To:
keydist@cafax.se
From:
Michael Richardson <mcr@sandelman.ottawa.on.ca>
Date:
Thu, 10 Jan 2002 15:31:12 -0500
In-reply-to:
Your message of "Thu, 10 Jan 2002 14:20:40 EST." <v0313030eb8639902f9f4@[199.171.39.21]>
Sender:
owner-keydist@cafax.se
Subject:
Re: Is this something to solve
-----BEGIN PGP SIGNED MESSAGE-----
>>>>> "Edward" == Edward Lewis <lewis@tislabs.com> writes:
Edward> I'd like to collect scenarios of things we would want to solve. E.g.:
Edward> ====
Edward> In SSH, I have a host at my home institution named "beagle." When I go to
Edward> the IETF, I carry beagle's SSH host key configured in my client. But while
Edward> I am away, beagle crashes and is down for some time. But since my home
Edward> institution uses NIS, I could log into "retriever" with the same name and
Edward> password and still get to my home directory. The problem is that I don't
Edward> have retriever's SSH host key configured because I didn't cover my bases in
Edward> the event of a crash on beagle.
Edward> How do I make SSH's "trust" robust in the light of beagle's crash?
Edward> ====
Edward> Does this sound like a rational example?
Yes, I think that it is.
However, I think that one answer in our problem space is that you should
have taken a copy of your institutions' apex DNSSEC public key.
It isn't easy to know what to do with it right now.
(I think that putting it into the named.ca file doesn't work for some reason)
The answer therefore does not depend upon a global PKI or trust model.
] ON HUMILITY: to err is human. To moo, bovine. | firewalls [
] Michael Richardson, Sandelman Software Works, Ottawa, ON |net architect[
] mcr@sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: latin1
Comment: Finger me for keys
iQCVAwUBPD36D4qHRg3pndX9AQGd5AP9Ej9pTJo26s9So5JpkCZxUy9+JfnTv+ts
3pxViaTY2G9PTmhZ7Dy3arjweAWSnKdUl9n4MKnJHACcMhHbSNwb+HVCSjkHDlI6
LfJ5AOVB+/hiujEzXoWt3fYIWpJ5wx3XcEpz4gTm3G4tEyq4StUjaH8mvPmD//Jn
csoKMShxJfA=
=L4nP
-----END PGP SIGNATURE-----