[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: IPsec near term work
Steve,
It was also only with some trepidation that I sent my original
message, as I didn't want to start a flame war. But this topic is,
regrettably, inescapable. Believe me, I would like nothing better than
to be proven wrong here -- that there are no significant obstacles to
our using public key cryptography as we see fit to secure IP. But I
fear that I am right.
>o A substantial amount of the criticism in the community comes from
> people who believe that software ought not be patentable, that
True. I'll avoid this particular issue, except to make the obvious
point that if public key cryptography were in the public domain, we
wouldn't be having this discussion, and we would quite likely have
fielded real systems by now.
>o Licenses for public key technology are obtainable. RSADSI and PKP
> seem to consummate deals quite regularly, and quite a few major
Yes, but. The problem isn't so much that you have to pay and get a
license to use public key cryptography, but that PKP puts so many
conditions on it. Conditions that I feel unreasonably hamper our
traditional freedom to explore multiple technical approaches in
parallel, with experience and the marketplace choosing the eventual
winner.
Case in point: approaches to public key certification. I personally
strongly prefer the PGP "mesh" model over PEM's strict hierarchy. It's
much more elegant and easier to use than the PEM model, which it could
even handle as a special case. It's also far more practical in a
decentralized environment like the Internet. I would very much like to
explore the use of the PGP certification structure as a base for IP
security.
You and others may disagree. Fine; reasonable people often do.
There's no problem as long as we can all prototype our approaches,
test them, and let the market decide the winner(s). It's happened many
times before in the Internet, and it's a proven way to make progress.
However, this assumes that we all play on a level
field. Unfortunately, it's not. PKP blesses only the PEM model, and
they have consistently refused to grant licenses, at any price, for
the use of PGP and PGP-derived software, even for personal use. The
only notable exception is ViaCrypt, which was apparently able to
obtain a license only because PKP didn't know what they wanted it for.
The popularity of PGP (3,106 registered keys on the keyservers as of
my last look), despite PGP's "underground" legal status and the
availability of "blessed" alternatives such as RIPEM, just underscores
the appeal of PGP's approach to key management.
PKP has also, to my understanding, denied repeated requests to allow
modification of the RSAREF interfaces to accomodate PGP even for
personal use. This makes RSAREF much less than useful to me, given
that I would like to personally experiment with PGP-style IP security.
In other words, I'm stuck -- either I pursue an approach that I
consider to be technically inferior with PKP's blessing, or I "go
underground" and pursue the approach that I really believe in.
I'm not particularly enthusiastic about either alternative.
Phil
Follow-Ups:
References: