<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Both resources are very helpful. I was looking for something like that.</p>
<p>Thanks a lot,</p>
<p>Nikos</p>
<div id="signature"></div>
<p><br /></p>
<p id="reply-intro">Στις 2024-01-15 23:07, Lixia Zhang έγραψε:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">On Jan 14, 2024, at 11:25 PM, <a href="mailto:fotiou@aueb.gr">fotiou@aueb.gr</a> wrote:<br /><br />Hi Lixia, all<br /><br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">yes all trust anchors have limited scope, and different trust domains have</blockquote>
different trust anchors.<br /><br />My question is about limiting the scope of a trust anchor within a domain.<br />E.g., in ndn testbed, would be possible to use different trust anchors for /ndn/edu/Arizona and for /ndn/edu/Memphis?</blockquote>
<br />I could offer 2 explanations here:<br /><br />1/ as illustrated in an old TR from 2018, <br />"An Overview of Security Support in Named Data Networking"<br /><a href="https://named-data.net/wp-content/uploads/2018/07/ndn-0057-4-ndn-security.pdf" target="_blank" rel="noopener noreferrer">https://named-data.net/wp-content/uploads/2018/07/ndn-0057-4-ndn-security.pdf</a></div>
<br />
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><br />you could see that even under the same high level namespace (/ndnfit), /ndnfit/Alice has its own trust anchor (you could lookup the TR for more details). This TR is from 6 years back. We are working on a revision now, one of the things is to add the trust domain concept to it. <br /><br />2/ The testbed trust model: it was put together more than 10 years back. Over that time we gained much better understanding about security/trust models. There has been a plan to change it to a multicampus collaborative/peer model, i.e. each site sets up its own trust anchor (as your msg suggested). As an example, see ACM ICN 2022 poster "Intertrust: establishing inter-zone trust relationships"<br /><a href="https://dl.acm.org/doi/abs/10.1145/3517212.3559489" target="_blank" rel="noopener noreferrer">https://dl.acm.org/doi/abs/10.1145/3517212.3559489</a><br />(we replaced "trust zone" with "trust domain", to avoid potential confusion with tpm trustzone)<br />But we are yet to get some manpower to change the testbed to multiple trust domain models (we are looking for help!)<br /><br />Lixia<br /><br /></div>
</blockquote>
</body></html>