Re: Name canon/secure name service (Re: kink-09)

On Sep 13, 2005, at 06:14, KAMADA Ken'ichi wrote:
> host->address was in my mind.
> Suppose an environment where the granularity of SA or principal
> is hosts.
> Two users are on sharedhost.example.com, which has 10.0.0.9.
> They wanted to be protected by KINK and typed  
> somehost.good.example.com
> and anotherhost.bad.example.com respectively.
> And if, both hostnames were resolved to 10.0.0.1...
>
> Then, what the KINK daemon on the sharedhost.example.com should do?
> Which key should be used to protect the SAs between 10.0.0.9 and
> 10.0.0.1?

Ah, I see.  Interesting...  I'm not sure what to do about this case.

> I don't think this is a KINK/Kerberos specific matter, though.

No, it isn't.  How would a non-Kerberos IPsec deployment deal with  
such a case?

Ken