[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: manual keying and IPSEC conformance
I agree with the several suggestions to make ISAKMP a mandatory
part of IPsec for IPv4.
And I agree with Dan's rationale for continuing to keep manual keying
as a mandatory requirement. The only flaw with this scheme was pointed
out by Rodney Thayer's distinction between "really manual" and "some
other KMP plugged into the manual keying interface". If we are going
to prohibit Anti-Replay for manual keying, it should be explicitly
stated that it is only prohibited for "manual keying requiring human
intervention for rekey".
I don't know if there are any other requirements which depend on
manual vs. automatic. If so, they should all be clearly stated as
such, so that all KMPs are treated as automatic keying for purposes
of interpreting the requirements.