[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Name canon/secure name service (Re: kink-09)


On Sep 13, 2005, at 06:14, KAMADA Ken'ichi wrote:
host->address was in my mind.
Suppose an environment where the granularity of SA or principal
is hosts.
Two users are on sharedhost.example.com, which has 10.0.0.9.
They wanted to be protected by KINK and typed somehost.good.example.com
and anotherhost.bad.example.com respectively.
And if, both hostnames were resolved to 10.0.0.1...

Then, what the KINK daemon on the sharedhost.example.com should do?
Which key should be used to protect the SAs between 10.0.0.9 and
10.0.0.1?

Ah, I see. Interesting... I'm not sure what to do about this case.

I don't think this is a KINK/Kerberos specific matter, though.

No, it isn't. How would a non-Kerberos IPsec deployment deal with such a case?

Ken