Re: Shim6 proxies

[Paul Jakma <paul@clubi.ie>]

On Wed, 14 Jun 2006, Erik Nordmark wrote:

> The host (which doesn't have a cert) uses HBA. Looks up 
> www.example.com and gets some IP addresses. The shim6 layer on the 
> host is told the FQDN for the peer.
>
> During the shim6 context establishment TLS is used, which verifies 
> the server's cert.

FWIW: When[1] DNS-Sec is involved, you may well already have 
verified credentials for:

- the example.com zone
- the www.example.com address record
- potentially an RSA public key for www.example.com itself

In which case, as an optimisation, the whole TLS setup and 
verification could be left out - redundant.

1. Which might actually happen within the next few years, as ISC seem
   to be really trying to jump-start deployment.

regards,
--
Paul Jakma	paul@clubi.ie	paul@jakma.org	Key ID: 64A2FF6A
Fortune:
Well, you know, no matter where you go, there you are.
		-- Buckaroo Banzai