[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Comments on draft-ietf-ipsec-ike-01.txt (long)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> From: Derrell D. Piper [mailto:ddp@network-alchemy.com]
> Sent: Thursday, June 03, 1999 12:39 PM
>
> > So let me ask the entire working group: should vendors
> > be prohibited from accepting a key length greater than
> > what they have configured? Should they be prohibited from
> > accepting a stronger group?
>
> Absolutely not and I'd go so far as to make it a SHOULD
> instead of a MAY.
>
> We're trying to design good security, not workarounds for bad
> implementations.
>
Hmmm, this means if a policy _explicitly_ states 128 bit encryption
(note, the policy _did not_ state 128 bit encryption or greater),
then IKE has the right to change the policy to be 128 bit or greater?
IMHO, IKE must act dumb when it comes to policy and must not assume
it knows better then whatever set that policy. Here we seem to be
arguing that good security is allowing stronger encryption even when
stronger encryption is precluded by the policy. I would argue that
good security offers no such surprises.
I can imagine applications that may not want to manage, or be capable
of managing, the extra 320 bits (above 128) possible in in Blowfish.
I can imagine machines not wishing to do the extra work required of a
stronger group.
- -Michael Heyman
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1b23
iQA/AwUBN1bxJrXbkJfuXzRQEQK9ZACeNTT47NLq7FWfpLG5YECiBTany78AoLhe
W00MD2vdcnzlKZyiPSez+BnP
=gcBZ
-----END PGP SIGNATURE-----
Follow-Ups: