something similar.

Hence hash collisions would only be useful for redirecting the encrypted
content.

   Erik