[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Comments on draft-ietf-ipsec-ike-01.txt (long)
>
> >> So let me ask the entire working group: should vendors be
> >> prohibited from accepting a key length greater than what they have
> >> configured? Should they be prohibited from accepting a stronger
> >> group?
>
I may be in the minority here but I see this as an implementation
issue. I would argue that a system should be configured to provide
a level of security comparable to the value of the information
being protected. Overriding that configuration just because it is
capable doesn't necessarily mean it should.
I'm not arguing for prohibiting such behavior. I'm just not for
recommending it. If an implementation chooses to accept such
behavior that fine. On the other hand, an implementation could
just as easily allow such behavior to be configured.
thanks,
David W. Faucher
Follow-Ups:
References: