[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Last Call for IPSEC

  The "flaw"? The name is a flaw? 

  Please tell me your opinion on The Point-to-Point Tunneling Protocol.
There are others, and some would say better ones, yet no one claims that 
PPTP is flawed because of its name. And no one is upset at the broadness 
of it's claim to be _The_ Point-to-Point Tunneling Protocol.

  The problem of the conglomeration of a plug-in? If there was any doubt
anywhere that the IPSec WG was finished, I hope this rediculous discussion
dispells it. 

  Dan.

> Lewis McCarthy wrote:
> > 
> > Peter Ford writes:
> > > 3) calling anything the Internet
> > > Key Exchange (IKE) should not happen since there are many Internet Key
> > > Exchanges going on in the Internet today and several are being standardized
> > > by Internet working groups(e.g TLS).
> > 
> > Until now I didn't realize you were raising this as a serious objection.
> > To my ear, calling the key exchange for the "Internet Protocol" the "Internet
> > Key Exchange" makes the terminology nicely consistent. 
> 
> ...and therein lies the flaw: it is not 'the' key exhange for IP, it's
> 'a' key exchange, of which there are many others.
> 
> <snip...>
> 
> The initial assessment (in my view) is correct: IKE is too broad, and
> perhaps even misleading. This nibbles around the corners of a larger
> problem which I'm surprised no one has mentioned. ISAKMP is the base
> protocol within which key exchange takes place. However, it is NOT
> strictly a key-exchange protocol. In fact, it is primarily a SA
> management protocol, of which key exchange is one component. The point
> is, ISAKMP is the protocol here, not IKE.
> 
> ISAKMP is designed to accept key-exchange plug-ins. This makes ISAKMP a
> well-designed protocol, in that if we find flaws with the key-exchange
> component, it may be replaced without designing an entirely new
> protocol. This seems quite reasonable to anticipate, given the relative
> dearth of practical operating experience in this frontier.
> 
> The IKE document proposes an instantiation of a key-exchange plug-in,
> and describes (for purposes of clarity) the entire conglomeration of the
> plug-in and the base component in one document, and there now seems to
> be this general notion that this is the new ISAKMP, and that (the old)
> ISAKMP is now irrelevant. What happens if we find a flaw with the key
> exchange portion of the conglomerate? What do we call the next iteration
> (if there is one)? The 'Better Internet Key Exchange'?? The 'Second
> Internet Key Exchange'? 
> 
> I would suggest that the title of the document convey the actual
> document contents. It was called 'The resolution of ISAKMP with Oakley'.
> Perhaps it should be called something like 'The Oakley Key Exchange for
> ISAKMP', which more accurately describes it than the current title.
Follow-Ups: References: