Re: identity persistence and comparison issues

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On 2004-06-28, at 14.45, Erik Nordmark wrote:

>> What if we just always show the application a long-lived identifier,
>> even though when it sets up a session we use ephemeral identifiers?
>
> That's part of what Jukka and I were pondering a bit.
> I think it is very interesting; just need to make sure that
> the additional local mapping on the host from the long-lived to
> the ephemeral doesn't introduce attacks that we don't know how to
> handle.

Without having thought this through very much I have a few questions on 
this,

As you would need to keep state that would be very much like a cache. 
Would you not open your self up for "cache-poisoning" very much like 
todays DNS?

- - kurtis -

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3

iQA/AwUBQOPHFaarNKXTPFCVEQLEqACfX3JL9KkJQkiflYwE8rosfUE8otQAoLuh
CIRhucKydadbJeOfgWlNAK/D
=fNTb
-----END PGP SIGNATURE-----