[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Bruce Schneier on IPsec
Hugo Krawczyk wrote:
<significantly trimmed...>
> PS: After defending ipsec for once, I'd like to see also openess in the group
> for changes that significantly improve the quality of the protocols
> even at the cost of hurting some existing implementations (and the sooner
> things are fixed the better).
> We can start with many issues that [FS] point out (and other that
> were discussed in this list) that can be "resolved" by textual clarifications,
> and then proceed to the fixes that also require changing the
> "bits on the wire".
I agree with this sentiment, and also with Paul Koning's comments on
this topic. There are some errors and misconceptions in the paper, but
there is much of substance, as we all know. It is a normal part of the
IETF process to modify developing standards as a result of
implementation experience and analysis, and we know that IKE is already
undergoing modifications for this very reason. While it may be expensive
for companies deploying such early implementations to modify them, I
think this is a price we must pay to play.
Scott
References: