[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Comments on latest IPSP drafts
From: Mark H Linehan/Watson/IBM Research <linehan@watson.ibm.com>
Date: 7 Apr 95 17:10:05
- There has been a lot of discussion about whether the DES-CBC
transport should be required. I respectfully submit that there is a
set of organizations and individuals who MUST (in a much more
significant sense of "MUST") obey U.S. (and other nation's) laws and
who will require an engineering solution to provide exportable
encryption.
This is a common fallacy. There is no requirement that vendors MUST
provide exportable encryption. Vendors can simply not export their
products outside the U.S., or provide an alternative product which
simply does not provide encryption at all.
This topic was discussed at the Security Area Advisory Group at the most
recent IETF meeting, and the consensus of the SAAG (by a strong
majority) was that the standard should require encryption, and strong
encryption at that (recognizing that some vendors may decide to only
provide IPv6, a.b.e. --- "all but encryption") but that this since this
was the technically correct thing to do, we shouldn't back down.
The area director that asked the group for their opinion about what what
our recommendation should be if the IESG pushed back on requiring strong
encryption ---- should we mandate encryption, but specify a weak
encryption algorithm, or make encryption optional, but if you do
implement encryption, you must do strong encryption? The overwhelming
sense of the group was that given those two choices, it was better to
make encryption optional, but make DES mandatory if you do implement
encryption, instead of making encryption mandatory, and but specifying a
crippled encryption system, since that would only give users a false
sense of security.
- Ted
References: