[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Human I&A, IPsec, and their non-relationship


Hilarie Orman says:
> The motivation for per-user keying based on chosen plaintext seems
> unconvincing to me.  The amount of data sent per key can be controlled 
> by the OS, and adjusted to a conservative value based on the algorithm 
> in use.  Wouldn't it be cheaper and safer to rekey host-host
> connections than to negotiate and rekey many user/host keys?

Completely agree.

Further, I think that selection of the security association should be based 
on information that is normally used in the IP layer.

Russ