Re: linux-ipsec: Re: your mail

Hello,

> On Tue, 1 Dec 1998, John Gilmore wrote:

Basic (or long term) requirement I see here is to support Public-Key-Encryption and Signature authentication modes of IKE. Beside supporting the needed crypto routines (RSA), this requires the whole certificate *verification* stuff, too.

Basically I agree with John's stepping, while I want to "partition" it a bit more:

> On Tue, 1 Dec 1998, John Gilmore wrote:
> My guess at what needs doing is: First, IKE needs to be able to

Which includes to recognize requested auth. mode, "payload-payload"-en-/decryption, support of CERT payloads (possibly some more things) - I'd suppose this requires some major redesign of pluto's protocol engine (Hugh Redelmeier, what would you say?)

> Once it can do that, then, IKE needs to do a DNS lookup to get an

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

Until that, are we interoperable for PKE/SIG, yet?

> Once it can do that, we'll need a few utilities for easily

Hmm, only for public keys of entities stored in "DNS certificate hierarchy", right? Advantage is, that the whole verification process is done by the resolver lib.

But I'd argue that we later should support at least X.509/PKIX certificates, too (for that part, SSLeay might be a good starting point). These certificates can be retireved by IKE itself (CERT payload), from DNS (which is serving as a directory service here) or by LDAP from any "independent" directory service.

Whichever will be the first, I'd design the whole "public-key-retrieving-and-certificate-verification"-process as an independend subsystem. Is there a standardized interface to such a subsystem, already?

Greetings
Kai

# Kai Martius                                                           #
# Dpt. of Medical CS and Biometrics / Dresden University of Technology  #
# PGP Fingerprint: to be compared after download of my key              #
# Key and more info (especially IP-security related) see my Homepage    #
# 
http://www.imib.med.tu-dresden.de/imib/personal/kai.html              #