[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Hybrid Authentication and Remote Access
I wasn't planning on commenting on this until I'd had a bit more time to
review it, but so long as you're bringing it up, I will voice one
criticism of the hybrid-auth draft: ISAKMP Notify messages are ONE-WAY.
You are using them for a 2-way exchange. This is a hack. Read the other
drafts. Hacking your enhancements into the protocol is ridiculous and
unjustified, given that the working group is entering another round in
which such modifications may be properly implemented if appropriate.
Aside from that criticism, I agree that there is a need for such a
mechanism, and that this proposal meets that need in one way, and Roy's
isakmp-xauth proposal meets it in others. It's certainly worthy of
continued discussion.
Follow-Ups:
References: