54 - marcelo's editorial comments

Jari Arkko writes:
> >I am not sure that the example of the certificate is a good example... 
> >what if the certificate is self signed? (i don't know if those are 
> >supported) but in any case, i don't know how simple is that certificates 
> >can prove address ownership (this depends of the checks performed by the 
> >CA about address ownership)
> >
> Right. Suggested text change: s/the address is
> included in the peer's certificate/the address is
> included in a certificate given to the peer by a trusted
> authority/

The certificate is not normally given by trusted authority in the
exchange, it is signed by the trusted authority and the other peer
normally presents it.

On the other hand, I do not see any problem with the original text. If
certificate is not trusted by the peer, this will lead the peer to
reject the authentication because there is no valid certificate, thus
it does not matter what the certificate had.

Of course you DO NOT use any information from the any other
certificates than from the one that was used in the authentication.

Also in some scenarios self-signed certificates with opportunistic
approach could be used.

If you want to change that text then "the address is inlcuded in the
certificate used to authenticate the other peer". 
-- 
[email protected]